SoK: Cybersecurity Assessment of Humanoid Ecosystem

2 min read

This systematisation of knowledge sorts published attacks and defences for humanoid robots into a seven-layer model: physical, sensing and perception, data processing, middleware, decision-making, application, and social interface. From a PRISMA-style review it builds a 39 × 35 attack-defence coverage matrix, weights it by attack severity, and turns it into a per-platform score called RISK-MAP. It also scores two-hop attack paths across layers to see where a compromise in one layer cascades into the next.

Findings

  • The search returned 530 papers; 150 were read in full and 89 kept. 68% of the kept papers date from after 2020.
  • About a third of the surveyed papers deal with ROS and DDS middleware security, the most studied topic.
  • Sensor attacks (LiDAR spoofing, IMU drift) already have concrete countermeasures such as filtering, fusion checks, shielding and freshness tests. Human-robot interface attacks are well documented but validated mitigations are scarce, so the upper layers are the weakest.
  • Scores for three robots: Digit 79.5% ± 3.2%, Unitree G1 EDU 48.9% ± 4.1%, Pepper 39.9% ± 2.8%. Uncertainty comes from 1,000 Monte Carlo runs with inputs perturbed by ±25%.
  • The highest-risk cross-layer paths run from data processing to decision-making and from sensing to data processing on all three robots.
  • Examples from the corpus include unencrypted camera and audio streams on Pepper and remote override of ROS robots through plain /cmd_vel commands.

Limits

  • Platform scores come from public datasheets, documentation and a standard deployment scenario, with no hands-on testing.
  • The authors say scores are not comparable across platforms with different capabilities: a robot with fewer components can score higher simply by having less to attack.
  • Defences are assumed to act independently when coverage is combined, and the effectiveness levels (0, 0.25, 0.5, 0.75, 1) involve expert judgement.
  • Multi-robot settings and robot-to-robot trust are out of scope.

Relevance

It maps the single-robot attack surface for robot security and finds that sensor-level spoofing is the best defended layer while middleware and decision layers are not. The layered view carries over from cyber-physical security, but it stops at one robot. A team adds a layer the model lacks: robots that report to each other, where a compromised member is a Byzantine node.