cs.CRFeb 19, 2026
SaveWhat Breaks Embodied AI Security:LLM Vulnerabilities, CPS Flaws,or Something Else?
Organizations: Shandong University, 72 Binhai Road, Jimo, Qingdao, Shandong, 250100, China
Abstract
Embodied AI systems (e.g., autonomous vehicles, service robots, and LLM-driven interactive agents) are rapidly transitioning from controlled environments to safety critical real-world deployments. Unlike disembodied AI, failures in embodied intelligence lead to irreversible physical consequences, raising fundamental questions about security, safety, and reliability. While existing research predominantly analyzes embodied AI through the lenses of Large Language Model (LLM) vulnerabilities or classical Cyber-Physical System (CPS) failures, this survey argues that these perspectives are individually insufficient to explain many observed breakdowns in modern embodied systems. We posit that a significant class of failures arises from embodiment-induced system-level mismatches, rather than from isolated model flaws or traditional CPS attacks. Specifically, we identify four core insights that explain why embodied AI is fundamentally harder to secure: (i) semantic correctness does not imply physical safety, as language-level reasoning abstracts away geometry, dynamics, and contact constraints; (ii) identical actions can lead to drastically different outcomes across physical states due to nonlinear dynamics and state uncertainty; (iii) small errors propagate and amplify across tightly coupled perception-decision-action loops; and (iv) safety is not compositional across time or system layers, enabling locally safe decisions to accumulate into globally unsafe behavior. These insights suggest that securing embodied AI requires moving beyond component-level defenses toward system-level reasoning about physical risk, uncertainty, and failure propagation.
Figures & tables
Figure 1: From Rule-Based CPS to Embodied AI
Figure 2: Embodied AI Robot System Architecture
| Attack Category | Semantic Intent Integrity | Cross-Modal Consistency | Agent–Environment Stability |
| Cognitive / Semantic Jailbreaking | ✓ | ✗ | ✗ |
| Multi-modal Adversarial Attacks | ✗ | ✓ | ✗ |
| Physical & Environmental Manipulation | ✗ | ✗ | ✓ |
Table 1: Systematic mapping between attack categories and violated system-level trust assumptions in embodied agent systems.
| Jailbreak Variant | Primary Lever | Distinctive Characteristic |
| Executability-Aware Jailbreaking | Code / API validity | Ensures generated outputs are physically executable by robots |
| Safety Misalignment Exploitation | Language–action gap | Safe linguistic responses still induce unsafe actions |
| Cross-Modal Injection | Vision–language context | Non-textual inputs hijack planner intent |
| Adversarial Optimization | Prompt tokens / attention | Optimized suffixes induce stable policy deviation |
| Mobile-System-Oriented Jailbreak | Navigation goals | Goal hijacking leads to hazardous trajectories |
Table 2: Mechanism-level comparison of jailbreak attacks in LLM-based embodied AI systems.
| Attack Category | Attack Surface | Violated Trust | Lifecycle | Failure Propagation | Risk | Representative Work |
| Executability-Aware Jailbreaking Algorithms | Planner / Codegen | Policy executability | I | Goal Plan Action | H | ROBOPAIR [ 96 ] , POEX [ 73 ] |
| Exploiting Safety Misalignment and Conceptual Gaps | Planner (alignment boundary) | “Text-safe” “Action-safe” | I | Safe-text pass unsafe-action emit | H | BADROBOT [ 145 ] |
| Cross-Modal and Multi-Modal Injection | V–L Fusion | Channel isolation | I/P | V+L cue context hijack action | H | CrossInject [ 118 ] |
| Adversarial Optimization and Instruction Decomposition | Prompt / tokens | Robustness to optimized prompts | I | Prompt opt planner drift unsafe plan | M | EIRAD (GCG variants) [ 65 ] , attention-guided attacks [ 60 ] |
| Mobile Systems | Navigation stack | Goal fidelity under injections | I/P | Goal hijack route deviate hazard | H | LLM navigation injection study [ 147 ] |
| Optimization-Based and Targeted Attacks | Training / finetune | Data integrity | T/I | Poison trigger target action | H | BadVLA [ 151 ] , TabVLA [ 135 ] |
Table 3: Semantic and intent integrity attacks taxonomy.
| Backdoor Variant | Trigger Form | Embodied-Specific Implication |
| Optimization-Based Backdoors | Latent feature trigger | Precise and stealthy manipulation of embodied decision policies |
| Physical Trigger Backdoors | Real-world objects | Model-agnostic activation in physical deployment |
| Contextual Backdoors | In-context demonstrations | No weight modification; exploits ICL behavior |
| Modular / Pipeline Backdoors | Planner–controller interface | Survives sim-to-real and modular reuse |
| Unified Benchmarking | Evaluation protocol | Enables systematic comparison across architectures |
Table 4: Mechanism-level comparison of data poisoning and backdoor attacks in embodied AI systems.
