🤖 AI

What Breaks Embodied AI Security:LLM Vulnerabilities, CPS Flaws,or Something Else?

This survey argues that the security of embodied AI systems cannot be fully addressed by analyzing LLM vulnerabilities or CPS flaws in isolation, as their fundamental risks stem from embodiment-induced system-level mismatches where semantic correctness fails to guarantee physical safety due to nonlinear dynamics, error propagation, and non-compositional safety.

Original authors: Boyang Ma, Hechuan Guo, Peizhuo Lv, Minghui Xu, Xuelong Dai, YeChao Zhang, Yijun Yang, Yue Zhang

Published 2026-02-20

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Boyang Ma, Hechuan Guo, Peizhuo Lv, Minghui Xu, Xuelong Dai, YeChao Zhang, Yijun Yang, Yue Zhang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Question: Who is to Blame When a Robot Breaks?

Imagine you have a brand-new robot butler. It's super smart (it has a "brain" powered by a Large Language Model, like a super-charged chatbot) and it has a physical body (arms, wheels, sensors) that interacts with the real world.

Recently, these robots have started making dangerous mistakes. They might drop a fragile vase, drive into a wall, or hurt a human.

The big question this paper asks is: Why did the robot fail?

Is it the Brain? Did the AI get confused by a tricky question (like a hacker tricking a chatbot)?
Is it the Body? Did a sensor break or a motor glitch (like a car's brakes failing)?
Or is it something else entirely?

The authors argue that the answer is "Something Else." It's not just the brain or the body failing on its own. It's the mismatch between the two. The robot is trying to speak a language of "logic" while living in a world of "physics," and they don't speak the same dialect.

The Core Problem: The "Dreamer" vs. The "Realist"

Think of the robot's Brain (LLM) as a Dreamer.

The Dreamer is great at stories, logic, and following instructions.
If you say, "Pick up that glass quickly," the Dreamer thinks: "Got it! Grab the glass, move fast. Done!"
The Dreamer doesn't know that "quickly" might mean "shatter the glass" or "slip on the wet floor." It treats the world like a video game where physics can be ignored.

Think of the robot's Body (CPS) as a Realist.

The Realist deals with gravity, friction, weight, and speed limits.
If the Dreamer says "move fast," the Realist knows that moving a heavy object fast requires more force, which might tip the robot over.

The Security Break: The robot fails because the Dreamer gives an order that sounds perfect in a storybook, but the Realist tries to execute it and crashes because the laws of physics weren't part of the story.

The Four Reasons Why This is So Hard to Fix

The paper identifies four specific reasons why this "Dreamer vs. Realist" gap makes robots dangerous:

1. The "Perfect Sentence, Broken Glass" Problem

The Analogy: Imagine a chef who reads a recipe perfectly. The recipe says, "Whisk the eggs vigorously." The chef follows the instruction perfectly. But the bowl was made of cheap plastic, and the vigorous whisking shattered it.
The Reality: The robot's brain can be "semantically correct" (it understood the words) but "physically unsafe" (it broke the rules of physics). The brain doesn't "feel" the weight of the glass or the friction of the table.

2. The "Same Move, Different Outcome" Problem

The Analogy: Think of a skateboarder. If they do a kickflip on flat concrete, they land safely. If they do the exact same kickflip on a patch of wet leaves, they fly off and break an arm. The move didn't change; the state of the world did.
The Reality: In the digital world, if you type "A," you always get "A." In the physical world, doing the exact same action can lead to disaster if the floor is slippery, the object is heavier than expected, or a person steps in the way. The robot can't predict these tiny changes.

3. The "Whispering Wind" Effect (Error Propagation)

The Analogy: Imagine a game of "Telephone" where a message gets passed down a line. If the first person whispers "The door is open," and the last person hears "The door is closed," the whole game is ruined.
The Reality: In a robot, a tiny mistake in "seeing" (perception) gets passed to the "thinking" (planning), which gets passed to the "moving" (control). A tiny error in seeing a wall as 1 meter away instead of 1.1 meters can cause the robot to plan a path that leads to a crash. These small errors amplify into big disasters.

