💻 computer science

Phantom Force: Injecting Adversarial Tactile Perceptions into Embodied Intelligence via EMI

This paper reveals a critical security vulnerability in embodied robots by demonstrating that targeted Electromagnetic Interference (EMI) can inject "phantom forces" into Hall-effect fingertip sensors, causing up to a 9x amplification in perceived force and a 65-degree directional deviation that paralyzes learning-based models and enables attackers to manipulate robot actions.

Original authors: Zirui Kong, Youqian Zhang, Sze Yiu Chau

Published 2026-05-14

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Zirui Kong, Youqian Zhang, Sze Yiu Chau

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Idea: Hacking a Robot's "Sense of Touch"

Imagine a robot hand that is incredibly smart at picking up delicate objects, like a fragile egg or a heavy toolbox. It doesn't just "see" these objects; it has special sensors on its fingertips that act like human skin, feeling exactly how hard it is squeezing and in which direction.

This paper reveals a scary new weakness: Hackers can trick these robot fingers into "feeling" things that aren't actually happening.

The researchers call this a "Phantom Force." Just like a ghost is something you can't see but might feel, a phantom force is a fake sensation injected into the robot's brain using invisible radio waves.

The Villain: Invisible Radio Waves (EMI)

The paper focuses on a specific type of sensor called a Hall-effect sensor. Think of these sensors like tiny, sensitive compasses inside the robot's fingertips that detect magnetic changes to figure out how much pressure is being applied.

The researchers found that these "compasses" are easily confused by Electromagnetic Interference (EMI).

The Analogy: Imagine you are trying to listen to a quiet conversation in a room. If someone walks in with a loud, buzzing speaker playing a specific tone right next to your ear, you can't hear the conversation anymore. The robot's sensor is the "ear," and the hacker's device is the "loud speaker."

How the Attack Works

The researchers didn't just guess; they built a real experiment to prove this works.

The Setup: They put a robot finger on a table and pressed known weights onto it (like a 1kg weight). Under normal conditions, the robot correctly says, "I am feeling 1kg of pressure."
The Hack: They used a device to blast a specific radio frequency (313 MHz) right at the sensor. This frequency was found to be the "sweet spot" that makes the sensor glitch.
The Result: The robot's brain suddenly received a corrupted signal.
- Fake Strength: The robot thought the force was 9 times stronger than it actually was.
- Fake Direction: The robot thought the force was coming from a completely different angle (a 65-degree shift).

The Consequences: Why This Matters

The paper shows two dangerous scenarios where this "Phantom Force" could break a robot:

1. The "Crush" Scenario (Amplifying Force)

What happens: The robot is holding a fragile vase. The hacker injects a signal that makes the robot think it is squeezing the vase with 9 times the force it actually is.
The Reaction: The robot's safety system panics. It thinks, "Oh no, I'm crushing this!" So, it immediately loosens its grip to save the vase.
The Disaster: Because it loosened its grip, it drops the vase, and it shatters. Alternatively, if the robot is holding something heavy and thinks the force is too low, it might squeeze too hard, crushing a delicate object it was supposed to protect.

2. The "Ghost Drop" Scenario (The Simulation)

What happens: The researchers simulated a robot holding an object steady. Suddenly, the hacker injects a signal that makes the sensor read zero force.
The Reaction: The robot thinks, "I've lost my grip! The object is falling!"
The Disaster: In a panic to "catch" the falling object, the robot might slam its hand shut with dangerous speed and force, potentially crushing whatever it is holding or hurting a human nearby.

The Bottom Line

For a long time, scientists have worried about hackers tricking robots with fake images (like putting a sticker on a stop sign so a self-driving car thinks it's a speed limit sign). This paper says: "Stop ignoring the sense of touch!"

The researchers proved that by simply blasting the right radio waves at a robot's fingertips, you can completely confuse its understanding of the physical world. This could cause robots to drop dangerous items, crush fragile ones, or move unpredictably, all because their "skin" was hacked.

What the paper does NOT say:

It does not claim this has happened in a real-world factory or hospital yet; it was a controlled experiment and a computer simulation.
It does not offer a fix yet; it only identifies the problem and suggests that future work needs to find ways to shield these sensors or teach robots to ignore these fake signals.

