Robot Safety

Follow this topic Ask about this topic

Robot safety concerns preventing collisions, injury, unsafe contact, and unauthorized actions while robots operate in homes, workplaces, hospitals, and shared spaces. Common approaches include control barrier functions and reachability for formal safety constraints, runtime shields and backup controllers, and safe reinforcement learning that balances task reward with risk. As vision-language-action models and other learned policies enter robot control, researchers add perception-aware filters, rule-based authorization, adversarial testing, and benchmarks that measure safety throughout execution rather than task success alone. A central challenge is achieving useful performance under uncertain dynamics and imperfect sensing: guarantees depend on assumptions, interventions can be overly conservative, and success in simulation may not predict safe real-world behavior.

Latest papers

230 papers41 papers in the last four weeks, up 3% on the four weeks before. 0.2% of all new papers.

Mar 4, 2026

Whole-Body Safe Control of Robotic Systems with Koopman Neural Dynamics

Controlling robots with strongly nonlinear, high-dimensional dynamics remains challenging, as direct nonlinear optimization with safety constraints is often intractable in real time. The Koopman operator offers a way to represent nonlinear systems linearly in a lifted space, enabling the use of efficient linear control. We propose a data-driven framework that learns a Koopman embedding and operator from data, and integrates the resulting linear model with the Safe Set Algorithm (SSA). This allows the tracking and safety constraints to be solved in a single quadratic program (QP), ensuring feasibility and optimality without a separate safety filter. We validate the method on a Kinova Gen3 manipulator and a Go2 quadruped, showing accurate tracking and obstacle avoidance.

Sebin Jung, Abulikemu Abuduweili, Jiaxing Li +1

Robotics Institute, Carnegie Mellon University, Pittsburgh, PA.

Robotic Control Robot Safety Whole-Body Control Robot Dynamics Learning Koopman Operator Learning

Feb 27, 2026

Layered Safety: Enhancing Autonomous Collision Avoidance via Multistage CBF Safety Filters

This paper presents a general end-to-end framework for constructing robust and reliable layered safety filters that can be leveraged to perform dynamic collision avoidance over a broad range of applications using only local perception data. Given a robot-centric point cloud, we begin by constructing an occupancy map which is used to synthesize a Poisson safety function (PSF). The resultant PSF is employed as a control barrier function (CBF) within two distinct safety filtering stages. In the first stage, we propose a predictive safety filter to compute optimal safe trajectories based on nominal potentially-unsafe commands. The resultant short-term plans are constrained to satisfy the CBF condition along a finite prediction horizon. In the second stage, instantaneous velocity commands are further refined by a real-time CBF-based safety filter and tracked by the full-order low-level robot controller. Assuming accurate tracking of velocity commands, we obtain formal guarantees of safety for the full-order system. We validate the optimality and robustness of our multistage architecture, in comparison to traditional single-stage safety filters, via a detailed Pareto analysis. We further demonstrate the effectiveness and generality of our collision avoidance methodology on multiple legged robot platforms across a variety of real-world dynamic scenarios.

Erina Yamaguchi, Ryan M. Bena, Gilbert Bahati +1

Department of Mechanical and Civil Engineering and the Department of Aerospace, Caltech, Pasadena, CA 91125, USA

Safety-Critical Control Control Barrier Functions Robot Safety Safety Filtering Safe Motion Planning Dynamic Obstacle Avoidance+1

Feb 27, 2026

SafeGen-LLM: Enhancing Safety Generalization in Task Planning for Robotic Systems

Safety-critical task planning in robotic systems remains challenging: classical planners suffer from poor scalability, Reinforcement Learning (RL)-based methods generalize poorly, and base Large Language Models (LLMs) cannot guarantee safety. To address this gap, we propose safety-generalizable large language models, named SafeGen-LLM. SafeGen-LLM can not only enhance the safety satisfaction of task plans but also generalize well to novel safety properties in various domains. We first construct a multi-domain Planning Domain Definition Language 3 (PDDL3) benchmark with explicit safety constraints. Then, we introduce a two-stage post-training framework: Supervised Fine-Tuning (SFT) on a constraint-compliant planning dataset to learn planning syntax and semantics, and Group Relative Policy Optimization (GRPO) guided by fine-grained reward machines derived from formal verification to enforce safety alignment and by curriculum learning to better handle complex tasks. Extensive experiments show that SafeGen-LLM achieves strong safety generalization and outperforms frontier proprietary baselines across multi-domain planning tasks and multiple input formats (e.g., PDDLs and natural language).

