Sim-to-Real Gap Exploitation

The attacker identifies a statistical divergence between the simulation's training distribution and the real world's deployment distribution. The policy is trained on a narrow, idealized data manifold. By introducing inputs from a tail-end distribution or an entirely out-of-distribution (OOD) state never seen in simulation, the attacker forces the model to interpolate wildly, causing catastrophic failure.

• Example: A robot trained on perfect, unscuffed objects fails to grasp a slightly worn item because the visual texture is OOD.
• Mechanism: The agent's neural network activates untested, chaotic pathways when encountering the unfamiliar input.

This involves the adversarial modification of physical constants in the real world to violate the simulator's assumptions. If a policy is trained with a fixed coefficient of friction or a specific mass, the attacker physically alters the environment to change these values.

• Example: Applying a lubricant to a surface to reduce friction below the simulator's minimum threshold, causing a walking robot to slip and fall.
• Mechanism: The control loop issues commands based on a rigid internal model; the physical divergence creates a cumulative error that the feedback controller cannot correct in time.

The attacker exploits the visual fidelity gap between synthetic rendering and physical optics. Simulators often lack realistic specular highlights, motion blur, or subsurface scattering. Adversaries can construct physical adversarial patches or lighting conditions that are optically normal but fall into the 'blind spot' of the synthetic training data.

• Example: A stop sign with a carefully patterned sticker that a vision model misclassifies because the pattern mimics a simulation rendering artifact.
• Mechanism: The convolutional filters learned on synthetic data fail to generalize to the complex light transport of the real scene.

Simulators often assume instantaneous or perfectly linear actuation. In reality, motors have inertia, backlash, and communication delays. An attacker can exploit this by forcing the agent into a high-frequency control loop where the simulated actuation profile diverges from the physical actuation profile.

• Example: Triggering a rapid stop-and-go sequence that causes a physical motor to overheat or miss steps, while the simulation predicted perfect tracking.
• Mechanism: The policy issues commands at a frequency that the physical hardware cannot achieve, leading to a desynchronized state estimation.

Simulated sensors often use simplified Gaussian noise models. Real-world sensors suffer from non-linear shot noise, saturation, and multi-path reflections. An attacker can project structured light or ultrasonic interference that is filtered out by the simulation's noise model but corrupts the real sensor stack.

• Example: Using an ultrasonic jammer to create a 'blind spot' for a drone's altimeter, which the simulation's noise filter fails to model.
• Mechanism: The Kalman filter or state estimator places high confidence in a corrupted reading because the noise profile matches the 'safe' simulated distribution.

Simulators use simplified convex hulls or primitive shapes for collision detection to save compute. An attacker designs a physical object that is non-convex or has a thin cavity that the simplified collision mesh cannot resolve.

• Example: A robotic arm trained to avoid obstacles passes through a 'ghost' object because the simulator's mesh approximation didn't capture a sharp internal edge.
• Mechanism: The planner generates a collision-free path in the abstract geometric space of the simulation, which intersects the real object's complex geometry.

An attack where adversaries corrupt the data, models, or state of a digital twin to cause the physical counterpart to make incorrect decisions or fail. Unlike sim-to-real gap exploitation—which leverages existing discrepancies—poisoning actively injects malicious corruption into the twin itself.

• Targets the synchronization pipeline between physical and virtual assets
• Can involve corrupting sensor feeds, state estimates, or the 3D environment model
• Often precedes a sim-to-real attack by creating the exploitable gap artificially

The systematic evaluation and quantification of the fidelity delta between a simulated environment and its real-world referent. Security teams use this process to identify potential vulnerabilities before adversaries do.

• Measures discrepancies in physics, rendering, sensor noise, and actuator dynamics
• Produces a risk map of which gaps are most exploitable
• Essential for hardening sim-to-real transfer pipelines against exploitation

A training technique that varies simulation parameters (lighting, friction, object masses) to produce policies robust to reality gaps. Adversarial domain randomization inverts this—manipulating parameter distributions to create policies brittle to specific real-world conditions.

• Standard practice: randomize within realistic bounds to improve generalization
• Attack vector: bias distributions toward values that fail in deployment
• Defense requires cryptographic integrity of randomization seeds and parameter ranges

A data poisoning technique targeting the domain adaptation module that maps simulated features to real-world features during transfer. By corrupting the adaptation layer, an attacker causes systematic misclassification upon deployment.

• Exploits the feature alignment process between sim and real domains
• Can be executed by poisoning the unlabeled target-domain data used for adaptation
• Results in confident but incorrect predictions in the physical system

The act of feeding a simulated agent's virtual sensors with crafted, malicious data streams to manipulate its perception and subsequent decision-making. This is a direct input to the perception stack rather than an environmental discrepancy.

• Targets virtual LiDAR, camera, IMU, and radar feeds
• Can create phantom obstacles or hide real ones from the planning module
• Often combined with sim-to-real exploitation to ensure the policy learns dangerous behaviors

A model stealing attack where an adversary queries a simulation-trained policy to create a functionally equivalent clone. The extracted model reveals proprietary strategies and, critically, the specific input ranges where the policy behaves erratically.

• Enables offline analysis of exploitable edge cases without detection
• The cloned policy can be tested against adversarial real-world conditions
• Defenses include query rate limiting and output perturbation