Safety in Embodied AI: A Survey of Risks, Attacks, and Defenses

Xiao Li; Xiang Zheng; Yifeng Gao; Xinyu Xia; Yixu Wang; Xin Wang; Ye Sun; Yunhan Zhao

cs.CRMar 28, 2026

Safety in Embodied AI: A Survey of Risks, Attacks, and Defenses

Authors: Xiao Li, Xiang Zheng, Yifeng Gao, Xinyu Xia, Yixu Wang, Xin Wang, Ye Sun, Yunhan Zhao,

Organizations: Fudan University · City University of Hong Kong · Jilin University · Shanghai Innovation Institute ·

Abstract

Embodied Artificial Intelligence (Embodied AI) integrates perception, cognition, planning, and interaction into agents that operate in open-world, safety-critical environments. As these systems gain autonomy and enter domains such as transportation, healthcare, and industrial or assistive robotics, ensuring their safety becomes both technically challenging and socially indispensable. Unlike digital AI systems, embodied agents must act under uncertain sensing, incomplete knowledge, and dynamic human-robot interactions, where failures can directly lead to physical harm. This survey provides a comprehensive and structured review of safety research in embodied AI, examining attacks and defenses across the full embodied pipeline, from perception and cognition to planning, action and interaction, and agentic system. We introduce a multi-level taxonomy that unifies fragmented lines of work and connects embodied-specific safety findings with broader advances in vision, language, and multimodal foundation models. Our review synthesizes insights from over 500 papers spanning adversarial, backdoor, jailbreak, and hardware-level attacks; attack detection, safe training and robust inference; and risk-aware human-agent interaction. This analysis reveals several overlooked challenges, including the fragility of multimodal perception fusion, the instability of planning under jailbreak attacks, and the trustworthiness of human-agent interaction in open-ended scenarios. By organizing the field into a coherent framework and identifying critical research gaps, this survey provides a roadmap for building embodied agents that are not only capable and autonomous but also safe, robust, and reliable in real-world deployment.

Figures & tables

Figure 1: Capability vs. risk duality in embodied AI systems. Left: Nested capability layers from perception (innermost) to agentic systems (outermost), with representative embodiments at each level: sensor-only devices (e.g., face-recognition access controls), dialogue robots (e.g., museum guides), autonomous vehicles, robotic arms and humanoids, and future agentic robots with memory and tool use. Right: Corresponding safety risks at each layer. As capabilities expand outward, the attack surface grows correspondingly—vulnerabilities at inner layers cascade to outer layers, amplifying risks in more autonomous systems.

Figure 2: Illustration of safety threats and attack surfaces across capability layers of embodied AI systems.

Figure 3: Overview of representative attack and defense methods across perception, cognition, planning, action, and agentic system layers. The width of the strips is proportional to the number of research works.

Capability Layer	Attack	Threat	Real-world Danger
Perception	Adversarial Attack	Misclassification, misdetection, scene misinterpretation	Wrong object recognition, traffic sign errors, surveillance failure
	Backdoor Attack	Triggered misperception, hidden model manipulation	Unsafe behavior activation, safety bypass during deployment
	Sensor Attack	Sensor spoofing, jamming, data corruption	Navigation failure, loss of situational awareness, system malfunction
Cognition	Adversarial Attack	Faulty reasoning, scene misunderstanding, context errors	Navigation errors, hazard avoidance failure, unsafe decisions
Planning	Adversarial Attack	Planning perturbation, trajectory errors	Collision risk, unstable motion, unsafe task execution
	Jailbreak Attack	Safety constraint bypass, unsafe goal generation	Execution of prohibited actions, violation of safety rules

Table 1: Summary of attacks and threats across capability layers of embodied AI.