Jialiang Fan, Weizhe Xu, Mengyu Liu +3

University of Notre Dame · Washington State University · University of Pennsylvania

Formal Methods for RL Large Language Model-Based Robot Planning Robot Task Planning Robot Safety

Feb 26, 2026

Refining Almost-Safe Value Functions on the Fly

Control Barrier Functions (CBFs) are a powerful tool for ensuring robotic safety, but designing or learning valid CBFs for complex systems is a significant challenge. While Hamilton-Jacobi Reachability provides a formal method for synthesizing safe value functions, it scales poorly and is typically performed offline, limiting its applicability in dynamic environments. This paper bridges the gap between offline synthesis and online adaptation. We introduce refineCBF for refining an approximate CBF - whether analytically derived, learned, or even unsafe - via warm-started HJ reachability. We then present its computationally efficient successor, HJ-Patch, which accelerates this process through localized updates. Both methods guarantee the recovery of a safe value function and can ensure monotonic safety improvements during adaptation. Our experiments validate our framework's primary contribution: in-the-loop, real-time adaptation, in simulation (with detailed value function analysis) and on physical hardware. Our experiments on ground vehicles and quadcopters show that our framework can successfully adapt to sudden environmental changes, such as new obstacles and unmodeled wind disturbances, providing a practical path toward deploying formally guaranteed safety in real-world settings.

Sander Tonkens, Sosuke Kojima, Chenhao Liu +2

University of California, San Diego

Safety-Critical Control Control Barrier Functions Robot Safety Reachability Analysis Adaptive Control

Feb 23, 2026

Energy-Based Injury Protection Database: Including Shearing Contact Thresholds for Hand and Finger Using Porcine Surrogates

While robotics research continues to propose strategies for collision avoidance in human-robot interaction, the reality of constrained environments and future humanoid systems makes contact inevitable. To mitigate injury risks, energy-constraining control approaches are commonly used, often relying on safety thresholds derived from blunt impact data in EN ISO 10218-2:2025. However, this dataset does not extend to edged or pointed collisions. Without scalable, clinically grounded datasets covering diverse contact scenarios, safety validation remains limited. Previous studies have laid the groundwork by assessing surrogate-based velocity and mass limits across various geometries, focusing on perpendicular impacts. This study expands those datasets by including shearing contact scenarios in unconstrained collisions, revealing that collision angle significantly affects injury outcomes. Notably, unconstrained shearing contacts result in fewer injuries than perpendicular ones. By reevaluating all prior porcine surrogate data, we establish energy thresholds across geometries and contact types, forming the first energy-based Injury Protection Database. This enables the development of meaningful energy-limiting controllers that ensure safety across a wide range of realistic collision events.

Robin Jeanne Kirschner, Anna Huber, Carina M. Micheler +4

Munich Institute of Robotics and Machine Intelligence, Technical University of Munich, 80992 Munich, Germany · TUM Hospital, Department of Orthopaedics and Sports Orthopaedics, 81675 Munich, Germany · Institute for Machine Tools and Industrial Management, TUM School of Engineering and Design, Technical University of Munich, 85748 Garching near Munich, Germany +1