| Attack Type | Targeted Layer | Failure Outcome | |||||
| Vision | V–L Fusion | Decision | Mis-grounding | Unsafe Motion | Inaction | Policy Hijack | |
| Physical Adversarial Patches | |||||||
| Visual Prompt Injection / CHAI | |||||||
| Semantic Scene Manipulation | |||||||
| Action Space Manipulation | |||||||
| Freeze / DoS Attacks | |||||||
Table 5: Multi-Modal Adversarial Attacks in Embodied AI
| Category | Attack Surface | Representative Work | Key Characteristics |
| Indirect Environmental Jailbreaking | Environmental text and semantic cues | SHAWSHANK [ 57 ] | Blind trust in environmental text, no direct prompt access, guardrail bypass via surroundings |
| Geometric and Structural Adversaries | Object geometry and physical shape | Geometric Red-Teaming (GRT) [ 34 ] | Shape-based attacks, mesh deformation, exploits contact physics and depth perception |
| Physically Realizable Navigation Attacks | Viewpoint- and lighting-robust visual cues | Physically Realizable Attack [ 17 ] | Texture + opacity optimization, multi-view robustness, human-camouflaged patches |
| Safety Evaluation and Failure Diagnosis | Decision-to-execution pipeline | SAFEL / EMBODYGUARD [ 105 ] | ISO-grounded safety taxonomy, physical risk levels, modular failure attribution |
Table 6: Environment-centric attacks and safety evaluation frameworks in embodied AI systems.
| CPS Threat Category | Physical | Remote | Stealthy | Irreversible | Core CPS Assumption Violated | Pitfaills and Explanations | Representative Works |
| Sensor Integrity Attacks | Sensors faithfully reflect physical state | Perception errors undermine state estimation and violate observability assumptions. | GPS spoofing [ 113 ] , LiDAR spoofing [ 11 ] , acoustic IMU attacks [ 115 ] , laser camera attacks [ 52 ] | ||||
| Control Loop Attacks | Bounded disturbance and stable feedback | Small disturbances are amplified by feedback dynamics, leading to instability. | FDI attacks [ 80 ] , dynamic attacks [ 88 ] , DoS control [ 13 ] , resilient control [ 86 ] | ||||
| Actuator Attacks | Commands safely translate to physical actions | Malicious commands directly induce unsafe physical actions with irreversible effects. | CAN injection [ 53 ] , vehicle attacks [ 78 ] , ICS actuator abuse [ 12 ] | ||||
| Timing and Synchronization Attacks | Time and message ordering are trustworthy | Timing violations break feedback consistency and destabilize distributed control. | TSA [ 148 ] , delay attacks [ 79 ] , Chronos [ 55 ] , time SoK [ 9 ] |
Table 7: Classical CPS threat categories. The table summarizes attack properties, violated CPS assumptions, and the limits of classical CPS security models when applied to learning-enabled embodied AI systems.
| Root Cause | Manifestation | Underlying Mechanism | Safety Implication | Representative Work |
| Semantic–Physical Mismatch | Semantically correct but physically unsafe decisions | Language-level correctness ignores geometry, dynamics, contact, and execution risk; physical constraints are not encoded in semantic representations | Constraint violations despite correct intent (e.g., breakage, collision) | SAFEL [ 106 ] , Zhang et al. [ 146 ] |
| State-Dependent Action Outcomes | Identical actions lead to different physical consequences | Nonlinear state–action mapping; outcomes depend on pose, contact mode, friction, and dynamics | Unpredictable safety risk under small state perturbations | Winter et al. [ 128 ] |
| Perception Uncertainty Propagation | Small perception errors cascade into unsafe execution | Occlusion, noise, and viewpoint errors distort grounding; uncertainty is not propagated to planning and control | Cascading failures across perception–decision–control | Jiang et al. [ 45 ] , Prasanna et al. [ 92 ] |
| Cross-Modal Representation Gaps | Inconsistent interpretation across language, vision, and action | Implicit alignment without explicit consistency constraints across modalities | Mis-grounded actions despite correct perception or intent | Ma et al. [ 75 ] , HiFi-CS [ 6 ] |
| Dynamic Environment Assumptions | Policies fail under environment or agent motion | Quasi-static assumptions break under human motion, object movement, and temporal drift | Delayed reactions, collision risk, and long-horizon failure | DynScene [ 54 ] , RoboView-Bias [ 64 ] |
Table 8: Root causes of embodiment-induced semantic mismatch in embodied AI systems. The table summarizes how semantically correct decisions can systematically fail to ensure physical safety due to structural gaps between language, perception, and physical interaction.