4. The "Safe Step, Dangerous Journey" Problem

The Analogy: Imagine walking through a minefield. You take one step that is perfectly safe. Then another safe step. Then another. But because you kept walking in a straight line, you eventually step on a mine. Every single step was "safe," but the journey was fatal.
The Reality: A robot might make a series of small, safe decisions. But because it doesn't see the "big picture" over time, these safe steps add up to a globally unsafe situation (like driving into a restricted zone because every turn seemed fine individually).

Why Old Security Rules Don't Work

The paper explains that we've been trying to fix this with two old tools, but they aren't enough:

The "Chatbot Guard" (LLM Security): We try to stop hackers from tricking the robot with bad words.
- Why it fails: Even if the robot isn't tricked, it can still make a mistake because it doesn't understand physics. You can't "jailbreak" a robot into understanding gravity.
The "Car Mechanic" (CPS Security): We try to make sure the sensors and motors don't break or get hacked.
- Why it fails: Even if the sensors are perfect and the motors are strong, the robot's brain might still decide to do something stupid because it doesn't understand the consequences of its actions.

The Solution: A New Kind of Safety

The authors say we need to stop looking at the brain and body separately. We need to build a "System-Level Safety" approach.

The Metaphor: Instead of just checking the engine (body) or the driver's license (brain), we need a Co-Pilot that constantly checks: "Is this logical plan actually possible in the real world right now?"
The Goal: We need robots that don't just answer questions correctly, but also understand that if they push too hard, things break. They need to be aware of uncertainty, friction, and the fact that the world is messy.

Summary

This paper argues that the biggest danger to robot safety isn't hackers or broken parts. It's the gap between what the robot thinks it's doing and what it is actually capable of doing in the real world. To fix this, we need to teach robots to respect the laws of physics, not just the laws of language.

1. Problem Statement

Embodied AI (EA) systems—ranging from autonomous vehicles to service robots and LLM-driven agents—are transitioning from controlled labs to safety-critical real-world deployments. Unlike purely digital AI, failures in EA result in irreversible physical consequences.

The central problem addressed is the misdiagnosis of failure causes. Current research and security paradigms tend to silo EA security into two distinct categories:

LLM-Centric View: Focusing on software vulnerabilities like prompt injection, jailbreaking, and hallucinations.
CPS-Centric View: Focusing on classical Cyber-Physical System flaws like sensor spoofing, control loop instability, and actuator attacks.

The authors argue that neither perspective alone is sufficient. Many observed breakdowns in modern embodied systems do not stem from isolated model flaws or traditional hardware attacks, but from embodiment-induced system-level mismatches. The paper seeks to answer: What actually breaks embodied AI security?

2. Methodology

The paper employs a comprehensive survey and root-cause analysis approach, structured across three dimensions:

Taxonomy of Vulnerabilities: Systematizing emerging threats in LLM-based agents (semantic attacks, cross-modal inconsistencies) and revisiting classical CPS threat models (sensor, control, actuator, timing attacks) within learning-enabled systems.
Synthesis of Domains: Analyzing the intersection of LLM reasoning and physical execution to identify structural gaps that cannot be reduced to either domain alone.
Root Cause Identification: Moving beyond surface-level failure modes to identify four core insights (root causes) explaining why securing embodied AI is fundamentally harder than securing LLMs or CPS in isolation.

The analysis covers the evolution from rule-based control to foundation-model-enabled agents, utilizing a minimal architectural decomposition (Perception $\to$ Decision/Reasoning $\to$ Behavior Planning/Control $\to$ Physical Environment).

3. Key Contributions & Core Insights

The paper's primary contribution is the identification of four fundamental insights that explain the unique security challenges of embodied AI:

Insight 1: Semantic Correctness $\neq$ Physical Safety

The Gap: Language-level reasoning abstracts away geometry, dynamics, friction, and contact constraints.
The Failure: An action can be semantically valid (logically consistent with user intent) but physically dangerous. For example, an instruction to "move quickly" might be interpreted correctly by an LLM but executed with forces that exceed friction limits, causing a robot to slip or break an object.
Implication: Better reasoning does not guarantee safer behavior because the "world model" in language models lacks physical constraints.

Insight 2: State-Dependent Consequence Variability

The Gap: In digital systems, identical inputs yield identical outputs. In physical systems, identical actions yield drastically different outcomes based on the state (pose, contact mode, material properties, environmental dynamics).
The Failure: Nonlinear dynamics mean that small variations in state can transform a safe action into a hazardous one. Static validation or one-shot policy certification is insufficient because safety is not a static property of an action but a function of the dynamic state.

