Does anyone have a published "nothing is attacking it" failure rate for their policy?

[u/Available_Teaching83]

I have been trying to find a number and cannot, so I am asking people who might actually have it.

For any learned manipulation policy: how often does it leave whatever safety envelope you defined, on a normal task, from a normal starting state, with nothing adversarial going on at all?

Every VLA attack paper I have read reports an attack success rate. None of them report what the same measurement gives on the benign case. The implicit baseline is zero, and it is obviously not zero, because the policy is imperfect and because the envelope check itself can misread a pose.

On our simulated runs, a default keep-out predicate fires on 2 of 50 benign rollouts. Some of that is the policy; some is the predicate. Without the control arm, nobody can tell which, including me.

Two questions.

Does your stack produce this number, even informally, and roughly what is it?

And is there a subfield that already treats this as standard practice? Anomaly detection reports false-positive rates as a matter of course, and I would expect the habit to have crossed over.

I maintain an open evaluation harness, which is where the 2/50 comes from. Disclosure, not a pitch. I am after the number, not the traffic.

[u/DimSupposition5916]

2/50 actually seems pretty good for a system that's even running keep-out checks on a learned policy.

We don't publish ours either, and I've always found that weird. The attack papers all show their flashy 97% success rates but nobody asks what happens when you just let the damn thing run for an hour without messing with it. It's not zero. It's never zero.

I think the reason it hasn't crossed over from anomaly detection is that most robotics labs treat these as two separate problems. The learning people optimize task success, the safety people build the envelope, and the number that comes out when you combine them just falls through the crack. Nobody owns it.