PaperlayerView exact revision on arXiv

Source-linked AI summary

Seeing is Not Believing: Breaking the Physical-to-Digital Trust Boundary in Robotics

Leming Shen, Shikai Geng, Yuanqing Zheng, Chris Xiaoxuan Lu

arXiv:2609.08280v1cs.ROcs.CR

TL;DR

Downstream verifiers often rely on telemetry to assess whether a robot’s physical execution matches its task, but the paper finds that ROS 2 messages can be intercepted before publication. It uses a user-space hook to manipulate control and telemetry, and reports a 100% attack success rate in repeated task trials with and without Secure ROS 2.

  • Problem

    Downstream verifiers rely on reported telemetry to assess task execution, raising whether that telemetry faithfully reflects a robot’s physical behavior.

    Source: §I · p. 1

  • Method

    The paper exploits a pre-publication hook to intercept and alter ROS 2 control messages and synthesize telemetry from perturbed motion.

    Source: §I · p. 1, B. Generating Realistic Spoofed… · p. 5

  • Results

    100% attack success rate was achieved in 100 pick-and-place trials both with and without SROS 2.

    Source: B. Overall Attack Success Rate (RQ1) · p. 6

  • Takeaways & Limitations

    Securing telemetry in transit does not guarantee that it reflects physical reality; the paper calls for trust anchored at the physical source when measurements are acquired.

    Source: §VIII · p. 8

Abstract

from arXiv · show

In multi-robot collaboration, task handovers rely on downstream verifiers performing remote attestation, which inspects sensor telemetry to ensure a robot's physical behavior strictly matches its assigned task. But can this telemetry be trusted? We show that it often cannot. In this paper, we uncover a severe vulnerability in Robot Operating System (ROS) 2: by modifying a single environment variable, an adversary can execute a pre-built hook to covertly intercept and inject both telemetry and control signals before they are published. Consequently, adversaries can hijack a robot to perform dangerous tasks while spoofing downstream verifiers with synthesized fake telemetry. Worse still, by exploiting the widespread reliance on third-party Docker containers and auxiliary tools, attackers can distribute compromised packages embedded with these malicious hooks to launch such attacks easily. On a physical Franka Emika robotic arm running Secure ROS 2, our attack injects fabricated telemetry in real time with only around 3 ms of jitter, preserving temporal synchronization and hardware integrity while achieving an 87% success rate even against an AI-based detector. We have responsibly disclosed these findings to the ROS 2 development team. We prepared a demo video available at https://youtu.be/ExeiGqUrnhQ.

I. INTRODUCTION

Downstream verifiers often rely on reported telemetry to assess whether a robot’s physical execution matches its task. The paper shows that a compromised ROS 2 environment can decouple that telemetry from physical behavior, including while messages remain temporally consistent and securely transmitted.

I. INTRODUCTION

  • Verifiers often use reported camera frames and joint states to judge task execution because continuously observing every robot is impractical.This reliance creates a trust boundary between physical behavior and digitally reported state.Source: §I · p. 1
  • A single environment-variable change lets an adversary intercept and inject messages before publication without modifying official ROS 2 binaries.The resulting physical-digital mismatch can include hijacked control signals and fabricated telemetry for verifiers.Source: §I · p. 1
  • Among 4,429 Docker containers investigated, over 4,000 were released by unverified individuals and accounted for nearly 10.2% of registry activity, including up to 7.6 million pulls.The paper identifies this ecosystem as a potential route for distributing containers that silently deploy the interception mechanism.Source: §I · pp. 1–2
  • On a physical Franka Emika arm running Secure ROS 2, fabricated telemetry was injected with approximately 2 ms of transmission jitter while preserving high-fidelity sensor data and normal operation.The result shows that authenticating and protecting telemetry in communication does not ensure it reflects physical execution.Source: §I · p. 2
  • The authors disclosed the spoofing, hijacking, and DoS vulnerabilities to the ROS 2 development team, which discussed the concerns at a PMC meeting.Source: §I · p. 2

II. BACKGROUND

ROS 2 supports distributed robotic applications, while Secure ROS 2 protects communications but does not verify that published data reflects physical state. The ecosystem also includes substantial third-party software use and a fragmented repository landscape.