Feb 23, 2026

Contextual Safety Reasoning and Grounding for Open-World Robots

Robots are increasingly operating in open-world environments where safe behavior depends on context: the same hallway may require different navigation strategies when crowded versus empty, or during an emergency versus normal operations. Traditional safety approaches enforce fixed constraints in user-specified contexts, limiting their ability to handle the open-ended contextual variability of real-world deployment. We address this gap via CORE, a safety framework that enables online contextual reasoning, grounding, and enforcement without prior knowledge of the environment (e.g., maps or safety specifications). CORE uses a vision-language model (VLM) to continuously reason about context-dependent safety rules directly from visual observations, grounds these rules in the physical environment, and enforces the resulting spatially-defined safe sets via control barrier functions. We provide probabilistic safety guarantees for CORE that account for perceptual uncertainty, and we demonstrate through simulation and real-world experiments that CORE enforces contextually appropriate behavior in unseen environments, significantly outperforming prior semantic safety methods that lack online contextual reasoning. Ablation studies validate our theoretical guarantees and underscore the importance of both VLM-based reasoning and spatial grounding for enforcing contextual safety in novel settings. We provide additional resources at https://zacravichandran.github.io/CORE.

Zachary Ravichandran, David Snyder, Alexander Robey +3

University of Pennsylvania · Carnegie Mellon University

Feb 22, 2026

Safe and Interpretable Multimodal Path Planning for Multi-Agent Cooperation

Successful cooperation among decentralized agents requires each agent to quickly adapt its plan to the behavior of other agents. In scenarios where agents cannot confidently predict one another's intentions and plans, language communication can be crucial for ensuring safety. In this work, we focus on path-level cooperation in which agents must adapt their paths to one another in order to avoid collisions or perform physical collaboration such as joint carrying. In particular, we propose a safe and interpretable multimodal path planning method, CaPE (Code as Path Editor), which generates and updates path plans for an agent based on the environment and language communication from other agents. CaPE leverages a vision-language model (VLM) to synthesize a path editing program verified by a model-based planner, grounding communication to path plan updates in a safe and interpretable way. We evaluate our approach in diverse simulated and real-world scenarios, including multi-robot and human-robot cooperation in autonomous driving, household, and joint carrying tasks. Experimental results demonstrate that CaPE can be integrated into different robotic systems as a plug-and-play module, greatly enhancing a robot's ability to align its plan to language communication from other robots or humans. We also show that the combination of the VLM-based path editing program synthesis and model-based planning safety enables robots to achieve open-ended cooperation while maintaining safety and interpretability.

Haojun Shi, Suyu Ye, Katherine M. Guerrerio +5

Johns Hopkins University

Multi-Agent Planning Multi-Robot Coordination Explainable Motion Planning Human-Robot Collaboration Robot Safety Program Synthesis

Feb 19, 2026

Evolution of Safety Requirements in Industrial Robotics: Comparative Analysis of ISO 10218-1/2 (2011 vs. 2025) and Integration of ISO/TS 15066

Industrial robotics has established itself as an integral component of large-scale manufacturing enterprises. Simultaneously, collaborative robotics is gaining prominence, introducing novel paradigms of human-machine interaction. These advancements have necessitated a comprehensive revision of safety standards, specifically incorporating requirements for cybersecurity and protection against unauthorized access in networked robotic systems. This article presents a comparative analysis of the ISO 10218:2011 and ISO 10218:2025 standards, examining the evolution of their structure, terminology, technical requirements, and annexes. The analysis reveals significant expansions in functional safety and cybersecurity, the introduction of new classifications for robots and collaborative applications, and the normative integration of the technical specification ISO/TS 15066. Consequently, the new edition synthesizes mechanical, functional, and digital safety requirements, establishing a comprehensive framework for the design and operation of modern robotic systems.

Daniel Hartmann, Kristýna Hamříková, Aleš Vysocký +2

Robot Safety Industrial Robotics

Feb 19, 2026

Distributed Virtual Model Control for Scalable Human-Robot Collaboration in Shared Workspace

We present a decentralized, agent agnostic, and safety-aware control framework for human-robot collaboration based on Virtual Model Control (VMC). In our approach, both humans and robots are embedded in the same virtual-component-shaped workspace, where motion is the result of the interaction with virtual springs and dampers rather than explicit trajectory planning. A decentralized, force-based stall detector identifies deadlocks, which are resolved through negotiation. This reduces the probability of robots getting stuck in the block placement task from up to 61.2% to zero in our experiments. The framework scales without structural changes thanks to the distributed implementation: in experiments we demonstrate safe collaboration with up to two robots and two humans, and in simulation up to four robots, maintaining inter-agent separation at around 20 cm. Results show that the method shapes robot behavior intuitively by adjusting control parameters and achieves deadlock-free operation across team sizes in all tested scenarios.

