Robust robotics

3 min read

A possible thesis thread: robots and robot teams that keep working when some of their parts fail, are wrong, or are compromised. Hacked firmware, a spoofed GPS fix and a sensor that dies while still reporting plausible numbers look the same from the outside, and a robot has to cope with all three.

I come to this from eight years of cyber-physical security at iTrust, where the plant was a water treatment testbed and the defences were detectors and invariants. A robot is a control system that moves, and a robot team is a networked one.

Detection

Every detector I’ve read about depends on something the faulty part doesn’t control: a second sensor, a second network path, the physics of radio, a design document. Hand-written checks cover only what their designer thought of, and learned ones come with no guarantee. More in failure recovery.

Recovery

Most robots stop. Simplex, shields and barrier filters fall back to something conservative, and swarms cut members off. Few papers measure how long a robot stays useful after its safety layer acts. My workshop paper Safe but Stuck is about what stopping costs in the field. See also safe control.

Monitors

A runtime monitor reads the same state estimate as the controller, and none of the ones I’ve read check it. A spoofed sensor fools the safety switch as easily as the controller. See runtime monitoring.

Estimation

Outlier rejection in robust estimation copes well with look-alike places and badly with a coordinated liar. TEASER++ proves exact recovery needs at least three more inliers than adversarial outliers, the same kind of bound as in Byzantine fault tolerance.

Learned components

Robots running the same model make the same mistakes, and VLM judges lean towards calling an attempt a success. See disagreement between models and evaluating language models. Cheap attacks work on them too: a printed sign, a spoken safety phrase, a backdoor that survives fine-tuning (robot security).

Open questions

  1. How can a team tell a broken teammate from a lying one, using a witness the suspect can’t control? A broken robot can be repaired or given another job; a liar has to be cut off.
  2. What does recovery look like beyond stopping, and how do you measure it?
  3. Can a monitor know when its own inputs are uncertified, and say so to its teammates?
  4. Which alarm guarantees survive drift and an adversary at the same time?
  5. How should agreement between two robots running the same model be discounted?

Earlier pieces of this on the site: Lying robots (resilient consensus, interactive), the buoy swarm paper, and resilient consensus.

