Can a robot with physical artificial intelligence remain safe when an attacker alters what it perceives, decides, or does, without any visible malfunction? This question serves as the guiding thread for an article published by IEEE Spectrum in content sponsored by the company VicOne. The text outlines risks at three levels, from model training to their real-time operation.
Physical artificial intelligence refers to machines that perceive their environment through multimodal sensors, interpret the situation using AI models, and translate these interpretations into actions. Their security therefore depends on the integrity of the data guiding their decisions. According to the article, recent research has shown that manipulating what a robot sees, hears, or interprets can influence its behavior without direct control.
Corrupting the Model at the Source
The work named BadNets, published in 2017, showed that a model could function normally in most cases, but fail in the presence of a hidden trigger. In one cited example, a discreet pattern caused a stop sign to be classified as a speed limit sign, without altering the model’s behavior on other inputs.
At the NeurIPS 2025 conference, researchers presented BadVLA, a ‘backdoor’ attack targeting Vision-Language-Action, or VLA, models, which enable a robot to see, interpret instructions, and produce coordinated movements. Instead of altering a single label, the attack caused conditional deviations in the robot’s trajectory when the trigger was present. Without it, the model largely retained its performance, and the backdoor remained effective after a task transfer or fine-tuning of the model.
A 2025 study, named GoBA, showed that an ordinary object, like a coffee mug, could serve as a reliable trigger. The researchers report a 97% attack success rate, without degradation of performance on unmanipulated inputs. This work highlights a blind spot in model validation: a model can pass its tests and still produce corrupted behavior when a hidden trigger appears in a real-world situation.
The article presents the tool Radeis, a physical AI security validator designed for the NVIDIA Isaac Sim simulation environment. According to VicOne, it allows testing, before deployment, the effect of manipulated visual inputs on the robot’s behavior.
Flaws in the System
Even a safely trained model can be hijacked if the system surrounding it is vulnerable. In September 2025, researchers disclosed UniPwn, a Bluetooth exploit chain affecting quadruped and humanoid robots from a major manufacturer. According to the vulnerability description, it is ‘wormable,’ meaning capable of self-propagation, with a compromised robot able to analyze nearby devices and affect an entire fleet. According to a demonstration by VicOne LAB R7, chaining three wireless flaws can trigger uncontrolled robot behavior in 60 seconds.
Middleware, the software layers that connect a robot’s components, constitutes another entry point. According to the article, vulnerabilities in ROS 2 and in systems based on DDS can allow arbitrary code execution or the sending of malicious commands. An attacker with sufficient access could modify motor commands or replace the model’s weights, i.e., its learned parameters, without directly attacking its architecture. The components can then continue to function as intended, but the reliability of the commands circulating in the system is no longer guaranteed.
Manipulating Perception in Real Time
During execution, manipulating the inputs that shape perception or reasoning may require neither firmware modification nor network intrusion. In 2024, RoboPAIR showed that carefully structured queries could redirect robots piloted by a large language model (LLM) towards dangerous trajectories. According to the BadRobot research, in several cases, a robot verbally refused a dangerous command, but its motion controller executed it nonetheless.
Visual manipulation is no less effective. VLAttack showed that an adversarial patch placed in the camera’s field of view could reduce a VLA model’s success rate to zero. FreezeVLA showed that a single adversarial image could freeze a robot’s decision loop, causing it to no longer respond to subsequent instructions. In these cases, the camera can function, the model can run, and the controller can respond, while the behavior remains dangerous. According to the article, cybersecurity constitutes the missing layer for robot security, as it complements functional safety, which deals with failures and unexpected operating conditions. VicOne’s approach, described in the article, combines model and vulnerability analysis, simulation-based validation, and continuous monitoring.