Technical Summary: Phantom Force

Problem Statement

Embodied intelligent robots rely heavily on tactile sensors to interact safely with the physical world, particularly in contact-rich environments where robotic hands must perceive contact force, pressure distribution, and material texture. While the security of visual perception systems against adversarial examples has been extensively studied, the integrity of the tactile sensory channel remains largely unexplored. Current systems often treat tactile sensor signals as inherently trustworthy, creating a critical vulnerability where an attacker could inject malicious signals at the sensor level. This paper investigates the susceptibility of modern Hall-effect fingertip sensors to intentional Electromagnetic Interference (EMI), demonstrating how such interference can be weaponized to induce "phantom forces."

Methodology

The research employs a combination of physical experiments and simulation to quantify the impact of EMI on tactile perception and subsequent machine learning tasks.

Data Acquisition and Baseline:
The authors established a tactile classification baseline using a Gen. 2 Paxini Hall-effect fingertip sensor mounted on a robot end-effector. Discrete calibration weights were pressed onto the sensor under a standardized contact protocol to collect time-series raw signals. These 3D signals were synchronized, segmented into windows, and used to train a Random Forest (RF) classifier.

Attack Setup:
To probe physical layer vulnerabilities, the team deployed a high-frequency emitter centered at 313 MHz. This frequency was identified through a prior 100–400 MHz sweep as a resonant frequency capable of inducing measurable perturbations in the sensor signal. The attack chain consisted of:

A signal generator producing a continuous-wave tone.
A power amplifier.
A near-field probe positioned at a controlled standoff distance of less than 1 cm from the sensor.
Output power calibration using a spectrum analyzer and reference probe.

Evaluation Metrics:
The study evaluated classification degradation and force estimation accuracy using two primary metrics:

Cosine Similarity (Cos. Sim.): Measures the angular alignment between the ground-truth force vector ( $F_{gt}$ ) and the measured/perturbed force vector ( $F_{measure}$ ).
Amplitude Ratio (Amp. Rat.): Quantifies the magnitude difference between the measured and ground-truth vectors ( $\|F_{measure}\| / \|F_{gt}\|$ ).

Key Contributions and Results

The paper presents empirical evidence that carefully crafted electromagnetic waves can manipulate tactile sensor readings, leading to severe performance degradation in learning-based models.

Force Estimation Perturbation:
Under benign conditions (no attack), the sensor readings closely matched the ground truth, with Cosine Similarity and Amplitude Ratio values above 0.99. However, under EMI attack:

Direction Deviation: The inferred force direction deviated significantly, with Cosine Similarity dropping to a mean of 0.56 (standard deviation 0.44).
Magnitude Amplification: The perceived force magnitude was amplified by over 9×, with an Amplitude Ratio mean of 9.20.
Model Collapse: These perturbations caused the Random Forest classifier to fail completely. Precision and recall dropped to 0.00, as the drastic signal amplitude shifts moved the data distribution entirely outside the model's learned boundaries.

Simulation of "Phantom Release":
Using NVIDIA Isaac Sim, the authors simulated a closed-loop control scenario. During a stable hold phase (approx. 35N real force), the injection of the attack signal caused the spoofed sensor reading to drop to near 0N. This creates a "Phantom Release" scenario where the robot falsely believes it is losing its grip. In a closed-loop system, this would likely trigger a dangerous compensatory increase in gripping force, potentially crushing fragile objects or causing the robot to drop dangerous payloads.

Significance and Claims

The authors claim that this work exposes a previously underexplored attack surface in robotic perception. The significance of the study lies in demonstrating that ensuring the robustness of embodied intelligence requires a holistic view of sensor security that extends beyond vision to include tactile and other proprioceptive modalities.

The paper concludes that while this is a preliminary study, it highlights the urgent need for:

Systematic characterization of adversarial signal injection capabilities and limitations.
Extension of this analysis to diverse tactile technologies (capacitive, piezoresistive, optical, etc.) to assess the generality of the threat.
Development of principled defense mechanisms across the sensing and learning stack, including hardware-level design, signal-level anomaly detection, and robust learning approaches like sensor fusion and uncertainty modeling.

Ultimately, the work aims to contribute to a unified framework for trustworthy tactile perception, enabling embodied robots to operate safely in adversarial environments.