Yi Zhang, Omar Faris, Chapa Sirithunge +3

Department of Engineering, University of Cambridge, Cambridge CB2 1PZ, United Kingdom

Human-Robot Collaboration Robot Safety Feedback Control Multi-Robot Coordination

Feb 18, 2026

Unified Perceptive Fall Safety for Humanoids

Reliable fall recovery is critical for humanoids operating in cluttered environments. Unlike quadrupeds or wheeled robots, humanoids undergo high-energy impacts, complex whole-body contact, and large viewpoint changes during falls, making recovery essential. Prior work treats fall safety as separate problems (avoidance, impact mitigation, stand-up) or learns end-to-end policies without vision, typically on flat terrain. More fundamentally, it couples pose, dynamics, and terrain into a single data space, requiring exhaustive coverage and limiting generalization. We present a unified visually grounded fall-safety approach spanning all phases of recovery. It builds on two insights: (1) human fall-recovery poses are structured and transferable across terrains via alignment, and (2) effective recovery depends on interpreting the recovery goal in relation to the surrounding terrain. We train a privileged teacher using sparse human demonstrations and simulated terrains, and distill it into a deployable student that relies on egocentric depth and proprioception. The student predicts a goal-in-context latent representing the recovery target in relation to its surroundings, guiding coordinated whole-body reactions. Experiments in simulation and on a Unitree G1 demonstrate robust zero-shot fall safety across diverse terrains. Project page: https://vigor2026.github.io/.

Osher Azulay, Zhengjie Xu, Andrew Scheffer +1

University of Michigan, Ann Arbor

Humanoid Robot Fall Recovery Humanoid Robot Control Robot Safety Humanoid Robotics

Jan 27, 2026

Reversible Simplex Supervision with Post-Action Debt Accounting for Goal-Reaching RL

Deploying reinforcement learning (RL) on multi-tonne robots calls for supervisory mechanisms that address both operational safety and progress toward task completion. However, repeated switching need not preserve task progress when a learned action increases storage before recovery takes control. We introduce reversible Simplex supervision with post-action debt accounting for a frozen finite-state policy and robust-adaptive recovery. Under exact sampled-state information and stated model and certificate conditions, we prove that recovery repayment exceeding a uniform triggering-edge debt bound guarantees finite switching and finite-sample goal entry. We formulate reachability-based certificate constructions for establishing these sufficient conditions. In 20 matched simulations, goal-entry counts are 20 with debt gating and 18 without it; the two remaining runs terminate under the supervisor's admissibility stopping rule. On an experimental 6000 kg robot, 24 asphalt and soft-terrain trials evaluate 50 ms supervision above a 1 kHz actuator stack; all eight triggered recoveries complete debt-gated re-entry. The experiments demonstrate the supervisory mechanism in the tested trials.

Mehdi Heydari Shahna, Joongheon Kim, Jouni Mattila

Faculty of Engineering and Natural Sciences, Tampere University, Tampere, Finland · Department of Electrical and Computer Engineering, Korea University, Seoul, Republic of Korea

RL for Robotics Robot Safety Runtime Assurance Safe RL

Dec 9, 2025

VLSA: Vision-Language-Action Models with Plug-and-Play Safety Constraint Layer

Vision-Language-Action (VLA) models have demonstrated remarkable capabilities in generalizing across diverse robotic manipulation tasks. However, deploying these models in unstructured environments remains challenging due to the critical need for simultaneous task compliance and safety assurance, particularly in preventing potential collisions during physical interactions. In this work, we introduce a Vision-Language-Safe Action (VLSA) architecture, named AEGIS, which contains a plug-and-play safety constraint (SC) layer formulated via control barrier functions. AEGIS integrates directly with existing VLA models to improve safety with theoretical guarantees, while maintaining their original instruction-following performance. To evaluate the efficacy of our architecture, we construct a comprehensive safety-critical benchmark SafeLIBERO, spanning distinct manipulation scenarios characterized by varying degrees of spatial complexity and obstacle intervention. Extensive experiments demonstrate the superiority of our method over state-of-the-art baselines. Notably, AEGIS achieves over 50% improvement in obstacle avoidance rate while substantially increasing the task success rate by nearly 10%. All benchmark datasets, code, and supplementary materials are publicly available at https://vlsa-aegis.github.io/.

