From bits to atoms: A survey of cross-layer safety in Embodied AI

GRAPHICAL ABSTRACT

• Digital faults, cyberattacks, or unsafe decisions in embodied AI can cause real-world harm.Embodied AI connects digital intelligence with physical action.Source: PUBLIC SUMMARY · p. 1
• The survey presents a four-layer framework spanning physical interaction, system and middleware, algorithm and decision, and cloud-edge and data.Source: PUBLIC SUMMARY · p. 1
• The framework reveals cross-layer risk propagation and unifies functional, physical, and behavioral safety with defenses.Source: PUBLIC SUMMARY · p. 1

INTRODUCTION

• Digital vulnerabilities can propagate through perception, decision-making, and control, while text-only guardrails do not verify actions against physical constraints.The introduction also notes that software, sensors, and actuators interact across cyber-to-physical and physical-to-cyber pathways.Source: INTRODUCTION · pp. 2–3
• The survey advocates action-feasibility checks, runtime assurance, and hardware safeguards alongside instruction-following alignment.It also calls for interactive, closed-loop benchmarks that assess multimodal and cross-layer risks.Source: INTRODUCTION · p. 3
• The survey’s roadmap covers hardware and software risks, compound software–hardware attack chains, embodied safety benchmarks, and future directions.Source: INTRODUCTION · p. 3

BACKGROUND

• The background introduces a four-layer architecture, clarifies safety concepts, traces the evolution of functional, physical, and behavioral safety, and presents the Identification–Mitigation–Evaluation organizing principle.Source: BACKGROUND · p. 3

A four-layer reference architecture for embodied systems

• The architecture maps physical interaction, system and middleware, algorithm and decision, and cloud-edge and data, using cross-layer flows to trace risks; it is an analytical reference, not a universally superior decomposition.Figure 1 depicts the four layers and principal cross-layer data flows; the architecture balances cross-layer traceability with platform independence.Source: A four-layer reference architecture… · p. 3, Figure 1 · p. 4

Safety definition and paradigm evolution

• Safety and security traditionally distinguish random faults from deliberate attacks, but their consequences can converge, as when LiDAR spoofing risks collision.The same perceptual failure can also arise from an adversarial pulse or an unintended reflection.Source: Safety definition and paradigm evolution · p. 4
• Robotics includes fixed, preprogrammed, teleoperated, and learned systems, while embodied AI specifically grounds learned intelligence in a closed perception–reasoning–action loop.The survey focuses on physical platforms coupling learned processes, action, and environmental feedback.Source: Safety definition and paradigm evolution · p. 4
• Safety in embodied AI requires controllability, interpretability, recoverability, and alignment amid faults, attacks, environmental anomalies, and model misspecification.The survey proposes evaluating these attributes through control-barrier and interlock measures, input-to-action traceability, fault-recovery performance, and task completion under constrained human-centric rewards.Source: Safety definition and paradigm evolution · pp. 4–5
• Functional safety addresses faults, physical safety addresses human–robot contact, and behavioral safety addresses hazards from agent decisions in open, partially observed worlds.The paradigms draw on distinct standards and methods, including SIL allocation, biomechanical limits, and emerging behavioral-safety standards and benchmarks.Source: Safety definition and paradigm evolution · p. 5
• The three safety paradigms are cumulative: embodied AI still requires mechanical interlocks and compliant contact alongside behavioral safety.The survey treats safety as cross-cutting across the four architectural layers; sensor spoofing can degrade controllability, interpretability, and recoverability.Source: Safety definition and paradigm evolution · p. 5

Cross-layer risk propagation and survey organization

• Representative chains show sensor spoofing, middleware compromise, and data contamination propagating across layers into unsafe physical actions.These examples are illustrative, not exhaustive; a comprehensive formal taxonomy of cross-layer vulnerabilities remains an open problem.Source: Cross-layer risk propagation and… · p. 5
• The survey uses an Identification–Mitigation–Evaluation triad, spanning threat identification, layered defenses, and evaluation through detection research and safety benchmarks.Mitigations range from hardware redundancy and secure boot to authenticated middleware, runtime shielding, privacy, and secure update pipelines.Source: Cross-layer risk propagation and… · p. 5
• Survey sections follow coupling strength: Layer 1 is treated separately, Layers 2–4 are integrated, propagation risks are consolidated, and evaluation is cross-cutting.This mapping groups strongly coupled middleware, algorithms, cloud-edge pipelines, and data flows rather than assigning each layer a separate section.Source: Cross-layer risk propagation and… · p. 5

