The Missing Layer in Robot Safety Assurance

A new analysis from VicOne warns that robot safety assurance must account for adversarial attacks that alter perception, decision-making, or action, citing research showing backdoor attacks on Vision-Language-Action models with up to 97% success rates and a Bluetooth exploit chain called UniPwn affecting quadruped and humanoid robots. The report highlights that conventional safety assessments miss these risks, which can be introduced through training pipelines, system infrastructure, or runtime perception.

Why robot safety assurance must account for attacks that can change how a machine sees, decides, and acts. Robot safety has traditionally asked: Can a machine remain safe when something goes wrong? Physical AI raises a harder question: Can it remain safe when an attacker changes what it sees, decides, or does even when nothing appears to have failed? Modern robots perceive through multimodal sensors, interpret context using AI models, and translate those interpretations into physical action. As they move into dynamic environments, their safety increasingly depends on the integrity of the data guiding their decisions. That dependence creates risks conventional safety assessments may not fully capture. Recent research has demonstrated that manipulating what a robot sees, hears, or interprets can redirect its behavior without requiring direct control. Such manipulation can occur across the robotic brain — a layered attack surface encompassing training pipelines, system infrastructure, and runtime perception. Layer One: Corrupting intelligence at its source In 2017, BadNets https://arxiv.org/abs/1708.06733 demonstrated that a model could behave normally under most conditions, yet fail in the presence of a specific hidden trigger. In one example, a subtle pattern caused a stop sign to be misclassified as a speed limit sign without affecting the model’s behavior on other inputs. What began as a classification vulnerability has since evolved into action manipulation. At NeurIPS 2025, researchers introduced BadVLA https://arxiv.org/abs/2505.16640 a backdoor attack targeting Vision-Language-Action VLA models that allow robots to see, interpret instructions, and produce coordinated physical movement. Rather than altering a single label, the attack caused conditional deviations in the robot’s action trajectory when a trigger was present. Without the trigger, the model largely preserved normal task performance, while the backdoor remained effective under task transfers and model fine-tuning. A related study in 2025, GoBA https://arxiv.org/abs/2510.09269 , showed that ordinary objects such as a coffee mug could serve as a reliable trigger. The researchers reported a 97% attack success rate without degrading performance on clean inputs. These studies expose a blind spot in model validation: a model may pass testing yet produce corrupted behavior when a hidden trigger appears in operation. The safety question is whether it remains within its task and safety boundaries under adversarial conditions. Simulation tools such as NVIDIA Isaac Sim™, when paired with VicOne Radeis, can test the effects of manipulated inputs before deployment. Video 1. VicOne LAB R7 demonstrates Radeis, a Physical AI safety validator for NVIDIA Isaac Sim that tests how adversarial visual inputs affect robot behavior before deployment. Layer Two: System vulnerabilities as gateways to AI control Even a securely trained model can be subverted if the surrounding system stack is vulnerable. In September 2025, researchers disclosed UniPwn https://github.com/Bin4ry/UniPwn , a Bluetooth exploit chain affecting quadruped and humanoid robots from a major manufacturer. Hardcoded cryptographic keys allowed traffic decryption, authentication checks were bypassed, and command injection enabled root-level execution. The exploit is also described as “wormable.” A compromised robot could scan nearby units and potentially affect an entire fleet. Video 2. VicOne Lab R7’s demo shows how chaining three wireless exploits can trigger uncontrolled robot behavior within 60 seconds, resulting in operational disruption. Middleware creates another exposure point. Vulnerabilities in ROS 2 and DDS-based systems can enable arbitrary code execution or abuse unauthenticated topics to deliver malicious commands. With sufficient access, an attacker could override motor commands or replace AI model weights without directly attacking the model architecture. In this case, the components may still function as designed. What has changed is the trustworthiness of the commands flowing through the system. Vulnerability management can help teams identify known risks before deployment, while continuous monitoring can surface emerging threats. Layer Three: Manipulating perception and reasoning at runtime At runtime, manipulating inputs that shape perception or reasoning may require neither firmware modification nor a network breach. In 2024, RoboPAIR https://robopair.org/ demonstrated how carefully structured prompts could redirect LLM-controlled robots into unsafe trajectories. BadRobot https://arxiv.org/abs/2407.20242 exposed a deeper architectural weakness: in several cases, a robot verbally refused a dangerous command while its motion controller executed the action anyway. Vision-based manipulation is equally powerful. VLAttack https://arxiv.org/abs/2411.13587 showed that an adversarial patch within the camera’s view could reduce a VLA model’s task success rate to zero. FreezeVLA https://arxiv.org/abs/2509.19870 showed that a single adversarial image could freeze a robot’s decision-making loop, making it unresponsive to subsequent instructions. In each case, the camera may still work, the model may still run, and the controller may still respond. Yet the resulting behavior can be unsafe because the robot is acting on manipulated perception or reasoning. Runtime assurance must therefore look beyond whether individual components remain available and assess whether cyber events are beginning to affect physical behavior. Security event correlation, behavioral-impact assessment, and policy-bounded response supported by edge AI, can help contain the affected path without unnecessarily stopping the entire robot fleet. From point-in-time safety to lifecycle assurance The risks across these three layers reveal the missing layer in robot safety assurance: cybersecurity. Functional safety addresses failures and unexpected operating conditions; cybersecurity extends that assurance to deliberate manipulation, including attacks that may leave the underlying system apparently functional. This requires assurance across the robot’s lifecycle. During design, teams need to understand which cyber risks could invalidate assumptions behind intended behavior. Before deployment, they should test whether realistic attacks can cause a robot to deviate from its task or safety boundaries. In operation, monitoring should identify whether cyber events are beginning to affect behavior, contain the affected path, and preserve safe operation where possible. While cybersecurity does not replace functional safety, it helps ensure that Physical AI remains within acceptable boundaries even when what it sees, decides, or does is under attack. For a deeper look at the cybersecurity risks and defense strategies shaping autonomous robotics, download our whitepaper “ Securing the Rise of AI Robots: Cyber Risks, Real-World Threats, and Defense Strategies https://info.vicone.com/ai-robotics-security-risk-whitepaper?utm source=therobotreport&utm medium=sponsored-content&utm campaign=2026-09 .” Sponsored content by VicOne