Papers

Showing 70 of 70 entries
PaperYearVenueDomain
Brain2Qwerty v22026arXiv 2026 (Meta AI)general
EmboCoach-Bench2026arXiv 2026land
Compression Principle2026arXiv 2026 (position essay)general
CaRR2026arXiv 2026general
Pow3R-SLAM2026arXiv 2026land
Discovering antagonists2026Robotics and Autonomous Systems 2026land
Semantic DoS2026arXiv preprint 2026general
Equivariant graph CBF2025arXiv 2025air
DRACo-SLAM22025arXiv preprintsea
Underwater multi-modal spatial perception2025ICRA 2025 Workshop on Field Roboticssea
RoboTwin 2.02025arXiv 2025land
AlphaEvolve2025Google DeepMind white paper, arXiv 2025general
DeNeR pursuit-evasion2025IEEE MRS 2025air
Energy-constrained coverage2025arXiv 2025general
UniDepthV22025arXiv 2025general
Intermittent faults in swarms2025arXiv 2025general
AAPD model2025Royal Society Open Science 2025land
Confidence-weighted trust consensus2025arXiv 2025land
SCAD2025IEEE S&P 2025 (listed as Oakland 2025 on the authors' site)general
Humanoid security SoK2025arXiv preprint 2025land
Range-based integrity monitoring2025IEEE Robotics and Automation Letters 2025air
Opti-acoustic semantic SLAM2024arXiv preprintsea
LLM-as-a-Judge survey2024arXiv 2024 (v6, October 2025)general
LalaEval2024COLM 2024general
ROS RV and field testing guidelines2024IEEE Transactions on Software Engineering 2024general
INVARLLM2024arXiv 2024 (v2, June 2025)general
Self-consistency2023ICLR 2023general
Hydra-Multi2023IROS 2023land
Role-based MADDPG pursuit2023ICRA 2023air
Blockchain token economy2023Science Robotics 2023land
Decentralized Blocklist Protocol2023AAMAS 2023general
LLM-guided scene graph planning2023arXiv preprintland
Verified AI2022Communications of the ACM 65(7)general
BWGNN2022ICML 2022general
Resilient task allocation2021IEEE Robotics and Automation Letters 2021land, air
SAD DNS resurrections2021ACM CCS 2021general
Kimera2021IJRR 2021land
Blockchain vs W-MSR2020Frontiers in Robotics and AI 2020land
Nav22020IROS 2020land
ROSMonitoring2020TAROS 2020general
SAD DNS2020ACM CCS 2020general
Design vs data invariants2020International Journal of Critical Infrastructure Protection, vol. 28, 2020general
SOTER2019DSN 2019air
Formal methods for robots survey2019ACM Computing Surveys 52(5)general
RoboChart2019Software and Systems Modeling 2019general
Multi-robot assembly survey2018ACM Computing Surveys 2018land
Shielded RL2018AAAI 2018general
CBF-QP2017IEEE Transactions on Automatic Control 2017land
Crazyflie 2.0 platform2017MMAR 2017air
Selective classification2017NeurIPS 2017general
Calibration2017ICML 2017general
Deep ensembles2017NeurIPS 2017general
Crazyswarm2017ICRA 2017air
MCMAS2017International Journal on Software Tools for Technology Transfer 19(1)general
Spoof-resilient networks2017Autonomous Robots 2017 (conference version at RSS 2015)air, land
Safety barrier certificates2016ACC 2016land
Observability-aware trajectory optimisation2016arXiv preprint 2016air
Distributed attack detection (SSMP)2016ACM AsiaCCS 2016general
Shield synthesis2015TACAS 2015general
Attack-resilient estimation2014IROS 2014land
LTL32011ACM Transactions on Software Engineering and Methodology 20(4)general
STL robustness2010FORMATS 2010 (LNCS 6246)general
PRISM swarm verification2010ANTS 2010, Swarm Intelligence (LNCS 6234)general
Brief account of RV2009Journal of Logic and Algebraic Programming 78(5)general
Z32008TACAS 2008 (LNCS 4963)general
Vicsek model convergence2003IEEE Transactions on Automatic Control, vol. 48, no. 6, 2003general
Simplex2001IEEE Software 2001general
Hybrid automata1996LICS 1996general
Timed automata1994Theoretical Computer Science 126(2)general
Temporal logic of programs1977FOCS 1977general
Showing 39 of 39 entries
PaperYearVenueDomain
GS underwater study2026arXiv 2026sea
AutoScientists2026arXiv 2026general
Reputation-based consensus2026arXiv preprintgeneral
FRAC-MARL2026arXiv preprintgeneral
Conformal map fusion2026arXiv preprintgeneral
CoSMO2026CoRL 2026land
MemoGuard2026IEEE Embedded Systems Letters (ESWEEK CODES 2026)land
CP-Cert2026arXiv preprintgeneral
RIWM2026arXiv preprint (perspective)general
FailBench2026arXiv preprintgeneral
Hide-and-Seek2026NeurIPS 2026general
No Free Checker2026arXiv preprint (survey)general
CILC2026arXiv preprintgeneral
Trust-aware rollout2026arXiv preprintland
Detect and Suppress2026arXiv preprintgeneral
Embodied agent security survey2026arXiv preprint (survey)general
SABER2026arXiv preprintland
Multi-agent prompt injection2026arXiv preprintgeneral
RigidShift2026arXiv preprintair
Physical prompt injection2026arXiv preprintgeneral
3DSG semantic uncertainty2026arXiv preprintland
Underwater metric depth benchmark2025arXiv 2025sea
AQUA-SLAM2025IEEE T-RO 2025sea
Agentic Robot2025arXiv 2025land
CRISP2025CVPR 2025general
SAFE2025NeurIPS 2025general
FAIL-Detect2025RSS 2025general
BadVLA2025arXiv preprintgeneral
TURTLMap2024IROS 2024sea
π02024RSS 2025land
ROMAN2024RSS 2025land, air
Diffusion Policy2023RSS 2023 (extended journal version on arXiv)land
ACT2023arXiv 2023land
C-3PO2023IEEE Transactions on Robotics 2023 (first arXiv version 2022, titled "Correct and Certify")general
MDBC2021ICLR 2021land, air
TEASER++2021IEEE Transactions on Robotics 2021general
Neural Trees2021NeurIPS 2021general
GNC2020IEEE Robotics and Automation Letters 2020 (ICRA 2020 Best Paper Award in Robot Vision)general
PCM2018ICRA 2018land

Other threads: multi-robot multimodal perception, long-term autonomy. All three on one page: thesis map.