Technical Summary: Security and Privacy of Foundation-Model-Powered Robots

1. Problem Statement

Foundation models (FMs), including Large Language Models (LLMs), Vision-Language Models (VLMs), and Vision-Language-Action (VLA) models, are transforming robotics by enabling agents to interpret open-ended instructions, reason over multimodal contexts, and operate in complex, open-world environments. However, this integration introduces security and privacy (S&P) risks that extend beyond the models themselves to embodied execution pipelines, supporting ecosystems, and broader governance impacts.

Existing literature reviews on this topic suffer from two primary limitations:

1. Fragmented Coverage: Most reviews focus on specific FM types (e.g., only LLMs or only VLAs) or specific risk categories, lacking an integrated analysis across different model types and system layers.
2. Insufficient Structural Framework: Prior analyses often rely on flat taxonomies or single trust boundaries (e.g., focusing solely on the model or the robot's embodiment). This obscures how risks originate, propagate across layers, and amplify into broader societal harms. Consequently, the field lacks a unified structure to identify mitigation gaps and understand the full lifecycle of S&P risks in FM-powered robotic systems.

2. Methodology

To address these gaps, the authors propose a systematic approach grounded in a novel structural framework and a multi-level taxonomy.

2.1 The F-E-S-G Structural Framework

The authors define a progressive, four-layer trust boundary framework to organize the problem space:

• Foundation Model Layer (F): Captures challenges rooted in the model artifact itself (parameters, checkpoints, adapters, embeddings, training updates).
• Embodied System Layer (E): Covers issues within the internal execution pipeline of a standalone robot, including the full perception-planning-execution loop (Perception, Planning, Policy, Kinematics, Execution, Middleware).
• Supporting Ecosystem Layer (S): Includes risks from external components and infrastructures supporting operation (communication channels, cloud backends, supply chains, external tools).
• Governance Impact Layer (G): Addresses issues extending beyond the technical system, including regulation, accountability, public trust, and downstream human/social consequences.

2.2 Multi-Level Taxonomy and Coding

Building on the framework, the authors developed a taxonomy to organize prior studies along three levels:

1. Trust Boundary: F, E, S, or G.
2. Domain: Security (integrity, reliability, intended behavior) vs. Privacy (protection of sensitive information).
3. Perspective: Risks (vulnerabilities, threats) vs. Mitigations (prevention, detection, recovery).

Additionally, each of the 96 systematized papers was annotated with fine-grained coding attributes:

• Target: The specific component affected (e.g., Planning Module, Middleware).
• Stage: The lifecycle stage where the risk is introduced or mitigation applied.
• Mechanism: The technical method of the risk or defense.
• System Access: The adversary's visibility (None, Black-box, Gray-box, White-box).
• Effect: Efficacy, stealth, and utility cost.

2.3 Systematization Process

Following standard Systematization of Knowledge (SoK) practices, the authors:

1. Defined the scope to include S&P studies involving LLMs, VLMs, or VLAs in robotic perception, planning, or action selection.
2. Retrieved candidates from major security, privacy, robotics, and embodied-AI venues (290 initial candidates).
3. Screened papers by title, abstract, and full text, retaining 118 for full review.
4. Iteratively coded and classified 96 papers into the final corpus used for analysis.

3. Key Findings and Results

3.1 Layer-Specific Risks and Mitigations

• Foundation Model (F) Layer:

  • Risks: Dominated by Model Compromise (data poisoning, malicious fine-tuning/backdoors), Semantic Manipulation (jailbreaking, adversarial instructions, prompt injection), Visual Manipulation (adversarial patches/texture), and Misalignment (reward hacking, goal misgeneralization). Privacy risks include membership inference, personalization leakage, and fingerprinting.
  • Mitigations: Primarily Model Hardening (adversarial training, model merging, interpretable architectures) and Execution Guardrails. Privacy mitigations rely on Federated Safeguards and Key-based Gating.
  • Gap: Defenses are often adapted from text-only LLMs and lack validation against grounded physical execution.