\cellcolor white \cellcolor perception-table-blue Attack	Method	Year	Category	Subcategory	Target Model	Dataset
\cellcolor white	Melis et al. [ 269 ]	2017	White-box	Digital Attack	Object Classifier	iCubWorld
\cellcolor white	Thys et al. [ 353 ]	2019	White-box	Digital Attack	Object Detector	Inria
\cellcolor white	Adversarial Overlay [ 417 ]	2023	White-box	Digital Attack	Object Detector	PASCAL VOC, ROS Gazebo
\cellcolor white	HitM [ 415 ]	2024	White-box	Digital Attack	Object Detector	CARLA, VOC
\cellcolor white	RTAA [ 153 ]	2020	White-box	Digital Attack	Single-Object Tracker	OTB, UAV, VOT
\cellcolor white	TrackPGD [ 286 ]	2024	White-box	Digital Attack	Single-Object Tracker	DAVIS, GOT-10k, UAV, VOT

Table 2: A summary of adversarial attacks for visual perception .

\cellcolor white \cellcolor perception-table-blue Defense	Method	Year	Category	Subcategory	Target Model	Dataset
\cellcolor white	Kalin et al. [ 167 ]	2021	Robust Training	Adversarial Training	Object Classifier	VEDAI
\cellcolor white	DSNet [ 137 ]	2020	Robust Training	Adversarial Training	Object Detector	FOD, Foggy Driving
\cellcolor white	IA-YOLO [ 234 ]	2022	Robust Training	Adversarial Training	Object Detector	VOC_Foggy, RTTS
\cellcolor white	BAD-Net [ 192 ]	2023	Robust Training	Adversarial Training	Object Detector	RTTS, VOChaze
\cellcolor white	Blazevic et al. [ 24 ]	2025	Robust Training	Adversarial Training	Object Detector	MetaDrive
\cellcolor white	RP-PGD [ 499 ]	2025	Robust Training	Adversarial Training	Semantic Segmentation	ADE20K, VOC, Cityscapes

Table 3: A summary of adversarial defenses for visual perception .

\cellcolor white \cellcolor perception-table-blue Attack/Defense	\cellcolor perception-table-blue Method	\cellcolor perception-table-blue Year	\cellcolor perception-table-blue Category	\cellcolor perception-table-blue Subcategory	\cellcolor perception-table-blue Target Model	\cellcolor perception-table-blue Dataset
\cellcolor white	Carlini et al. [ 34 ]	2016	White-box	Physical Attack	Speech Recognizer	Custom dataset
\cellcolor white	CommanderSong [ 464 ]	2018	White-box	Physical Attack	Speech Recognizer	Custom dataset
\cellcolor white	Metamorph [ 46 ]	2020	White-box	Physical Attack	Speech Recognizer	AIR, Common Voice, MARDY
\cellcolor white	SpecPatch [ 109 ]	2022	White-box	Physical Attack	Speech Recognizer	TIMIT
\cellcolor white	Li et al. [ 213 ]	2020	White-box	Physical Attack	Speech Verifier	CSTR VCTK Corpus
\cellcolor white	AdvPulse [ 214 ]	2020	White-box	Physical Attack	Speech Rec./Ver.	CSTR VCTK Corpus, Voice Commands

Table 4: A summary of adversarial attacks and defenses for auditory perception .

\cellcolor white \cellcolor perception-table-blue Attack	Method	Year	Category	Subcategory	Target Model	Dataset
\cellcolor white	FLAT [ 208 ]	2021	White-box	Digital Attack	3D Object Detector	nuScenes
\cellcolor white	SlowLiDAR [ 225 ]	2023	White-box	Digital Attack	3D Object Detector	KITTI
\cellcolor white	Zheng et al. [ 509 ]	2025	White-box	Digital Attack	3D Object Detector	KITTI, nuScenes
\cellcolor white	Wang et al. [ 402 ]	2025	White-box	Digital Attack	3D Object Detector	KITTI, Waymo
\cellcolor white	Cheng et al. [ 60 ]	2021	White-box	Digital Attack	3D Object Tracker	KITTI
\cellcolor white	TAN [ 237 ]	2023	White-box	Digital Attack	3D Object Tracker	KITTI

Table 5: A summary of adversarial attacks for spatial perception .