Insight 3: Error Propagation and Amplification

The Gap: Embodied AI operates as a tightly coupled feedback loop (Perception $\to$ Decision $\to$ Action).
The Failure: Minor perception errors, grounding ambiguities, or reasoning deviations cascade across layers. Crucially, uncertainty is rarely propagated explicitly between modules. Agents often commit to aggressive execution under high uncertainty rather than deferring action, leading to compounding errors that result in catastrophic failure without a single component failing.

Insight 4: Non-Compositional Safety

The Gap: Safety is not compositional over time or system layers.
The Failure: Actions that are locally safe and individually justified can accumulate into globally unsafe trajectories, especially in dynamic, human-shared environments. Unlike traditional CPS where safety is enforced at the control layer, embodied AI introduces adaptive decision-making that continuously reshapes objectives, making long-horizon safety violations hard to anticipate or contain.

4. Detailed Analysis of Vulnerabilities

The paper categorizes threats into three domains to illustrate the root causes:

LLM Vulnerabilities (Semantic & Intent):
- Jailbreaking: Attacks that bypass safety filters to generate executable but harmful physical plans (e.g., "RoboPair," "POEX").
- Cross-Modal Injection: Manipulating visual inputs (patches, text in the scene) to hijack the agent's decision-making (e.g., "CHAI," "CrossInject").
- Backdoors: Training-time attacks where specific triggers (physical objects or visual patterns) activate malicious behaviors.
CPS Vulnerabilities (Physical & Control):
- Sensor Integrity: GPS spoofing, LiDAR spoofing, and acoustic attacks on IMUs.
- Control Loop: Exploiting feedback dynamics to destabilize controllers via small, timed disturbances.
- Actuator Attacks: Direct injection of malicious commands to override physical safety (e.g., CAN bus injection).
Embodiment-Specific Failures (The "Something Else"):
- Semantic-Physical Mismatch: Plans are logically sound but physically infeasible.
- Execution Drift: Simplified planning models fail to account for real-world dynamics and perception noise.
- Cross-Layer Misalignment: Local optimality at the semantic, planning, and control layers does not compose into global safety. Information loss at interfaces (e.g., compressing safety rationale into numeric costs) leads to systemic failures.

5. Results & Open Challenges

The survey synthesizes existing literature to demonstrate that:

Current Defenses are Insufficient: Standard LLM alignment (RLHF) and CPS formal verification fail when applied in isolation to embodied systems.
New Attack Surfaces: The "brain-body" interface creates unique vulnerabilities where environmental cues (not just user prompts) can trigger failures.
Irreversibility: Unlike digital errors, physical failures often cannot be rolled back.

Key Open Challenges Identified:

Bias & Hallucination: Inherited biases in training data leading to discriminatory physical actions; hallucinations causing navigation into hazardous zones.
Impossibility of Filters: The computational asymmetry between creating hidden triggers (polynomial time) and detecting them (intractable) makes external monitoring insufficient.
Multi-Robot Coordination: Cascading failures in fleets due to insecure communication or algorithmic conflicts.
Human-Factor Risks: Over-trust and miscommunication between humans and agents.
Protection Boundaries: Defining the line between "safe" and "useful" exploration; overly strict safety envelopes may prevent agents from learning.

6. Significance

This paper fundamentally shifts the paradigm for Embodied AI security:

From Component to System: It argues that security cannot be achieved by patching LLMs or hardening sensors alone. It requires system-level reasoning about physical risk, uncertainty, and failure propagation.
New Research Directions: It calls for:
- Physical Grounding: Integrating physics and dynamics directly into reasoning models.
- Uncertainty Propagation: Explicitly passing uncertainty estimates from perception to planning and control.
- Cross-Layer Verification: Developing safety contracts that span the entire autonomy stack (Semantic $\to$ Planning $\to$ Control).
- Resilient Risk Management: Moving from "total vulnerability elimination" to frameworks that allow for controlled risk exploration and recovery.

In conclusion, the paper posits that the security of Embodied AI is broken not just by bad code or bad sensors, but by the fundamental mismatch between the discrete, symbolic nature of language and the continuous, nonlinear, and uncertain nature of the physical world.