This article is presented in partnership with VicOne.
Robot safety and cybersecurity are increasingly intertwined as AI-enabled machines rely on a stream of data to make decisions. A mobile platform that slows in a hallway, a collaborative arm that adapts as a worker approaches, or a humanoid that pauses to yield all depend on inputs such as distance readings, position estimates, or stop signals. When those inputs are wrong, robot safety and cybersecurity concerns converge.
How an untrusted input can change a robot’s behavior
Robots do more than sense their surroundings. Many interpret visual and audio cues to determine their next action, which means intentionally placed information in the environment can influence behavior.
Published studies illustrate the risk. Research on vision-language-action models found that a visual patch in a camera’s field reduced task success in simulated evaluations. Work on FreezeVLA reported that an adversarial image could cause tested models to disregard subsequent instructions. Though the methodologies differ, both show how visual signals can derail intended tasks.
VicOne LAB R7 has run similar evaluations. In a robot-dog experiment using Gemma 4 E4B, text on a poster was interpreted as an instruction and altered the robot’s movement. In a separate hospital service robot simulation using Nemotron on NVIDIA Jetson AGX Orin, crafted audio that humans could not hear changed the robot’s simulated behavior. The tasks stayed the same, but the inputs shifted the outcomes.
Safety-related decisions have inputs too
Independent protective functions can still stop a hazardous action, yet those safeguards also rely on data such as sensor readings, estimates, and inter-system messages. If an attacker manipulates one of those signals, protections may not trigger as intended.
At a robotics bug bounty event, VicOne LAB R7 researchers injected a ROS 2/DDS message into a robot expected to remain stationary under a safe-control setting, and the robot moved. Another scenario involves a humanoid’s balance controller. If its gyroscope is vulnerable, sound at the sensor’s resonant frequency could distort reported rotation, leading the controller to correct for a tilt that never occurred. Prior research demonstrated this acoustic technique against drones with susceptible gyroscopes, though not an end-to-end chain causing a humanoid to fall.
Other layers of protection might interrupt either pathway. The key question for safety and security teams is whether those layers detect danger independently or rely on the same potentially manipulated information.
Deliberate attacks challenge safety assumptions
Safety assessments often treat combinations of accidental faults as unlikely. Adversarial manipulation alters that calculus because an attacker can time and repeat a false input. That does not guarantee harm, but it shifts how risk should be evaluated.
Redundant sensors also merit adversarial testing. If one crafted action affects multiple inputs, agreement between them may be less reassuring than expected. Autonomous driving research has shown that a physical object can mislead systems that fuse camera and LiDAR data. While not a claim about a specific robot, it underscores the need to test whether one manipulation can degrade several checks at once.
Security testing strengthens robot safety evidence
Safety teams define limits for speed, protective distances, and operating areas. The supporting evidence should show what happens when the underlying information is deliberately corrupted.
Such evidence can support assessments under relevant requirements. China’s GB/T 45502-2025 addresses information security for service robots. IEC TS 63074 considers security threats that could affect safety-related control systems. The EU Machinery Regulation, effective January 20, 2027, includes measures to protect safety-relevant systems and data against corruption. Each framework has a defined scope, so teams still need evidence tailored to their robot’s design and conditions.
Before deployment, safety and security engineers can compare normal and adversarial scenarios against the same limits. During operation, they can monitor for changes to software, models, sensor signals, or behaviors that may challenge earlier results. Any response to suspicious indicators should align with policies approved by the safety team.
According to VicOne, this lifecycle approach is supported through multiple initiatives. Via the Robotic Hacking Community, VicOne LAB R7 collaborates with researchers to study how cyber threats can alter robot behavior. VicOne’s Radeis helps teams validate potential effects prior to deployment, while Rthena provides visibility into risks and behavior during operation.
Five questions safety and security teams should answer together
The core test is whether a robot’s safeguards still protect people when the information they rely on is manipulated. Safety and security teams can trace inputs behind each protective decision, probe them, and revisit the evidence as systems evolve. Five starting questions include:
1. What does each protective function read? Map readings, estimates, messages, and confirmations. Identify safeguards that operate independently of the robot’s AI decisions.
2. How does that information arrive? Review how inputs are produced, transmitted, authenticated where appropriate, and handled when missing or implausible.
3. What happens if an input is manipulated? Test false distances, drifting position estimates, and other relevant scenarios against safety limits.
4. Can one action mislead several inputs? Check whether sensor fusion or seemingly independent safeguards share a point of failure.
5. When should the evidence be revisited? Reassess after changes to software, models, sensors, or operating conditions, and agree in advance on bounded responses to suspicious behavior.
The aim is not only to demonstrate that a protective function works. Teams also need evidence that it remains protective when its decision inputs are wrong or deliberately manipulated, and that another safeguard can catch the resulting hazard if needed. As robots evolve, the evidence must evolve with them.
As humanoid and mobile robots advance toward commercial deployment in warehouses and factories, teams can also look to examples like safety-first humanoid platforms to understand emerging approaches to integrated safeguards.