Survey scope and comparison with related surveys

• Existing surveys leave gaps in coverage across all four layers, behavioral safety, compound risks, and embodied cross-layer benchmarks.The survey contrasts robot-cybersecurity, LLM-agent, autonomous-vehicle, and CPS coverage to identify these gaps.Source: Survey scope and comparison with… · p. 6
• The survey unifies embodied AI safety across four architectural layers and treats behavioral safety as an independent dimension.It also develops cross-layer propagation patterns and integrates embodied safety benchmarks.Source: Survey scope and comparison with… · pp. 6–7
• Three representative failure chains begin with sensor spoofing, middleware compromise, or data contamination and end in physical harm.The survey’s broader taxonomy includes chains such as sensor spoofing to physical harm and data poisoning to a field-triggered weight backdoor.Source: Figure 3 · p. 7, Survey scope and comparison with… · p. 7
• The survey excludes disembodied language-model content safety, general alignment theory, nonembodied teleoperation security, and robot mechanical-reliability engineering.It also leaves societal, legal, and economic deployment implications to policy literature.Source: Survey scope and comparison with… · p. 7

HARDWARE SAFETY AND SECURITY IN EMBODIED AI

• Hardware faults and attacks can propagate from the physical layer through the system stack to unsafe physical consequences.The survey positions hardware as the foundation of trustworthy embodied systems and groups protection mechanisms by defensive role.Source: HARDWARE SAFETY AND SECURITY IN… · p. 7

Visual sensor spoofing.

• Visual and other sensor spoofing can corrupt multimodal representations, create false objects or affordances, conceal hazards, and alter later reasoning, planning, and action generation.Visual attacks include adversarial patches, projected light, spectrum exploitation, and cross-domain acoustic attacks, with examples affecting traffic-light, obstacle, lane, and tracking perception.Source: Sensor security · p. 7, Visual sensor spoofing · p. 7, L1 L2 L3 L4 Behav. Comp. Bench.… · p. 8

L1 L2 L3 L4 Behav. Comp. Bench. Primary focus

• The survey’s comparison matrix distinguishes systematic, partial, and absent coverage across architectural layers, behavioral safety, compound risks, and benchmarks.Its highlighted row presents the survey’s unified four-layer treatment and explicit behavioral-safety axis.Source: L1 L2 L3 L4 Behav. Comp. Bench.… · p. 8

LiDAR/depth sensor spoofing.

• LiDAR spoofing can inject fake points into point clouds, fabricating objects, distorting obstacle positions, or hiding hazards.Attackers can synchronize with the victim sensor using a photodiode and manipulate laser-pulse delay; resulting systems may stop abruptly or suffer fatal navigation errors.Source: LiDAR/depth sensor spoofing · p. 8

IMU/GPS spoofing.

• Resonant acoustic signals can forge IMU readings, while counterfeit GPS signals can manipulate estimated position, subject to receiver-tracking and sensor-fusion constraints.Demonstrated GPS or trajectory spoofing can divert vehicles, corrupt LiDAR motion compensation, and disrupt map-assisted traffic-light detection.Source: IMU/GPS spoofing · p. 9

Tactile and force sensor tampering.

