Security for robots and the systems around them. A robot has every weakness of a networked computer, plus sensors that can be fooled and actuators that can hurt someone. My years at iTrust on water treatment plants are here too, because a robot is a control system that moves.
Concepts
- Robot security: where attacks land, and defences that use physics.
- Cyber-physical security: my earlier work at iTrust.
- SWaT testbed: the water treatment testbed.
- Byzantine fault tolerance, filed under multi-robot systems.
Entities
Datasets, platforms, tools and groups that come up in this subfield: iTrust, ROS. The entity index has the rest.
Open questions
- What is the robot version of a process invariant, for a machine whose normal behaviour depends on the task?
- How do you threat-model a team where one member may be compromised?
- When a spoken safety phrase can stop a robot, who is allowed to say it?
Papers
| Paper | Year | Venue | Domain | Threads |
|---|---|---|---|---|
| Discovering antagonists | 2026 | Robotics and Autonomous Systems 2026 | land | robustness |
| Semantic DoS | 2026 | arXiv preprint 2026 | general | robustness |
| Confidence-weighted trust consensus | 2025 | arXiv 2025 | land | robustness |
| SCAD | 2025 | IEEE S&P 2025 (listed as Oakland 2025 on the authors' site) | general | robustness |
| Humanoid security SoK | 2025 | arXiv preprint 2025 | land | robustness |
| Range-based integrity monitoring | 2025 | IEEE Robotics and Automation Letters 2025 | air | robustness |
| INVARLLM | 2024 | arXiv 2024 (v2, June 2025) | general | robustness |
| Blockchain token economy | 2023 | Science Robotics 2023 | land | robustness |
| BWGNN | 2022 | ICML 2022 | general | robustness |
| SAD DNS resurrections | 2021 | ACM CCS 2021 | general | robustness |
| Blockchain vs W-MSR | 2020 | Frontiers in Robotics and AI 2020 | land | robustness |
| SAD DNS | 2020 | ACM CCS 2020 | general | robustness |
| Design vs data invariants | 2020 | International Journal of Critical Infrastructure Protection, vol. 28, 2020 | general | robustness |
| Spoof-resilient networks | 2017 | Autonomous Robots 2017 (conference version at RSS 2015) | air, land | robustness |
| Distributed attack detection (SSMP) | 2016 | ACM AsiaCCS 2016 | general | robustness |
| Attack-resilient estimation | 2014 | IROS 2014 | land | robustness |
| Paper | Year | Venue | Domain | Threads |
|---|---|---|---|---|
| Reputation-based consensus | 2026 | arXiv preprint | general | robustness |
| CILC | 2026 | arXiv preprint | general | perception, robustness |
| Trust-aware rollout | 2026 | arXiv preprint | land | robustness |
| Detect and Suppress | 2026 | arXiv preprint | general | robustness |
| Embodied agent security survey | 2026 | arXiv preprint (survey) | general | robustness, long-term |
| SABER | 2026 | arXiv preprint | land | robustness, perception |
| Multi-agent prompt injection | 2026 | arXiv preprint | general | robustness |
| RigidShift | 2026 | arXiv preprint | air | robustness |
| Physical prompt injection | 2026 | arXiv preprint | general | robustness |
| BadVLA | 2025 | arXiv preprint | general | robustness |
Other subfields: perception, mapping and localisation, semantic mapping, planning and navigation, control, robot learning, multi-robot systems, safety and verification, Human-robot interaction, field robotics.