| Root Cause | Primary Fracture | Underlying Mechanism | Failure Consequence | Representative Work |
| Semantic Gap | Validated plans fail in physical execution | Text-derived knowledge abstracts away forces, contact, friction, and intermediate feedback; language generalizes semantically but not mechanically | Physically infeasible or unsafe execution despite correct intent | Roy et al. [ 97 ] , LIBERO [ 63 ] |
| Execution Drift | Mismatch between planned and executed behavior | Planning relies on simplified geometry and quasi-static dynamics; perception error, model mismatch, and environment change accumulate during execution | Trajectory deviation, delayed reaction, and unsafe control actions | Pramanick et al. [ 91 ] , Friedrich et al. [ 27 ] |
| Risk Accumulation | Locally safe actions lead to global hazards | Multi-level constraints (task, motion, control, interaction) are implicitly coupled; safety is not compositional over time | Long-horizon safety violations and cascading failures | He et al. [ 36 ] , Dandjinou et al. [ 21 ] |
Table 9: Root causes of action–consequence decoupling in embodied AI systems. These causes explain why actions validated as safe or reasonable at decision time may still lead to unsafe physical outcomes during execution.
| Failure Mode | Primary Root Cause(s) | Mechanism Description | Representative Work |
| Control Failure | Execution Drift (primary) Semantic–Physical Gap (secondary) | Mismatch between planned trajectories and real actuation limits causes tracking errors, delayed fault detection, and unsafe motion under saturation or bandwidth constraints. | Braun et al. [ 7 ] ; Ji et al. [ 42 ] ; Nguyen et al. [ 83 ] |
| Force Feedback Anomalies | Semantic–Physical Gap (primary) Risk Accumulation (secondary) | High-level decisions ignore contact dynamics and uncertainty, leading to ambiguous force signals, false alarms, and limited generalization of recovery strategies in contact-rich manipulation. | Altan et al. [ 4 ] ; Luo et al. [ 74 ] ; Zhong et al. [ 149 ] |
| Safety Boundary Breaches | Risk Accumulation (primary) | Locally safe actions and delayed detections accumulate across time and layers, causing fault propagation, cascading failures, and irreversible system-level safety violations. | Xu et al. [ 132 ] ; He et al. [ 36 ] ; Martinetti et al. [ 77 ] |
Table 10: Mapping between execution-layer failure modes and their underlying root causes in embodied AI systems, with representative empirical and theoretical studies.
| Root Cause | Description | Why Local Correctness Fails | Representative work |
| Objective Mismatch | Different layers optimize incompatible objectives (e.g., instruction plausibility vs. efficiency vs. stability). Physical risk is rarely an explicit objective. | Each layer reaches a local optimum, but safety is traded off implicitly across interfaces. No layer detects global risk violations. | EARBench [ 153 ] , SafeMind [ 18 ] |
| Constraint Incompatibility | Safety constraints are represented differently across layers: soft and contextual at the semantic level, partial and model-dependent at planning, and hard limits at control. | Enforcing constraints at a single layer does not guarantee end-to-end safety; violations emerge after abstraction boundaries. | Safety Chip [ 140 ] , ROBOGUARD [ 95 ] |
| Information Loss at Interfaces | Semantic intent, uncertainty, and safety rationale are compressed into symbolic goals and numeric costs during translation. | Downstream layers cannot recover discarded safety context, and upstream layers cannot anticipate physical feasibility or risk. | Varley et al. [ 116 ] , Rais et al. [ 94 ] |
| Temporal Mismatch | Semantic reasoning, planning, and control operate at different time scales, with asynchronous updates. | Symbolic plans become stale as physical states evolve, causing execution under invalid assumptions. | Liu et al. [ 66 ] |
| Distribution Shift and Stochasticity | LLM-driven decision layers introduce stochastic outputs and face distribution shifts unseen during training. | Small semantic variations propagate into large execution differences, amplifying cross-layer inconsistency over time. | Ghosh et al. [ 31 ] |
Table 11: Root Causes of Cross-Layer Misalignment in Embodied AI Systems
More in this topic
Embodied AI
Embodied AI studies agents that perceive, reason, and act through bodies in physical or simulated environments.
See all 248 papers