Technical Summary: Safety in Embodied AI: A Survey of Risks, Attacks, and Defenses

1. Problem Statement

Embodied Artificial Intelligence (Embodied AI) integrates perception, cognition, planning, and interaction into agents operating in open-world, safety-critical environments (e.g., autonomous driving, healthcare, industrial robotics). Unlike digital-only AI systems, embodied agents face unique safety challenges because their failures can lead directly to physical harm, property damage, or loss of human life. These systems operate under uncertain sensing, incomplete knowledge, and dynamic human-robot interactions.

While existing surveys address safety in digital domains (vision foundation models, Large Language Models, and digital agents), they often fail to account for the tight coupling of perception, cognition, planning, and interaction in physical settings. Furthermore, vulnerabilities in one layer (e.g., perception) can cascade to cause catastrophic failures in outer layers (e.g., control and interaction). There is a critical need for a unified framework that synthesizes research across the entire embodied pipeline, connecting embodied-specific findings with broader advances in vision, language, and multimodal foundation models.

2. Methodology

This paper presents a comprehensive survey of safety research in Embodied AI, analyzing over 400 papers. The authors employ a multi-level taxonomy structured around the "capability–risk duality," where each expansion in agent capability introduces corresponding new vulnerabilities. The survey organizes the field into five key capability layers, progressing from the innermost sensory inputs to the outermost agentic systems:

1. Perception: Covers visual, auditory, spatial (3D), motion, and cross-modal perception.
2. Cognition: Encompasses instruction understanding, world modeling, and reasoning.
3. Planning: Includes task planning, trajectory planning, and multi-agent planning.
4. Action & Interaction: Addresses robot control policies, human-agent interaction (HRI), and multi-agent collaboration.
5. Agentic System: Examines tool use, memory, self-evolution, and cascading risks.

For each layer, the survey categorizes threats into specific attack types (Adversarial, Backdoor, Jailbreak, Sensor-level, and Emerging Risks) and reviews corresponding defense mechanisms (Robust Training, Robust Inference, and Architectural Safeguards). The analysis integrates insights from traditional AI safety, robotics, and foundation model research to provide a mechanism-oriented understanding of embodied safety.

3. Key Contributions

• Unified Multi-Level Taxonomy: The paper introduces a structured framework that unifies fragmented lines of work across the embodied pipeline. It maps specific attack vectors (e.g., adversarial patches, sensor spoofing, jailbreak prompts) to specific capability layers and traces how inner-layer vulnerabilities propagate to outer-layer failures.
• Comprehensive Review of 400+ Papers: The survey consolidates embodied-specific research with safety-relevant advances in vision, language, and multimodal foundation models. It details over 400 specific works, categorizing them by attack type, defense strategy, target model, and dataset.
• Identification of Critical Gaps: The authors identify overlooked challenges, including:
  • The fragility of multimodal perception fusion.
  • The instability of planning under jailbreak attacks.
  • The trustworthiness of human-agent interaction in open-ended scenarios.
  • The lack of safety evaluation methodologies that avoid real-world risks.
  • The absence of cross-embodiment safety generalizations.
• Roadmap for Future Research: The paper outlines open challenges and future trends, providing a roadmap for developing embodied agents that are not only capable but also safe, robust, and reliable in real-world deployment.

4. Key Findings and Results

The survey synthesizes the current state of attacks and defenses across the five layers:

• Perception: Adversarial attacks (digital and physical) can cause misclassification, misdetection, and scene misinterpretation. Sensor attacks (spoofing, jamming) compromise raw data integrity. Backdoor attacks embed hidden triggers in visual and auditory models. Defenses include robust training (adversarial training, data augmentation) and robust inference (input/output moderation, sensor fusion).
• Cognition: Jailbreak attacks manipulate natural language instructions to bypass safety constraints, inducing unsafe physical actions. World models suffer from hallucinations and rule violations, leading to decisions based on false beliefs. Reasoning chains can be hijacked (CoT hijacking) or suffer from grounding failures.
• Planning: Adversarial attacks on task and trajectory planners can induce collisions or unsafe trajectories. Jailbreak attacks manipulate LLM-based planners to generate harmful action sequences. Multi-agent planning faces Byzantine faults and goal conflicts.
• Action & Interaction: Control policies (MLP, Diffusion, VLA) are vulnerable to adversarial perturbations in state, action, and observation spaces. Backdoor attacks in control policies can activate harmful behaviors. Human-agent interaction risks include handover safety failures and trust manipulation (over-trust/under-trust).
• Agentic Systems: The expansion to tool use, memory, and self-evolution introduces new vectors: tool misuse, memory poisoning/leakage, and misalignment in self-evolving agents. Cascading risks allow compromises in one layer (e.g., supply chain poisoning) to propagate through the entire system.

The survey highlights that while significant progress has been made in digital AI safety, embodied systems face unique challenges where digital vulnerabilities translate directly into physical consequences. Current defenses are often siloed, and there is a lack of standardized benchmarks for safety-critical scenarios in embodied settings.

5. Significance and Claims

The authors claim that this survey provides the first coherent, mechanism-oriented framework for understanding safety in Embodied AI. By organizing the field into a layered taxonomy, the paper bridges the gap between digital AI safety and physical robotics.

The significance of this work lies in its ability to:

1. Unify Fragmented Research: It connects disparate lines of work in vision, language, and robotics safety into a single narrative.
2. Highlight Unique Risks: It emphasizes that embodied safety is not merely an extension of digital safety but requires addressing the "capability–risk duality" where increased autonomy amplifies physical harm potential.
3. Guide Future Development: By identifying open challenges (e.g., safety evaluation without real-world risk, cross-embodiment generalization, hardware-software co-design), the paper sets a research agenda for building trustworthy embodied agents.

The paper concludes that achieving safe Embodied AI requires a shift from treating safety as an isolated module to viewing it as an emergent property of the entire perceive–think–act loop, necessitating coordinated progress across algorithms, simulation, hardware design, and governance.