• Embodied System (E) Layer:

  • Risks: Includes Semantic Manipulation (plan-hijacking), Visual Manipulation (physical object attacks), Signal Manipulation (sensor spoofing), and Middleware Compromise (ROS2/DDS vulnerabilities). Privacy risks stem from eavesdropping on acoustic or communication signals.
  • Mitigations: Heavily reliant on Runtime Guardrails (fault diagnosis, avoidance, recovery) and limited middleware hardening.
  • Gap: Mitigations are reactive and layer-local, intervening after decisions are made, which is problematic for irreversible physical actions.

• Supporting Ecosystem (S) Layer:

  • Risks: Supply-chain attacks (poisoned adapters/packages), Man-in-the-Middle (MITM) attacks, Software-service abuse, and Multi-robot system attacks. Privacy risks involve traffic-analysis leakage and data outsourcing.
  • Mitigations: Supply-chain verification, multi-robot resilience, and runtime MITM detection.
  • Gap: Limited understanding of compositional risks where individually trustworthy components introduce emergent risks when integrated.

• Governance Impact (G) Layer:

  • Risks: Manifest as deployment-level harms (unsafe actions, liability disputes, loss of trust) and privacy issues arising from routine sensing without consent.
  • Mitigations: Governance safeguards (certification, auditing, transparency, liability allocation).
  • Gap: "Governance lag" where accountability mechanisms lack the technical evidence (provenance, traces) needed to address cross-layer harms.

3.2 Systemic Gaps and Limitations

The analysis reveals four critical systemic gaps:

1. Assumption vs. Reality: Threat models often assume white-box access or trusted components, which do not hold in dynamic, heterogeneous real-world deployments.
2. Propagation vs. Local Mitigation: Risks often originate in one layer (e.g., F) but manifest in another (e.g., E), yet mitigations are frequently deployed only where the harm is observed, failing to eliminate upstream vulnerabilities.
3. Fragmentation vs. Systemic Defense: Current solutions are module-specific, lacking a unified framework for end-to-end defense across the pipeline.
4. Accountability Evidence: Governance mechanisms struggle due to a lack of unified, verifiable technical evidence (provenance, update histories) across layers.

3.3 Evaluation Limitations

The paper identifies significant deficiencies in current evaluation protocols:

• Lack of shared benchmarks and standardized metrics.
• Insufficient reporting of utility costs (trade-offs between safety and performance).
• Limited Sim-to-Real validation, raising questions about the generalizability of findings.

4. Contributions

The paper makes three primary contributions:

1. Novel Framework: Proposes the progressive F-E-S-G structural framework, providing a unified lens to organize fragmented research and trace risk propagation across the entire robotic system lifecycle.
2. Multi-Level Taxonomy: Develops a comprehensive taxonomy organizing 96 papers by trust boundary, security-privacy dimension, and risk-mitigation perspective, supplemented by fine-grained coding attributes.
3. Research Agenda: Identifies open challenges and future directions, including operationalizing embodied S&P, addressing systemic risks in multi-robot systems, ensuring long-horizon reliability, securing emerging World Foundation Models (WFMs), and establishing unified evaluation protocols.

5. Significance and Claims

The authors claim that this work provides the first comprehensive and structural view of the S&P landscape across the full lifecycle and system architecture of FM-powered robotic systems. By moving beyond single-boundary perspectives, the framework allows researchers to:

• Identify mitigation gaps that are invisible when viewing layers in isolation.
• Understand how risks originate, propagate, and amplify across different components.
• Systematize the field to guide the development of secure, privacy-preserving, and responsibly governed robotic systems.

The paper emphasizes that without such a unified structure, the field cannot effectively address the complex, cross-layer nature of modern robotic threats. It positions itself as a foundational reference for future research, highlighting that current evaluations are insufficient and that future work must bridge the gap between technical defenses and governance requirements.