Songqiao Hu, Zeyi Liu, Shuang Liu +5

Department of Automation, Tsinghua University, Beijing 100084, China. · Institute for Embodied Intelligence and Robotics, Tsinghua University, Beijing 100084, China. · 3TetraBOT. +1

Robot Safety Vision-Language-Action Models Robot Collision Avoidance

Oct 20, 2025

HumanHalo: Safe and Efficient 3D Navigation Among Humans via Minimally Conservative MPC

Safe and efficient robotic navigation among humans is essential for integrating robots into everyday environments. Most existing approaches focus on simplified 2D crowd navigation and fail to account for the full complexity of human body dynamics beyond root motion. We present HumanHalo, an MPC framework for 3D MAV navigation among humans that combines theoretical safety guarantees with data-driven models for realistic human motion forecasting. Our approach introduces a novel reachability-based safety formulation that constrains only the initial control input for safety while modeling its effects over the entire planning horizon, enabling safe yet efficient navigation. We validate HumanHalo in both simulated experiments using real human trajectories and in the real world, demonstrating its effectiveness across tasks ranging from goal-directed navigation to visual servoing for human tracking. While we apply our method to MAV in this work, it is generic and can be adapted to other platforms. Our results show that the method preserves safety without excessive conservatism, even under imperfect human prediction and in constrained workspaces, while remaining efficient enough for real-time onboard execution.

Simon Schaefer, Helen Oleynikova, Sandra Hirche +1

Technical University of Munich · ETH Zurich

Constrained Motion Planning UAV Navigation Safe Robot Navigation Social Robot Navigation Robot Safety Model Predictive Control

Oct 7, 2025

How Well Do Latent World Models Understand Partially Observable Safety Constraints?

Latent world models are a promising approach for learning state representations and dynamics directly from high-dimensional observations, enabling robot control in hard-to-model settings. However, control performance ultimately depends on the latent representation encoding the required information for the task. In this work, we study latent-space safe control problems and show how partial observability can induce control failures when safety-relevant information is not preserved in the latent state. Specifically, we identify two world model failure modes: estimation gaps, where current observations do not reveal safety-critical quantities (e.g., temperature in a cooking task), and prediction gaps, where failures are observable once they occur but cannot be reliably anticipated from available observations. We introduce two diagnostics for these gaps: a mutual-information-based measure of safety observability and a rollout-based measure of future safety predictability. Finally, we present mitigation strategies for each failure mode: privileged multimodal supervision for estimation gaps and conformal risk calibration for prediction gaps. Across two hardware case studies -- using unimodal RGB world models and multimodal RGB+Tactile and RGB+Thermal variants -- we show that these mitigation strategies improve the safety of a Franka Research 3 manipulator on challenging cooking tasks under partial observability, albeit with increased conservativeness. More broadly, our work raises the question of when world model state representations are sufficient for reliable robot control

Matthew Kim, Kensuke Nakamura, Andrea Bajcsy

UC San Diego · Carnegie Mellon University

Latent World Models Robot Safety Partially Observable Markov Decision Processes

Jul 21, 2025

The Constitutional Controller: Doubt-Calibrated Steering of Compliant Agents

Ensuring reliable and rule-compliant behavior of autonomous agents in uncertain environments remains a fundamental challenge in modern robotics. Our work shows how neuro-symbolic systems, which integrate probabilistic, symbolic white-box reasoning models with deep learning methods, offer a powerful solution to this challenge. They enable the simultaneous consideration of explicit rules and neural models trained on noisy data, combining the strengths of structured reasoning with flexible representations. To this end, we introduce the Constitutional Controller (CoCo), a novel framework designed to enhance the safety and reliability of agents by reasoning over deep probabilistic logic programs that represent constraints, such as those found in shared traffic spaces. Furthermore, we propose the concept of self-doubt, implemented as a probability density conditioned on doubt features such as travel velocity, employed sensors, or health factors. In a real-world aerial mobility study, we demonstrate CoCo's advantages for intelligent autonomous systems to learn appropriate doubts and navigate complex, uncertain environments safely and compliantly.