\cellcolor white \cellcolor perception-table-blue Defense	Method	Year	Category	Subcategory	Target Model	Dataset
\cellcolor white	Defense-PointNet [ 497 ]	2019	Robust Training	Adversarial Training	Point Cloud Classifier	ShapeNet
\cellcolor white	Sun et al. [ 333 ]	2021	Robust Training	Adversarial Training	Point Cloud Classifier	ModelNet, ScanObjectNN
\cellcolor white	PointCutMix [ 478 ]	2022	Robust Training	Adversarial Training	Point Cloud Classifier	ModelNet, ScanObjectNN
\cellcolor white	Hahner et al. [ 116 ]	2021	Robust Training	Adversarial Training	3D Object Detector	KITTI
\cellcolor white	3D-VField [ 186 ]	2022	Robust Training	Adversarial Training	3D Object Detector	CrashD, KITTI, Waymo
\cellcolor white	BAFT [ 496 ]	2024	Robust Training	Adversarial Training	3D Object Detector	KITTI, Waymo

Table 6: A summary of adversarial defenses for spatial perception .

\cellcolor white \cellcolor perception-table-blue Attack/Defense	Method	Year	Category	Subcategory	Target Model	Dataset
\cellcolor white	TrojViT [ 508 ]	2023	Training Manipulation	Bit-Flipping	Vision Transformer	ImageNet
\cellcolor white	SWARM [ 450 ]	2024	Training Manipulation	Prompt Poisoning	Vision Transformer	CIFAR-100, ImageNet
\cellcolor white	TrojanModel [ 531 ]	2023	Training Manipulation	Trigger Injection	Speech Recognizer	Google Speech Commands
\cellcolor white	Han et al. [ 118 ]	2022	Data Poisoning	Physical Object	Object Detector	TuSimple
\cellcolor white	BadLANE [ 492 ]	2024	Data Poisoning	Visual Pattern	Object Detector	CULane, TuSimple
\cellcolor white	DBALD [ 218 ]	2025	Data Poisoning	Visual Pattern	Object Detector	CULane, TuSimple

Table 7: A summary of backdoor attacks and defenses for embodied perception .

\cellcolor white \cellcolor perception-table-blue Attack	Method	Year	Category	Subcategory	Target Sensor	Dataset
\cellcolor white	Lenhart et al. [ 187 ]	2021	Spoofing	Replay Spoofing	GNSS	real-world data
\cellcolor white	Wang et al. [ 379 ]	2025	Spoofing	Replay Spoofing	GNSS	ESA, real-world data
\cellcolor white	Horton et al. [ 128 ]	2018	Spoofing	Generative Spoofing	GNSS	real-world data
\cellcolor white	FusionRipper [ 320 ]	2020	Spoofing	Generative Spoofing	GNSS	Apollo Data, KAIST Complex Urban
\cellcolor white	Dasgupta et al. [ 68 ]	2024	Spoofing	Generative Spoofing	GNSS	custom dataset
\cellcolor white	Zhong et al. [ 513 ]	2025	Spoofing	Generative Spoofing	GNSS	real-world data

Table 8: A summary of sensor attacks for motion perception . RF: Radio Frequency; EM: Electromagnetic.

\cellcolor white \cellcolor perception-table-blue Defense	Method	Year	Category	Subcategory	Target Sensor	Dataset
\cellcolor white	Xu et al. [ 438 ]	2018	Anti-Spoofing	Detection	Ultrasonic Ranging	real-world data
\cellcolor white	SoundFence [ 243 ]	2021	Anti-Spoofing	Detection	Ultrasonic Ranging	real-world data
\cellcolor white	SecureTrack [ 322 ]	2025	Anti-Spoofing	Detection	Ultrasonic Ranging	real-world data
\cellcolor white	Sun et al. [ 341 ]	2021	Anti-Spoofing	Detection	mmWave Radar	real-world data
\cellcolor white	Nallabolu et al. [ 279 ]	2021	Anti-Spoofing	Detection	mmWave Radar	real-world data
\cellcolor white	Falco et al. [ 81 ]	2018	Anti-Spoofing	Detection	GNSS	Simulation data

Table 9: A summary of sensor defenses for motion perception .

