Attacks on robots, and defences that work when the attacker can touch the physical world. A robot has every weakness of a networked computer, plus sensors that can be fooled and actuators that can hurt someone.
Attacks
- Sensors. GNSS spoofing is the classic. RigidShift shows a slow shift of a whole swarm defeats any check that compares drones only with each other, and Francos and others model an adversary that spoofs its own position just below what the monitor would notice.
- Middleware and networks. The humanoid security SoK maps the attack surface of a modern humanoid from firmware to cloud. The DNS papers (SAD DNS, its follow-up, SCAD) teach the general lesson: rejecting a spoofed message isn’t enough if the rejection changes shared state the attacker can read back. On a robot that shared state might be a radio’s rate limit, a middleware discovery table, or a map’s update queue.
- Models. A printed sign hijacks a VLM planner in up to 29.4% of trials (physical prompt injection). Prompts injected into one agent spread to others through shared prompt structure (multi-agent prompt injection). Backdoors in vision-language-action models survive fine-tuning (BadVLA). On the defence side, Detect and Suppress finds one internal feature that tracks an adversarial patch.
- Safety logic itself. Steinberg and Gal halt an LLM-controlled robot with one to five spoken safety phrases, in up to 98.3% of multi-turn runs. The safety layer is the attack.
- Teammates. CILC shows a compromised robot can reconstruct an honest teammate’s images from its loop-closure descriptors.
The survey of embodied agent security counts where the effort goes: attacks cluster on perception and action interfaces, defences on the action and runtime layer, and memory, world-state integrity and trust between agents get little of either.
Defences
These defences use a witness the attacker doesn’t control. Gil and others use Wi-Fi signal fingerprints that a spoofer can’t forge, Vijay and others check positions against measured ranges, and Bezzo and others check sensors against each other and a model. This is the same idea as the invariants we used in water treatment plants (see cyber-physical security).
Questions
- What is the robot version of a process invariant, for a machine whose “normal” depends on the task?
- How do you threat-model a robot team where one member may be compromised?
- When a safety phrase can stop a robot, who is allowed to say it?
Related: Byzantine fault tolerance, runtime monitoring, robust robotics, Systems Security (course).