Simon Kohaut, Felix Divo, Navid Hamid +4

Artificial Intelligence and Machine Learning Lab, Department of Computer Science, TU Darmstadt, 64283 Darmstadt, Germany · Honda Research Institute Europe GmbH, Carl-Legien-Str. 30, 63073 Offenbach, Germany · Uncertainty in Artificial Intelligence Group, Department of Mathematics and Computer Science, TU Eindhoven, 5600 MB Eindhoven, Netherlands +3

Robotic Control Robot Safety Neuro-Symbolic Reasoning Probabilistic Logic

Jun 2, 2025

Captivity-Escape Games as a Means for Safety in Online Motion Generation

This paper addresses conservatism, limited numerical accuracy, and high computational effort in existing methods ensuring safety by design in online model-based motion generation. The presented method employs a novel captivity-escape zero-sum differential game to adapt the planning model's performance so that resulting reference trajectories are trackable within a prescribed safety margin by a jointly synthesized safety controller. A numerical example demonstrates orders-of-magnitude faster computation and improved numerical accuracy compared to the state of the art.

Christopher Bohn, Manuel Hess, Sören Hohmann

Institute of Control Systems, Karlsruhe Institute of Technology, 76131 Karlsruhe, Germany

Trajectory Generation Safety-Critical Control Robot Motion Generation Robot Safety Model-Based Planning Safe Motion Planning

May 16, 2025

SHIELD: Safety on Humanoids via CBFs In Expectation on Learned Dynamics

Robot learning has produced remarkably effective ``black-box'' controllers for complex tasks such as dynamic locomotion on humanoids. Yet ensuring dynamic safety, i.e., constraint satisfaction, remains challenging for such policies. Reinforcement learning (RL) embeds constraints heuristically through reward engineering, and adding or modifying constraints requires retraining. Model-based approaches, like control barrier functions (CBFs), enable runtime constraint specification with formal guarantees but require accurate dynamics models. This paper presents SHIELD, a layered safety framework that bridges this gap by: (1) training a generative, stochastic dynamics residual model using real-world data from hardware rollouts of the nominal controller, capturing system behavior and uncertainties; and (2) adding a safety layer on top of the nominal (learned locomotion) controller that leverages this model via a stochastic discrete-time CBF formulation enforcing safety constraints in probability. The result is a minimally-invasive safety layer that can be added to the existing autonomy stack to give probabilistic guarantees of safety that balance risk and performance. In hardware experiments on an Unitree G1 humanoid, SHIELD enables safe navigation (obstacle avoidance) through varied indoor and outdoor environments using a nominal (unknown) RL controller and onboard perception.

Lizhi Yang, Blake Werner, Ryan K. Cosner +3

Mechanical and Civil Engineering, California Institute of Technology · Aerospace Engineering and Engineering Mechanics, UT Austin · Computer Science, Cornell University

Control Barrier Functions Humanoid Robot Control Robot Safety Safe RL

Mar 1, 2025

Passivity-Centric Safe Reinforcement Learning for Contact-Rich Robotic Tasks

Reinforcement learning (RL) has achieved remarkable success in various robotic tasks; however, its deployment in real-world scenarios, particularly in contact-rich environments, often overlooks critical safety and stability aspects. Policies without passivity guarantees can result in system instability, posing risks to robots, their environments, and human operators. In this work, we investigate the limitations of traditional RL policies when deployed in contact-rich tasks and explore the combination of energy-based passive control with safe RL in both training and deployment to answer these challenges. Firstly, we reveal the discovery that standard RL policy does not satisfy stability in contact-rich scenarios. Secondly, we introduce a passivity-aware RL policy training with energy-based constraints in our safe RL formulation. Lastly, a passivity filter is exerted on the policy output for passivity-ensured control during deployment. We conduct comparative studies on a contact-rich robotic maze exploration task, evaluating the effects of learning passivity-aware policies and the importance of passivity-ensured control. The experiments demonstrate that a passivity-agnostic RL policy easily violates energy constraints in deployment, even though it achieves high task completion in training. The results show that our proposed approach guarantees control stability through passivity filtering and improves the energy efficiency through passivity-aware training. A video of real-world experiments is available as supplementary material. We also release the checkpoint model and offline data for pre-training at Hugging Face.