\cellcolor white \cellcolor perception-table-blue Attack/Defense	Method	Year	Category	Subcategory	Target Model	Dataset
\cellcolor white	DejaVu [ 318 ]	2025	Digital Attack	Temporal Misalignment	Fusion 3D Detector	nuScenes
\cellcolor white	Cao et al. [ 31 ]	2021	Physical Attack	Adversarial Object	Fusion 3D Detector	KITTI, nuScenes
\cellcolor white	Hallyburton et al. [ 117 ]	2022	Physical Attack	LiDAR Spoofing	Fusion 3D Detector	KITTI, nuScenes
\cellcolor white	Li et al. [ 528 ]	2024	Physical Attack	Adversarial Object	Fusion 3D Detector	nuScenes
\cellcolor white Adversarial Attack	Iranmanesh et al. [ 144 ]	2026	Physical Attack	Typographic	VLM	HomeRobot (Habitat)
\cellcolor white	Wang et al. [ 388 ]	2022	Robust Training	Adversarial Training	Fusion 3D Detector	KITTI

Table 10: A summary of adversarial attacks and defenses for cross-modal perception .

\cellcolor white \cellcolor cognition-table-green Attack/Defense	Method	Year	Category	Subcategory	Target Model	Dataset/Benchmark
\cellcolor white	CHAI [ 28 ]	2025	Instruction Attack	Jailbreak Attacks	Embodied LLM	Simulation, Real World
\cellcolor white	BadNAVer [ 254 ]	2025	Instruction Attack	Jailbreak Attacks	Navigation Agent	Matterport3D
\cellcolor white	Seeing-No-Evil [ 196 ]	2026	Instruction Attack	Jailbreak Attacks	VLM	Custom
\cellcolor white	SDoS [ 329 ]	2026	Instruction Attack	Jailbreak Attacks	Embodied LLM	Custom
\cellcolor white	Chen et al. [ 51 ]	2024	World Model Attack	Hallucination	VLM	Custom
\cellcolor white	Tao et al. [ 36 ]	2025	World Model Attack	Hallucination	VLM	Custom

Table 11: A summary of cognitive attacks and defenses for embodied cognition .

\cellcolor white \cellcolor planning-table-orange Attack/Defense	Method	Year	Category	Subcategory	Target Model	Environment
\cellcolor white	Zhang et al. [ 482 ]	2022	White-box	Optim.-Based Attack	Trajectory Planner	Apolloscape, NGSIM, nuScenes
\cellcolor white	AdvDO [ 32 ]	2022	White-box	Optim.-Based Attack	Trajectory Planner	nuScenes
\cellcolor white	KING [ 120 ]	2022	White-box	Optim.-Based Attack	Trajectory Planner	CARLA
\cellcolor white	ADvLM [ 488 ]	2024	White-box	Optim.-Based Attack	Trajectory Planner	nuScenes, DriveLM
\cellcolor white	Adv-GAN [ 82 ]	2024	White-box	Model-Based Attack	Trajectory Planner	Apolloscape, NGSIM, nuScenes
\cellcolor white	Islam et al. [ 145 ]	2024	Black-box	Optim.-Based Attack	Task Planner	EnvLarge-10

Table 12: A summary of attacks and defenses for embodied planning .

\cellcolor white \cellcolor planning-table-orange Risk	Method	Year	Category	Subcategory	Target Model	Environment
\cellcolor white	Strobel and Ferrer [ 330 ]	2020	Multi-Agent	Byzantine Faults	Multi-Agent Planner	Physical Robots
\cellcolor white	Blumenkamp et al. [ 25 ]	2021	Multi-Agent	Byzantine Faults	Multi-Agent Planner	Coverage, Path Planning
\cellcolor white	He et al. [ 124 ]	2025	Multi-Agent	Byzantine Faults	Multi-Agent Planner	Multi-Agent Frameworks
\cellcolor white	Zhou et al. [ 516 ]	2026	Multi-Agent	Byzantine Faults	Multi-Agent Planner	GQA
\cellcolor white	Choudhury et al. [ 65 ]	2022	Multi-Agent	Goal Conflicts	Multi-Agent Planner	Task Allocation
\cellcolor white	Bahrami and Jafarnejadsani [ 13 ]	2025	Multi-Agent	Goal Conflicts	Multi-Agent Planner	Relative Localization

Table 13: A summary of emerging risks for embodied planning .

