Kinematic Model Inversion

The attacker solves the inverse kinematics problem in reverse. Instead of calculating joint angles for a desired end-effector pose, they identify specific joint configurations that produce mathematical singularities—points where the robot loses one or more degrees of freedom and requires infinite joint velocities to maintain a trajectory.

• Forces the manipulator into a gimbal lock state
• Causes the Jacobian matrix to become non-invertible
• Results in unpredictable, high-velocity joint movements

Before exploitation, the adversary passively observes the agent's motion trajectories to infer its Denavit-Hartenberg (DH) parameters—the standard convention for describing robot kinematics. By analyzing end-effector paths and joint movements, they reconstruct a functionally equivalent kinematic model.

• Uses system identification techniques on observed data
• Infers link lengths, joint types, and axis alignments
• Requires no access to source code or CAD models

Once a singularity is identified, the attacker crafts a sequence of waypoints that drive the agent through that configuration. At the singularity, the robot's motion controller fails because the required joint velocities approach infinity, triggering an emergency stop or causing physical damage in the real world.

• Exploits wrist singularities (axes 4 and 6 alignment)
• Exploits shoulder singularities (axes 1 and 6 alignment)
• Exploits elbow singularities (fully extended arm)

The attack is particularly dangerous because it exploits the sim-to-real transfer gap. A policy trained in simulation may never encounter singular configurations during training, making it blind to the danger. When the crafted inputs are deployed, the physical robot encounters a state its policy cannot handle.

• Training distributions often exclude edge-case kinematics
• Simulated controllers may use idealized, singularity-free solvers
• Physical robots lack the infinite torque assumed by simulation

Attackers can also force the agent to the boundary of its reachable workspace, where small Cartesian movements require disproportionately large joint displacements. This causes the robot to hit mechanical joint limits at high speed, potentially damaging actuators or the surrounding environment.

• Targets the dexterous workspace boundary
• Exploits the non-linear mapping between Cartesian and joint space
• Can cause self-collision as joints fold into extreme angles

For redundant manipulators (robots with more than 6 degrees of freedom), the attacker targets the null-space optimization—the infinite set of joint configurations that achieve the same end-effector pose. By injecting preferred joint states, they force the robot into a mechanically unstable but kinematically valid posture.

• Manipulates the secondary objective function of the controller
• Exploits under-constrained degrees of freedom
• Creates internal joint stresses without visible end-effector deviation

The adversarial practice of identifying and weaponizing the fidelity delta between a simulation and its real-world counterpart. An attacker systematically probes the simulation's physics, rendering, and sensor models to find discrepancies. Once a gap is found—such as a simulated surface having lower friction than its real equivalent—the attacker crafts a policy that is highly successful in simulation but fails catastrophically upon physical deployment. This is a primary concern for embodied intelligence systems.

A systematic security testing methodology that involves bombarding a physics simulator's solver with unexpected, malformed, or extreme inputs to discover numerical instabilities or logic bugs. Key targets include:

• NaN/Inf propagation: Causing floating-point exceptions that crash the solver.
• Constraint violation: Forcing objects into impossible overlapping states.
• Energy gain exploits: Finding configurations where the system's total energy spuriously increases, which can be used to launch objects or break constraints. These bugs can be exploited for a security bypass in the physical system.

An attack vector where an adversary feeds a simulated agent's virtual sensors with crafted, malicious data streams to manipulate its perception. This goes beyond simple noise injection; it involves generating physically plausible but adversarial inputs. For example, injecting a LiDAR point cloud that creates a phantom obstacle, or feeding a camera stream with an adversarial patch that causes a misclassification in the object detector. The goal is to force the agent into an unsafe action or state without triggering anomaly detectors.

A trojan attack targeting a learned world model or dynamics function. During training, an attacker poisons the dataset so that the model learns a hidden trigger condition. When the agent encounters this rare, specific state in deployment, the dynamics model predicts a catastrophic or attacker-defined transition instead of the true physical outcome. This causes the agent's planner to make a dangerously incorrect decision, believing it is acting safely. This is a sophisticated form of model poisoning specific to model-based reinforcement learning.

A stealthy, long-duration attack that slowly introduces a cumulative error into an agent's calculated pose, velocity, or localization. Instead of a sudden, detectable jump, the attacker adds an imperceptibly small bias to sensor readings or state updates over thousands of timesteps. The agent's internal belief of its position gradually diverges from reality. By the time the error is significant, the agent has deviated far from its intended path or has collided with an obstacle, without any single event triggering an immediate alarm. This is a direct threat to SLAM and visual-inertial odometry systems.

An integrity attack that forces a simulation to revert to a previously saved checkpoint or state. An attacker can exploit this to:

• Repeatedly exploit a one-time vulnerability: Trigger a race condition, observe the result, roll back, and trigger it again with perfect timing.
• Erase evidence of malicious behavior: Perform a malicious action, then force a rollback to a clean state before the action is logged or detected.
• Poison the training process: Corrupt a checkpoint so that when training resumes, the agent learns a compromised policy from the tainted state. This undermines the non-repudiation and integrity of simulation-based testing.