Collision Detection Spoofing

The attacker crafts and injects a fabricated collision event into the physics engine's solver. This involves sending a spoofed contact manifold—a data structure defining the collision point, normal vector, and penetration depth—for two objects that are not actually intersecting.

• Mechanism: Exploits the engine's event-driven architecture, which trusts incoming collision pair data without re-verifying geometric intersection.
• Impact: Triggers emergency stop routines, forces path re-planning, or causes a robotic arm to jerk violently to avoid a non-existent obstacle.
• Example: Sending a false OnCollisionEnter event to a robotic gripper, causing it to release a payload mid-transit.

This attack targets the broadphase collision detection stage, which uses spatial partitioning (e.g., bounding volume hierarchies) to quickly cull object pairs that cannot possibly collide. By corrupting the broadphase data structure, the attacker removes a legitimate pair from the narrowphase detection queue.

• Mechanism: Deleting or altering an entry in the dynamic AABB tree so the overlapping pair is never flagged for detailed intersection testing.
• Impact: An autonomous vehicle's planner believes a path is clear, leading to a high-speed collision with an obstacle the physics engine has been blinded to.
• Key Distinction: Unlike sensor spoofing, this attacks the ground-truth physics model, not the perception layer.

Instead of inventing or deleting a collision, this sophisticated attack subtly alters the properties of a legitimate contact manifold to steer the agent's physical response. The attacker modifies the contact normal or penetration depth values.

• Mechanism: Rotating the contact normal vector by a few degrees causes the physics solver to apply a separation impulse in the wrong direction, nudging the agent off course.
• Impact: A bipedal robot is destabilized by a slight, incorrect lateral force applied during foot-ground contact, causing it to fall.
• Stealth: This is exceptionally hard to detect as a collision is still registered; only its physical resolution is corrupted.

This attack exploits the constraint solver's iterative nature. Physics engines use a finite number of iterations (e.g., 10-20) to resolve collisions. By flooding the engine with a burst of complex, simultaneous phantom collisions, the attacker exhausts the iteration budget.

• Mechanism: The solver cannot converge on a stable solution for the real, critical collision because it's spending all its computational time on fake ones.
• Impact: A critical joint constraint is left unresolved, causing an unstable simulation with jittering, explosions, or penetration of solid objects.
• Target: Real-time simulation loops with strict time-step deadlines, where increasing iterations is not an option.

The attacker replaces a simplified convex collision mesh with a maliciously deformed version, or swaps a high-fidelity mesh for a primitive shape. This is an integrity attack on the simulation's geometric assets.

• Mechanism: A robot's collision mesh is swapped for a slightly smaller one, allowing it to be commanded into a self-collision state that the physics engine fails to detect.
• Impact: Physical damage to the real robot, as the control policy trained on the corrupted mesh believes a joint configuration is safe when it is not.
• Asset Attack: This targets the simulation database rather than the runtime solver, making it a supply-chain style vulnerability.

This attack manipulates the timing of collision event delivery. A real collision event is buffered and delivered one physics tick late, or a phantom event is delivered one tick early, breaking the causal chain of the physics simulation.

• Mechanism: Exploiting a lack of timestamp verification on collision messages in a distributed simulation architecture.
• Impact: The agent's control loop reacts to a collision that hasn't happened yet, or fails to react to one that has, leading to cascading instability in a tightly coupled sense-think-act loop.
• Target: Distributed digital twin environments where physics is calculated on a separate node from the agent's policy.

A stealthy attack that slowly introduces a cumulative error into an agent's calculated pose or velocity, causing it to deviate from its intended path without triggering immediate alarms. By injecting sub-threshold perturbations into odometry, IMU, or visual-inertial odometry streams, the attacker causes the agent's estimated position to diverge from ground truth over time. Key characteristics:

• Error accumulates below anomaly detection thresholds
• Drift rate is calibrated to avoid triggering consistency checks
• Final position error can be meters while individual frame errors remain in millimeters

An integrity attack involving unauthorized modification of critical environmental variables within a simulation to degrade agent performance. Attackers target physics constants such as gravity, friction coefficients, restitution values, and damping factors. By subtly altering these parameters, the attacker creates a simulation that no longer matches reality, causing policies trained or validated in the compromised environment to fail upon deployment. Common targets include:

• Coefficient of friction modified to cause slippage or over-grip
• Gravity vector rotation inducing balance failures in legged robots
• Joint damping values altered to cause oscillation or sluggish response

An adversarial technique that identifies and leverages discrepancies between a simulation and the real world to cause a policy trained in simulation to fail upon deployment. Attackers systematically catalog rendering gaps, dynamics gaps, and sensing gaps, then craft environmental conditions that trigger worst-case behavior. The attack exploits the fact that no simulation perfectly models reality:

• Contact dynamics that differ between sim and real materials
• Latency differences between simulated and real sensor pipelines
• Unmodeled phenomena like cable drag, wind, or thermal expansion

A trojan attack on a learned dynamics model where a specific, rare trigger state causes the model to predict a catastrophic or attacker-defined transition. The backdoor is embedded during training and remains dormant until the agent encounters the trigger condition—a specific configuration of positions, velocities, and contacts. Upon activation, the dynamics model predicts a false next state, causing the agent's planner to select dangerous actions based on corrupted predictions. The trigger is designed to be statistically unlikely during normal operation, evading validation testing.