Editing a Robot Model’s Hidden Goal Without Changing Its Instructions

Changing the representation, not the instruction

Vision-language-action models combine visual observations and language instructions to produce robot actions. In this preprint, Rocio Perales Valdes and Animesh Garg ask whether changing the internal representation of a goal word can make such a model complete another task without changing the instruction it receives.

Their experiments use π₀.₅-LIBERO in simulation. In one task pair, the robot must select a black bowl identified by its location—on the stove or on the wooden cabinet—and place it on a plate. Other experiments change which object should go into a basket.

The authors report that targeted edits can redirect the robot successfully. This is not a demonstration of a physical robot being compromised: it is a controlled intervention in one model’s internal computations.

How the edits work

The researchers train sparse autoencoders, or SAEs, on intermediate activations in the model’s PaliGemma component. An SAE represents an activation using a set of features, only some of which are active for a given input. The study compares two SAE architectures, BatchTopK and Matryoshka, trained at four model layers.

For the central intervention, the researchers select features associated with the original and alternative goal words. They suppress the original word’s selected features and write in values associated with the alternative. The visible instruction stays unchanged, and the intervention is reapplied at every policy call.

Although the paper describes editing a goal word, that word or phrase can occupy multiple tokens. The intervention also changes combinations of features, rather than a single isolated feature. The authors report that additional, unselected features can switch on or off after the edited activation is encoded again.

Strong results, uneven reliability

At layer 0, a word-selected BatchTopK edit redirects the stove-to-cabinet task in all 20 tested rollouts; corresponding random-feature controls redirect none. Here, the edited policy completes the alternative task as often as the unedited policy given the alternative instruction. The authors call this performance-preserving steering.

Success is not uniform. Results vary across six scenes, feature-selection methods and layers. On the four object-selection scenes, the 16-feature-per-word BatchTopK edits at layer 0 achieve between 16 and 20 alternative-task completions out of 20. At layer 5, SAE edits in that suite achieve at most four out of 20, and the authors report no successful SAE steering at layer 11.

The architecture comparison also complicates the picture. Matryoshka features show less overlap by the authors’ measure, but this does not produce better steering. For object-selection tasks, its word-selected edits largely perform no better than random edits. Some random Matryoshka interventions are much larger than the natural activation change between words, making the controls important when interpreting apparent success.

Simpler edits also redirect behavior

SAEs are not necessary for the reported effect. Replacing the goal word’s activation with its activation under the alternative instruction succeeds in all 10 rollouts at layers 0 and 5 in both spatial scenes. This method requires a separate pass using the alternative instruction on the same camera frame.

A fixed difference vector offers another route. Computed from demonstration frames, it represents the average activation difference between the two goal words. Adding twice that vector redirects eight to 10 of 10 rollouts; equal-norm random vectors redirect none. Unlike activation replacement, it does not require an alternative-instruction pass during testing.

Where goal edits stop working

The researchers use activation replacement to examine depth more broadly. Goal-word edits remain effective through layer 6 for location tasks, but only through layer 2 for object-identity tasks. Extending the patch to the whole instruction produces a similar drop-off.

When patches also cover camera tokens, task redirection remains effective through layer 13 in both suites. This shows that the editable task information is not confined to the goal word’s representation.

These boundaries apply to the tested interventions, not to every possible way of altering a robot model. The study uses one fine-tuned model, selected simulation scenes and small rollout sets. Scenes were deliberately chosen to reduce instruction-independent success. The authors therefore present the findings as proof of existence and an initial map of goal editability—not a universal safety boundary or evidence of real-world attack reliability.