\cellcolor white \cellcolor interaction-table-pink Attack	Method	Year	Category	Subcategory	Target Model	Environment
\cellcolor white	CPA/AA [ 334 ]	2020	White-Box	Optim.-Based Attack	MLP-S	Atari, MuJoCo
\cellcolor white	RS/MAD [ 474 ]	2020	White-Box	Optim.-Based Attack	MLP-S	Atari, MuJoCo
\cellcolor white	Weng et al. [ 412 ]	2020	White-Box	Optim.-Based Attack	MLP-S	MuJoCo
\cellcolor white	MAS/LAS [ 185 ]	2020	White-Box	Optim.-Based Attack	MLP-A	Atari, Gym
\cellcolor white	DP-Attacker [ 53 ]	2024	White-Box	Optim.-Based Attack	DP-S	Robosuite
\cellcolor white	Kalra et al. [ 168 ]	2025	White-Box	Optim.-Based Attack	DP-S/DT-S	RoboMimic

Table 14: A summary of adversarial attacks for robot control . For clarity, we append suffixes to the target model (MLP, DP, DT, VLA), where S , A , E , V , and L denote attack surfaces on State , Action , Environment , Vision , and Language .

\cellcolor white \cellcolor interaction-table-pink Defense	Method	Year	Category	Subcategory	Target Model	Environment
\cellcolor white	Xu et al. [ 433 ]	2025	Robust Training	Adversarial Training	VLA-V	LIBERO
\cellcolor white	ATLA [ 473 ]	2021	Robust Training	Adversarial Training	MLP-S	MuJoCo
\cellcolor white	Liu et al. [ 235 ]	2024	Robust Training	Adversarial Training	MLP-S	RoboSumo
\cellcolor white	S-DQN/S-PPO [ 332 ]	2024	Robust Training	Adversarial Training	MLP-S	Atari, MuJoCo
\cellcolor white	VALT [ 277 ]	2025	Robust Training	Adversarial Training	MLP-S	MuJoCo
\cellcolor white	ACoE [ 18 ]	2024	Robust Training	Adversarial Training	MLP-S	Highway, Atari, MuJoCo

Table 15: A summary of adversarial defenses for robot control . For clarity, we append suffixes to the target model (MLP, DP, DT, VLA), where S , A , E , V , and L denote attack surfaces on State , Action , Environment , Vision , and Language .

\cellcolor white \cellcolor interaction-table-pink Attack/Defense	Method	Year	Category	Subcategory	Target Model	Environment
\cellcolor white	BackdooRL [ 387 ]	2021	Training Manipulation	Trajectory Manipulation	MA-MLP-E	MuJoCo
\cellcolor white	MARNet [ 52 ]	2023	Training Manipulation	Trajectory Manipulation	MA-MLP-E	Predator Prey, SMAC
\cellcolor white	PNAct [ 111 ]	2025	Training Manipulation	Trajectory Manipulation	Safe-MLP-S,A	Safety-Gymnasium
\cellcolor white	BadVLA [ 522 ]	2025	Training Manipulation	Model Manipulation	VLA-V	LIBERO
\cellcolor white	Xie et al. [ 426 ]	2026	Training Manipulation	Model Manipulation	VLA-L	ROS2
\cellcolor white	FlowHijack [ 8 ]	2026	Training Manipulation	Model Manipulation	VLA-V/L	LIBERO

Table 16: A summary of backdoor attacks and defenses for robot control (Part II) , where S , A , E , R , V , and L denote attack surfaces on State , Action , Environment , Reward , Vision , and Language .

\cellcolor white \cellcolor agentic-table-purple Attack	Method	Year	Category	Subcategory	Target	Benchmark/Evaluation
\cellcolor white	RoboCodeX [ 275 ]	2024	Tool Use	Tool Creation Risks	VLA	RLBench, CALVIN
\cellcolor white	ToolHijacker [ 321 ]	2025	Tool Use	Tool Manipulation Attacks	LLM Agent	Custom
\cellcolor white	STAC [ 195 ]	2025	Tool Use	Tool Manipulation Attacks	LLM Agent	Custom
\cellcolor white	BackdoorAgent [ 89 ]	2026	Tool Use	Tool Manipulation Attacks	LLM Agent	AgentBoard
\cellcolor white	MCP-FHA [ 20 ]	2026	Tool Use	Tool Manipulation Attacks	MCP Agent	Custom
\cellcolor white	MalTool [ 131 ]	2026	Tool Use	Tool Manipulation Attacks	LLM Agent	Custom

Table 17: A summary of agentic attacks for agentic systems .

