Robotics & Embodied AI Security

Security challenges unique to AI systems controlling physical robots and embodied agents: threat landscape, attack surfaces, physical-world constraints, and safety framework vulnerabilities.

When an LLM controls a robot arm, a drone, or an autonomous vehicle, the stakes of a security failure escalate from data breach or harmful text to physical damage, injury, or destruction. Embodied AI extends the AI attack surface from the digital into the physical domain, where the consequences of exploitation are irreversible.

The Embodied AI Stack

Modern LLM-controlled robots use a layered architecture:

┌──────────────────────────────────────────────┐
│  Layer 4: Task Planning (LLM)                │
│  "Pick up the red cup and place it on shelf" │
├──────────────────────────────────────────────┤
│  Layer 3: Action Sequencing                  │
│  move_to(cup) → grasp() → move_to(shelf)    │
│  → release()                                 │
├──────────────────────────────────────────────┤
│  Layer 2: Motion Planning                    │
│  Trajectory computation, collision avoidance │
├──────────────────────────────────────────────┤
│  Layer 1: Low-Level Control                  │
│  Motor commands, sensor feedback loops       │
├──────────────────────────────────────────────┤
│  Layer 0: Physical Hardware                  │
│  Motors, sensors, actuators, power systems   │
└──────────────────────────────────────────────┘

Each layer boundary is an attack surface. The highest-value targets are layers 3-4, where natural language interfaces meet action execution.

Threat Landscape

Attack Surface Map

Impact Categories

How LLMs Control Robots

Integration Patterns

The LLM generates code (Python, ROS commands) that is then executed by the robot's control system.

# LLM generates this code from natural language instruction:
# "Pick up the red cup and put it on the top shelf"
def task_pick_and_place():
    target = vision.detect("red cup")
    robot.move_to(target.position)
    robot.grasp(force=5.0)  # Newtons
    shelf_pos = vision.detect("top shelf")
    robot.move_to(shelf_pos.place_position)
    robot.release()

Security risk: The LLM can generate arbitrary code, including commands that disable safety limits or access unauthorized system functions.

The LLM calls predefined robot action APIs with parameters.

{"action": "pick_and_place",
 "params": {"object": "red cup", "destination": "top shelf",
            "grip_force": 5.0, "speed": "normal"}}

Security risk: Parameter injection can override safety bounds (e.g., setting grip_force to maximum or speed to unsafe levels).

The LLM outputs motor-level control signals directly, often via a learned control policy.

Security risk: Minimal abstraction layer means the LLM has full access to raw motor commands. Safety boundaries must be enforced at the hardware level.

Combines LLM planning with learned control policies. The LLM selects high-level actions; a trained policy handles low-level execution.

Security risk: The LLM can select action sequences that individually appear safe but produce dangerous outcomes in combination.

Red Team Methodology for Embodied AI

1. 1

   Environment assessment

   Catalog the robot's physical capabilities (reach, force, speed), the environment it operates in (who/what is nearby), and the safety systems in place (e-stops, force limits, geofencing).

2. 2

   Interface enumeration

   Map all input channels: natural language commands, vision inputs, sensor feeds, network APIs. Each is an injection surface.

3. 3

   Safety boundary testing

   Test whether safety constraints (force limits, speed caps, restricted zones) can be overridden through the LLM interface. Start with soft constraints in simulation.

4. 4

   Multi-step attack chains

   Design attack sequences where each individual command appears safe but the sequence produces a dangerous state. Test whether the system detects cumulative risk.

5. 5

   Simulation validation

   Execute all attacks in a physics simulator before any hardware testing. Verify attack effectiveness and measure potential physical consequences.

6. 6

   Controlled hardware testing

   For validated attacks, test on physical hardware with safety interlocks active: reduced speed, force limiting, physical barriers, human safety observer with e-stop.

Key Differences from Digital AI Red Teaming

Related Topics

• Robot Control Injection - Injecting malicious commands into LLM-controlled robots
• Computer Use & GUI Agent Attacks - Related digital agent exploitation techniques
• Agent Exploitation - General agent exploitation patterns
• Tool Abuse - Exploiting AI tool-use capabilities

References

• "Large Language Models for Robotics: A Survey" - Zeng et al. (2024) - Comprehensive survey of LLMs in robotics
• "Do As I Can, Not As I Say: Grounding Language in Robotic Affordances" - Ahn et al. (2022) - SayCan framework for LLM-robot interaction
• "Code as Policies: Language Model Programs for Embodied Control" - Liang et al. (2023) - LLM code generation for robot control
• "Jailbreaking LLM-Controlled Robots" - Robey et al. (2024) - Direct attacks on LLM-controlled robotic systems

Related Pages

• Robot Control Injection -- injecting malicious control commands
• Physical World Constraint Bypass -- bypassing physical safety limits
• Safety Framework Circumvention -- attacking safety systems
• Lab: Simulated Robot Control Exploitation -- hands-on simulation exercises