A. Robot Operating System (ROS)

  • ROS 2 extends the robotics tools and packages ecosystem toward distributed, production-oriented applications and uses DDS for communication across heterogeneous platforms.Source: A. Robot Operating System (ROS) · p. 2

B. Secure ROS 2

  • Secure ROS 2 provides authentication, access control, and encrypted communication that protect messages against unauthorized access, eavesdropping, and in-transit tampering.Those guarantees do not establish whether published data faithfully represents the robot’s physical state.Source: B. Secure ROS 2 · p. 2

C. ROS 2 Ecosystem and Supply-Chain Exposure

  • Approximately 4,400 images outside major verified namespaces account for 7.6 million pulls, or 10.2% of observed pulls.The 5,322 repositories span 3,636 owners, with only 76 marked official; the paper says these findings indicate a plausible distribution channel, not that third-party artifacts are malicious.Source: C. ROS 2 Ecosystem and Supply-Chain… · p. 2

III. THREAT MODEL

The threat model considers an attacker with an ordinary user-space foothold from a compromised ROS 2 artifact and an uncompromised verifier that relies on ROS 2 telemetry. It excludes root access, kernel or official-binary modification, SROS 2 credential compromise, and physical access.

III. THREAT MODEL

  • The attacker seeks to break the correspondence between a robot’s physical behavior and the execution evidence seen by a downstream verifier.The verifier has no independent trusted sensor continuously observing the robot’s physical state, and the foothold comes from a compromised third-party artifact run with ordinary application privileges.Source: §III · p. 2, A. Attack Goals · p. 2

A. Attack Goals

  • The two attack goals are hijacking and spoofing, which pair altered control signals with telemetry consistent with expected execution, and DoS through inconsistent or abnormal telemetry.The verifier may accept an incorrect physical execution as legitimate or reject executions and disrupt the workflow.Source: A. Attack Goals · p. 2

B. Attacker’s Capabilities

  • The attacker can intercept selected telemetry and control messages before publication, but cannot modify the kernel, official middleware binaries, firmware, or verifier.Messages are altered before SROS 2 protections apply, so falsified messages can still be authenticated and securely delivered; the attacker does not compromise SROS 2 credentials.Source: B. Attacker’s Capabilities · p. 3

IV. ATTACK SURFACE AND EXPLOIT MECHANISM

The paper identifies a common pre-middleware boundary in ROS 2 publication where message contents remain accessible. User-space function interposition can redirect publication calls to a hook that selectively modifies messages while leaving official ROS 2 binaries unchanged.

IV. ATTACK SURFACE AND EXPLOIT MECHANISM

  • The attack mechanism traces the ROS 2 publication path and uses user-space function interposition to manipulate messages before the protected communication stack, without modifying official binaries.The paper also explains why SROS 2 does not prevent this pre-protection manipulation.Source: §IV · p. 3

A. ROS 2 Publication Path

  • The rcl_publish function receives a publisher handle and message, then delegates transmission through rmw_publish to the underlying middleware.This makes rcl_publish a common pre-middleware boundary where message contents remain directly accessible.Source: A. ROS 2 Publication Path · p. 3, Figure 2 · p. 3

B. Pre-Publication Function Interposition

  • A preloaded Hook.so can export rcl_publish so calls are redirected to it, allowing selected messages to be inspected or changed before forwarding to the legitimate implementation.The hook can target telemetry or control publishers; the official ROS 2 binaries remain unchanged.Source: B. Pre-Publication Function… · p. 3, Figure 3 · p. 4

C. Why SROS 2 Does Not Prevent the Attack

SROS 2 protects messages in the communication stack, but the attack alters them before they reach that stack, so falsified telemetry can still be authenticated and encrypted. The hook intercepts telemetry and control signals, allowing the attacker to spoof the verifier while hijacking the robot.

C. Why SROS 2 Does Not Prevent the Attack

A. Attack Pipeline

  • The hook sends intercepted telemetry and control signals to an adversary’s PC, where simulated telemetry replaces real telemetry and malicious controls replace the original signals.Source: A. Attack Pipeline · p. 4
  • Because falsified telemetry feeds subsequent policy iterations, the physical robot and the policy-verifier pair follow parallel execution traces.Source: A. Attack Pipeline · p. 4

B. Generating Realistic Spoofed Telemetry

Realistic spoofed telemetry must reproduce both temporal structure and physical coupling across channels. The method perturbs the simulator’s underlying joint trajectory, then derives telemetry from that shared trajectory.

B. Generating Realistic Spoofed Telemetry

A. Experiment Setup

The experiments use a physical Franka Emika arm linked to a ROS 2 Humble victim server and a separately configured Isaac Sim attacker server. The evaluation asks whether the attack succeeds, how it performs in real time, how faithful synthesized telemetry is, whether it extends to multimodal telemetry, and how its components affect fidelity.