Heng Zhang, Gokhan Solak, Sebastian Hjorth +1

HRI2 Lab, Istituto Italiano di Tecnologia, Genoa, Italy · Ph.D. program of national interest in Robotics and Intelligent Machines (DRIM) and University of Genova, Genoa, Italy

Robotic Control Contact-Rich Robotic Manipulation Robotic RL Robot Safety Feedback Control Passivity-Based Control+1

Dec 21, 2024

Easier Said Than Done: Unpacking Intent-Behavior Gap in Jailbreaking LLM-Based Robots

LLM-based robots use Large Language Models (LLMs) as planners to translate natural language instructions into policies such as grasp(), move_to(), and open_gripper(). Jailbreak attacks on these robots extend the threat from generating malicious content to executing harmful behaviors. However, we find that existing jailbreak attempts against LLM-based robots that produce malicious-looking policies (intent jailbreaks) often fail to induce harmful physical actions by robots (behavior jailbreaks), due to robot-specific constraints, such as logical errors and hallucinated control APIs. In this paper, we demystify the intent-behavior gap and investigate its root causes to inform effective defenses. Our measurement study finds that current LLM jailbreak methods overlook robot-specific syntax constraints (e.g., executable control APIs) and physical feasibility (e.g., ordering of policies and hardware/kinematic constraints). To bridge the gap, we introduce POEF (POlicy EFfective Jailbreak), an automated red-teaming framework that takes into account the robot-specific constraints during both the optimization and evaluation processes. Specifically, POEF employs the hidden-layer gradients from an unaligned LLM to guide the jailbreak prompt optimization and uses a multi-agent evaluator to assess the feasibility of the generated policies. Experiments on commercial robots, including the Unitree G1, the Franka robotic arm, and simulators, show that POEF achieves an 80% behavior jailbreak success rate and transfers across various LLMs. In addition, we propose two defense strategies that mitigate the behavior jailbreak risks. Our findings indicate an urgent need for stronger countermeasures before LLM-based robots are deployed at scale. The homepage is available at https://zjushine.github.io/poef.github.io/.

Xuancun Lu, Zhengxian Huang, Xinfeng Li +3

Zhejiang University

Large Language Model-Based Robot Planning Adversarial Attacks on LLMs AI Agent Security Robot Safety LLM Jailbreak Attacks

Sep 30, 2024

Adaptive Collision Sensitivity for Efficient and Safe Human-Robot Collaboration

What is considered safe for a robot operator during physical human-robot collaboration (HRC) is specified in corresponding HRC standards (e.g., ISO 10218-2:2025). The regime that allows collisions between the moving robot and the operator, called Power and Force Limiting (PFL), restricts the permissible contact forces. Using the same fixed contact thresholds on the entire robot surface results unnecessary productivity losses, as the robot needs to stop even when impact forces are within limits. Here we present a framework that decides whether the robot should interrupt motion based on estimated collision force computed individually for different parts of the robot body and dynamically on the fly, based on the Effective Mass (EM) of each robot link. We performed experiments on a simulated and real collaborative robot arm (UR10e) with sensitive skin (AIRSKIN) for collision detection and isolation. To demonstrate the generality of our method, we added experiments on simulated KUKA LBR iiwa robot, where collision sensing draws on joint torque sensing. On a mock pick-and-place scenario with both transient and quasi-static collisions, we show an increase in productivity over 45% from using the standard approach. The method is applicable to any robot for which the EF can be calculated.

Lukas Rustler, Matej Misar, Matej Hoffmann

Department of Cybernetics, Faculty of Electrical Engineering, Czech Technical University in Prague, Prague, Czech Republic

Robot Safety Human-Robot Collaboration Robot Collision Avoidance