\cellcolor white \cellcolor agentic-table-purple Defense	Method	Year	Category	Subcategory	Target	Benchmark/Evaluation
\cellcolor white	Safety Chip [ 453 ]	2024	Tool Use	Tool Use Defenses	LLM Agent	Custom
\cellcolor white	SELP [ 421 ]	2024	Tool Use	Tool Use Defenses	LLM Agent	Custom
\cellcolor white	AgentSpec [ 380 ]	2026	Tool Use	Tool Use Defenses	LLM Agent	Code, Autonomous Driving, Embodied
\cellcolor white	Chang et al. [ 37 ]	2026	Tool Use	Tool Use Defenses	VLM Agent	Custom
\cellcolor white	Lv et al. [ 253 ]	2026	Tool Use	Skill Defenses	Agent Skills	Custom
\cellcolor white	RouteGuard [ 425 ]	2026	Tool Use	Skill Defenses	LLM Agent	Custom

Table 18: A summary of agentic defenses for agentic systems .

Embodied AI

Embodied AI studies agents that perceive, reason, and act through bodies in physical or simulated environments.

See all 248 papers

What Breaks Embodied AI Security:LLM Vulnerabilities, CPS Flaws,or Something Else?
Feb 19, 2026Boyang Ma, Hechuan Guo, Peizhuo Lv +5Embodied AI AI Safety
Shandong University, 72 Binhai Road, Jimo, Qingdao, Shandong, 250100, China
Embodied AI in Action: Insights from SAE World Congress 2026 on Safety, Trust, Robotics, and Real-World Deployment
May 11, 2026Jan-Mou Li, Paul Schmitt, Wei Tong +4AI Governance Trust in AI
Security of Foundation-Model-Powered Embodied Agents: Attack Surfaces, Attacks, Defenses, and Evaluation
Aug 17, 2026Jiawei Liu, Jiacheng Guo, Tian Zhang +4AI Agent Security Multi-Agent System Security
Wuhan University

Feb 19, 2026J/K move · Enter open · S save

What Breaks Embodied AI Security:LLM Vulnerabilities, CPS Flaws,or Something Else?

Boyang Ma, Hechuan Guo, Peizhuo Lv, Minghui Xu+4

Shandong University, 72 Binhai Road, Jimo, Qingdao, Shandong, 250100, China

Embodied AI AI Safety AI Agent Reliability

Open paper AskPDF arXiv

Embodied AI systems (e.g., autonomous vehicles, service robots, and LLM-driven interactive agents) are rapidly transitioning from controlled environments to safety critical real-world deployments. Unlike disembodied AI, failures in embodied intelligence lead to irreversible physical consequences, raising fundamental questions about security, safety, and reliability. While existing research predominantly analyzes embodied AI through the lenses of Large Language Model (LLM) vulnerabilities or classical Cyber-Physical System (CPS) failures, this survey argues that these perspectives are individually insufficient to explain many observed breakdowns in modern embodied systems. We posit that a significant class of failures arises from embodiment-induced system-level mismatches, rather than from isolated model flaws or traditional CPS attacks. Specifically, we identify four core insights that explain why embodied AI is fundamentally harder to secure: (i) semantic correctness does not imply physical safety, as language-level reasoning abstracts away geometry, dynamics, and contact constraints; (ii) identical actions can lead to drastically different outcomes across physical states due to nonlinear dynamics and state uncertainty; (iii) small errors propagate and amplify across tightly coupled perception-decision-action loops; and (iv) safety is not compositional across time or system layers, enabling locally safe decisions to accumulate into globally unsafe behavior. These insights suggest that securing embodied AI requires moving beyond component-level defenses toward system-level reasoning about physical risk, uncertainty, and failure propagation.

Abstract

Embodied AI

Explore similar work

What Breaks Embodied AI Security:LLM Vulnerabilities, CPS Flaws,or Something Else?

Embodied AI in Action: Insights from SAE World Congress 2026 on Safety, Trust, Robotics, and Real-World Deployment

Security of Foundation-Model-Powered Embodied Agents: Attack Surfaces, Attacks, Defenses, and Evaluation