A. Experiment Setup

  • Experiments run ROS 2 Humble on an Ubuntu victim server linked to a Franka Emika arm, with Isaac Sim running on a similarly configured attacker server.The victim server uses an AMD Ryzen Threadripper Pro CPU and an NVIDIA RTX A6000 GPU, and runs RViz to monitor joint states.Source: A. Experiment Setup · p. 5
  • The attack requires neither root privileges nor modification of the ROS 2 package.Source: A. Experiment Setup · p. 6
  • The evaluation covers attack success, real-time performance, telemetry fidelity, multimodal extension, and each technical component’s contribution to fidelity.Source: A. Experiment Setup · p. 6

B. Overall Attack Success Rate (RQ1)

The attack hijacks the robot in every reported pick-and-place trial, including when SROS 2 is enabled, and bypasses all four tested verification methods at high rates. It also operates with low message delay and no dropped telemetry samples.

B. Overall Attack Success Rate (RQ1)

  • 100% of 100 pick-and-place trials succeeded both with and without SROS 2, with the robot executing unauthorized actions while RViz showed normal task execution.Source: B. Overall Attack Success Rate (RQ1) · p. 6
  • The attack bypassed D1, D2, D3, and D4 at rates of 98%, 100%, 95%, and 87%, respectively.D1 checks velocity bounds, D2 position–velocity consistency, D3 cross-joint correlation, and D4 temporal anomalies.Source: B. Overall Attack Success Rate (RQ1) · p. 6
  • D4 was the strongest tested defense, flagging 13% of attacks, but no single detector reliably separated fabricated from genuine telemetry.The authors attribute D4’s greater effectiveness to the difficulty of reproducing real hardware’s fine-grained temporal predictability.Source: B. Overall Attack Success Rate (RQ1) · p. 6

C. Real-Time Performance (RQ2)

  • Message delay remained below 3 ms, its standard deviation fluctuated around 4 ms, and the message drop rate was 0% during the one-minute test.The 3 ms delay was substantially below the 33 ms interval of 30 Hz joint-state data.Source: C. Real-Time Performance (RQ2) · p. 6

D. Fidelity of the Synthesized Telemetry (RQ3)

Synthesized joint telemetry falls within the variability between genuine runs across the reported position, velocity, and torque comparisons. A VLM-based image synthesizer also produces camera frames that render the simulated robot’s final state and target placement.

D. Fidelity of the Synthesized Telemetry (RQ3)

  • Telemetry fidelity is assessed using position RMSE, velocity DTW distance, and torque standard deviation across 100 task runs with and without the attack.Each synthesized run is paired with a genuine run; pairs of distinct genuine runs provide the genuine-variability reference.Source: D. Fidelity of the Synthesized… · pp. 6–7
  • Across joints and reported metrics, Real-Fake discrepancies fall within Real-Real reference variability, with no separated position median and overlapping velocity distributions.Synthesized torque spread and the per-joint medians and interquartile ranges of discrepancies also nearly coincide with the genuine-run reference.Source: D. Fidelity of the Synthesized… · p. 7

E. Multimodal Telemetry Synthesis (RQ4)

  • The VLM-based synthesizer uses simulated initial and final states plus an intercepted real image to render photorealistic final frames that show the robot’s kinematic state and target placement.Fig. 6 distinguishes third-person camera views from wrist-camera views and shows simulated, real, and synthesized images.Source: E. Multimodal Telemetry Synthesis (RQ4) · p. 7, Figure 6 · p. 7

F. Ablation Study (RQ5)

The ablation results show that the full telemetry-synthesis pipeline most closely matches real hardware and is the only setting to evade all four detectors. The discussion limits live-video spoofing to final-state images and points to acquisition-time trust as a countermeasure; the conclusion identifies the physical-to-digital trust gap.

F. Ablation Study (RQ5)

  • D1 bypass remains ∼97% across settings; coupling raises D3 bypass from 5% to 92%, micro-motion lifts D4 from 13% to 66%, and only full synthesis evades D2.D1 is bypassed throughout because simulated telemetry respects physical bounds; full synthesis derives velocity to be exactly consistent with position.Source: F. Ablation Study (RQ5) · pp. 7–8
  • The full synthesis reduces J2 discrepancy by roughly 10%, 34%, and 23% on position, velocity, and torque, and is the only setting to evade all four detectors.The ablation tables compare synthesis variants with real telemetry and report detector bypass rates.Source: F. Ablation Study (RQ5) · p. 7, Table I · p. 8, Table II · p. 8

VII. DISCUSSIONS & COUNTERMEASURES

  • The live-video threat model forges only a final-state image; the proposed countermeasure is acquisition-time signing by a trusted sensor with a monotonic counter.The discussion describes coherent real-time multi-view forgery as impractical and places SROS 2 authentication downstream of the hook’s interception point.Source: §VII · p. 8

VIII. CONCLUSION

  • On a physical Franka arm, the attack succeeds in every trial while achieving real-time spoofing and evading representative detectors; closing the gap requires signing measurements at acquisition.The conclusion distinguishes securing telemetry in transit from ensuring it reflects physical reality.Source: §VIII · p. 8
Loading 2609.08280v1…