Robot Safety Must Address Adversarial Attacks on Perception and Action
Traditional robot safety focuses on failures, but physical AI introduces risks from attackers manipulating sensory inputs and AI models. Research shows hidden triggers can cause robots to misbehave without degrading normal performance. The article argues that safety assurance must include protection against such attacks across the robotic brain.
The article traces how backdoor attacks have progressed from simple misclassification—such as BadNets altering stop sign recognition in 2017—to full action manipulation in modern Vision-Language-Action models. Research presented at NeurIPS 2025 demonstrated that hidden triggers could alter a robot's movement trajectories while leaving normal performance intact, with one study achieving 97% attack success using an everyday object like a coffee mug as the trigger.
Beyond model-level threats, the piece highlights system-level vulnerabilities. A September 2025 Bluetooth exploit chain affecting quadruped and humanoid robots used hardcoded keys and command injection to achieve root access, with "wormable" potential to spread across fleets. Middleware weaknesses in ROS 2 and DDS systems similarly allow attackers to override motor commands or swap model weights without touching the AI architecture itself.
This story could reshape how industries approach robot deployment in public-facing roles. If adversarial attacks on perception and action systems remain undetected during standard validation, sectors like logistics, healthcare, and autonomous transportation may face liability questions they are not prepared to answer. Manufacturers could be forced to adopt adversarial testing as a regulatory requirement rather than an optional safeguard. Consumers may also grow wary of robots operating in unpredictable environments, potentially slowing adoption of physical AI technologies in everyday settings.