aiqbench analysis
This research introduces "Median Temporal Ensembling," a lightweight, training-free aggregation method for action-chunked visuomotor policies that significantly improves robustness against adversarial corruptions compared to standard exponential weighted means. By utilizing a coordinate-wise median instead of a mean, the approach maintains stable performance even when multiple predictions are compromised, offering a combinatorial guarantee on damage bounds without requiring model retraining. The technique demonstrates broad applicability across different policy configurations and failure modes, such as blank camera frames, making it a practical advancement for deploying reliable embodied AI systems.
Median Temporal Ensembling: Training-Free Robust Aggregation for Action-Chunked Visuomotor Policies
arXiv:2609.27167v1 Announce Type: new Abstract: Action-chunked visuomotor policies predict overlapping trajectories, so every executed action is covered by several predictions. Temporal ensembling smooths execution by combining these predictions with an exponentially weighted mean. One corrupted prediction can move the aggregate without bound: its breakdown point is 0. We use adversarial corruption to stress this deployed aggregator and to compare two kinds of guarantee. A metric guarantee bounds the response to a perturbation of a given size. A combinatorial guarantee instead bounds the damage when at most q of the M candidates covering a timestep are corrupted, whatever their size. Encoder adversarial fine-tuning recovers 44% of the loss under the published patch attack, but only 7.3% after the attacker's step size is increased. By contrast, the coordinate-wise median of the same candidate set keeps its recovered fraction flat as attack optimisation increases. Median temporal ensembling costs one line and requires no retraining. Across 25 (configuration, corruption-level) combinations it is never worse than the mean and is significantly better in 15. It also transfers to a second policy class, and it recovers performance under a failure with no attacker in the loop at all: camera frames that arrive blank. Its effect on clean data is configuration-dependent, from -0.04 to +0.07. We also give the boundary: corruption that shifts every covering prediction by the same amount is invisible to this whole family of statistics, and no equivariant aggregator can remove it.
Abstract:Action-chunked visuomotor policies predict overlapping trajectories, so every executed action is covered by several predictions. Temporal ensembling smooths execution by combining these predictions with an exponentially weighted mean. One corrupted prediction can move the aggregate without bound: its breakdown point is 0. We use adversarial corruption to stress this deployed aggregator and to compare two kinds of guarantee. A metric guarantee bounds the response to a perturbation of a given size. A combinatorial guarantee instead bounds the damage when at most q of the M candidates covering a timestep are corrupted, whatever their size. Encoder adversarial fine-tuning recovers 44% of the loss under the published patch attack, but only 7.3% after the attacker's step size is increased. By contrast, the coordinate-wise median of the same candidate set keeps its recovered fraction flat as attack optimisation increases. Median temporal ensembling costs one line and requires no retraining. Across 25 (configuration, corruption-level) combinations it is never worse than the mean and is significantly better in 15. It also transfers to a second policy class, and it recovers performance under a failure with no attacker in the loop at all: camera frames that arrive blank. Its effect on clean data is configuration-dependent, from -0.04 to +0.07. We also give the boundary: corruption that shifts every covering prediction by the same amount is invisible to this whole family of statistics, and no equivariant aggregator can remove it.
9 pages, 2 figures, 6 tables. Project page: this https URL
Robotics (cs.RO); Machine Learning (cs.LG)
arXiv:2609.27167 [cs.RO]
(or arXiv:2609.27167v1 [cs.RO] for this version)
https://doi.org/10.48550/arXiv.2609.27167 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 340 words
Related coverage

Game-Theoretic Disempowerment: Loss of Control to Agencyless AI
LessWrong · Sep 27, 2026
The current bottleneck is political will, not research
AI Alignment Forum · Jul 11, 2026
Multi-Level Distributional Entropy from Flow Summary Statistics for Explainable Network Intrusion Detection
arXiv · Oct 7, 2026
Safe Reinforcement Learning with Receding-Horizon Safety Critic and Differentiable Action Shields
arXiv · Oct 15, 2026