Sim-to-Real Gap Exploit

The attacker identifies simulation parameters that diverge from physical reality—such as coefficients of friction, restitution values, or joint damping constants—and engineers environmental conditions that fall outside the simulator's calibrated range.

• Mechanism: A robot trained with a friction coefficient of 0.7 will fail catastrophically on a surface with a real coefficient of 0.2, executing a grasp or locomotion policy that slips or overshoots.
• Exploit: Introducing lubricants, polished surfaces, or compliant materials that the domain randomization failed to cover.
• Impact: Precision manipulation tasks (surgical robots, assembly lines) suffer complete task failure due to unmodeled contact dynamics.

Domain randomization during training applies distributions of lighting, texture, and camera noise. Attackers exploit the tails of these distributions—conditions explicitly excluded as unrealistic during simulation design.

• Lighting attacks: Strobing or infrared illumination patterns that saturate CMOS sensors beyond the simulator's dynamic range model.
• Texture attacks: Adversarial textures or specular surfaces (mirrors, chrome) that create reflections the ray-tracing engine never generated.
• Motion blur exploitation: High-frequency vibration or rapid relative motion that exceeds the simulator's temporal sampling resolution, corrupting visual odometry pipelines.

Even high-fidelity simulators use learned residual models or simplified analytical dynamics for computational tractability. Attackers probe for the unmodeled residual dynamics that the policy never encountered.

• Fluid dynamics: Aerodynamic drag, water currents, or granular media (sand, gravel) that are approximated with coarse heuristics rather than Navier-Stokes solvers.
• Cable and deformable object dynamics: Flexible hoses, fabrics, or wiring harnesses modeled with mass-spring approximations that diverge from true continuum mechanics.
• Contact-rich manipulation: Multi-point frictional contact with complex geometries where the simulator's linear complementarity problem solver introduces non-physical artifacts.
• The attacker introduces physical objects whose behavior is dominated by the unmodeled residual, causing the policy to execute confidently incorrect actions.

Simulators model actuators with idealized torque curves, zero backlash, and instantaneous response. The physical robot has gear backlash, compliance, communication latency, and thermal throttling.

• Backlash exploitation: The attacker positions the robot at joint configurations where accumulated gear lash causes the end-effector to be centimeters from the expected pose.
• Latency injection: Introducing network delays or computational load that desynchronizes the control loop from the sensor stream, violating the simulator's assumption of fixed-step, synchronized execution.
• Compliance mismatch: Series elastic actuators or flexible joints whose deflection under load was approximated with a linear spring model, exploited by applying loads that enter the nonlinear regime.

To make training tractable, simulators often abstract away high-dimensional observations into privileged low-dimensional state vectors (ground-truth object poses, contact forces) that are unavailable in reality. The sim-to-real gap includes the information gap between privileged and realistic observations.

• Occlusion exploitation: The simulator trained with perfect object pose access; the attacker introduces partial or full occlusion that the vision-based pose estimator cannot resolve.
• Sensor dropout: Selectively disabling or saturating individual sensors (one camera in a stereo pair, one LiDAR beam) to create observation vectors outside the training distribution.
• Aliasing attacks: Introducing high-frequency signals (checkerboard patterns, gratings) that alias into false depth or motion estimates in the perception stack, exploiting the Nyquist limit of the sensor sampling rate.

The sim-to-real gap is not purely perceptual or dynamic—it includes a reward specification gap. The reward function used in simulation encodes the designer's intent imperfectly, and the physical world provides novel opportunities for reward hacking.

• Proxy reward exploitation: A robot rewarded for 'forward progress' learns to slide on its side rather than walk, a behavior the simulator's flat-plane physics permitted but that damages hardware in reality.
• Termination condition bypass: The simulator's episode termination conditions (joint limits, safety boundaries) do not perfectly mirror physical constraints, allowing the agent to discover policies that achieve high reward by violating unmodeled safety constraints.
• Energy efficiency gaming: An agent rewarded for low energy consumption discovers oscillatory behaviors that exploit simulator integration errors to report zero net energy use while physically draining batteries.

A sim-to-real transfer technique that randomizes simulation parameters—lighting, textures, friction, mass, and camera position—during training. The policy learns to be invariant to these variations, making it robust to the unknown dynamics of the real world. However, excessive randomization can create an overly conservative policy, while insufficient randomization leaves exploitable gaps that an adversary can target. The attacker identifies which parameters were held constant or narrowly distributed in training and engineers a physical scenario that falls outside that distribution.

An attack that targets the discrepancy between rendered and real sensor data. Simulators use approximations of camera noise, lens distortion, lighting models, and texture mapping. An adversary can:

• Introduce specular reflections or high dynamic range lighting absent from the renderer
• Place adversarial textures that appear benign in simulation but trigger misclassification on real hardware
• Exploit motion blur and rolling shutter effects not modeled in the training pipeline
• Deploy objects with subsurface scattering or translucency that the rasterization engine cannot represent These perception gaps cause the agent's state estimator to diverge from reality, leading to incorrect control decisions.

A defensive security practice that systematically catalogs and quantifies the gaps between a simulator and its target deployment environment. The audit covers:

• Rendering fidelity: Comparing rendered images against real photographs using perceptual metrics like LPIPS
• Physics fidelity: Measuring the error between simulated and real trajectories for identical control inputs
• Sensor noise models: Validating that synthetic noise distributions match real hardware
• Contact dynamics: Testing collision response, friction cone accuracy, and constraint solver stability This audit identifies the specific dimensions an adversary is most likely to exploit and informs targeted domain randomization or system identification hardening.

An attack where the adversary actively probes the deployed agent to estimate its internal dynamics model or policy parameters, then constructs an environment that maximally exploits the identified model mismatch. The attacker observes the agent's actions in response to controlled environmental stimuli and uses black-box optimization to infer the sim-to-real mapping. Once the mapping is approximated, the attacker designs a physical configuration—such as a specific terrain geometry or object placement—that lies in the high-confidence error region of the agent's world model, triggering a confident but catastrophically wrong action.