• Tampered tactile signals or sensor communications can corrupt closed-loop controller feedback and alter actuation, while sensor-array cross-talk can misstate physical stimuli.The resulting decision failures can crush objects or cause personal injury.Source: Tactile and force sensor tampering · p. 9

• Without hardware-rooted secure boot and authenticated updates, attackers may install persistent malicious MCU or SoC firmware that interferes with sensor processing or actuator commands.The resulting interference can cause unsafe platform behavior.Source: Chip and embedded system security · pp. 9–10
• Unprotected JTAG, UART, or SWD interfaces can expose privileged access for data exfiltration, payload implantation, actuator-threshold changes, or secure-boot bypass.The described attacks require physical access and an interface left enabled without appropriate access controls.Source: Chip and embedded system security · p. 10
• Side channels can reveal cryptographic keys, while precise laser fault injection can alter MCU flash reads and bypass cryptographic counters or permission checks.The fault-injection example targets 32-bit MCUs during flash-memory reads.Source: Chip and embedded system security · p. 10
• Supply-chain modifications to IP cores, IC layouts, firmware, or board support packages can remain dormant until specific triggers, enabling stealthy espionage or fleet-wide disruption.Functional testing may not detect modifications designed to activate only under particular physical triggers or environmental conditions.Source: Chip and embedded system security · p. 10

Power supply and clock system security

• Voltage glitches can induce computation or control-flow faults, while clock interference can corrupt transfers, skip instructions, desynchronize observations, and destabilize closed-loop control.Faults during VLA inference may corrupt intermediate computations or action outputs; timing disruptions can produce oscillatory or unstable motion.Source: Power supply and clock system security · p. 10

Actuator and control hardware security

• Compromised actuator controllers can override VLA commands and upstream safety constraints, causing excessive force, collisions, instability, or mechanical damage.Electronic brakes, grippers, and joint locks also need protected control paths because manipulation can prevent timely engagement or release.Source: Actuator and control hardware security · p. 10

Hardware security protection mechanisms

• The survey organizes Layer 1 protections by defensive role and recommends evaluating detection, false alarms, safety violations, intervention latency, and safe-state recovery.Its hardware-layer risk framing includes controllability, recoverability, traceability, and alignment concerns.Source: Hardware security protection mechanisms · pp. 10–11
• A TEE can isolate security-sensitive operations, and authenticated secure boot can verify each boot stage; model weights require a separate integrity and authenticity check.The boot chain starts from an immutable root of trust and extends through the bootloader and operating-system kernel.Source: Hardware security protection mechanisms · pp. 10–11
• PUF-based authentication can bind device identity to attestation evidence, while redundant sensing and independent stopping functions provide additional protection.Cross-validation requires sufficient trustworthy redundancy; emergency and protective stopping behavior depends on the robot and its risk assessment.Source: Hardware security protection mechanisms · p. 11
• Power, thermal, and vibration monitoring can flag abnormal operation, while component provenance and risk-based inspection complement a hardware root of trust.These measures do not establish whether an anomaly is malicious or guarantee detection of every compromised component.Source: Hardware security protection mechanisms · p. 11

SOFTWARE SAFETY AND SECURITY IN EMBODIED AI

• Software faults and attacks can propagate across layers: manipulated observations may mislead planners, unsafe plans may reach control, and middleware may expose command interfaces.The authors argue that safety and security should be addressed system-wide rather than within isolated modules.Source: SOFTWARE SAFETY AND SECURITY IN… · p. 11

Perception algorithm security

• Perception errors can alter an agent’s feasible actions and produce unsafe physical behavior, making perception a first security boundary.The section also describes risks from adversarial examples, physical perturbations, sensor spoofing, and localization attacks.Source: Perception algorithm security · p. 11
• Physical perturbations, including adversarial patches and road-sign attacks, can deceive perception through environmental artifacts rather than digital model access.The cited examples extend from image classification to object detection, including stop-sign disappearance attacks.Source: Perception algorithm security · p. 11
• Multimodal fusion adds attack surfaces because perturbing one modality can exploit conflict arbitration and affect both detection and high-level task reasoning.The passage identifies visual, geometric, tactile, and language-conditioned signals as possible inputs to this arbitration.Source: Perception algorithm security · pp. 11–12
• Perception defenses combine model-, sensor-, and system-level checks, with evaluation focused on whether errors propagate into unsafe plans or actions.Examples include adversarial training, sensor redundancy, temporal consistency checks, and safe modes under low confidence.Source: Perception algorithm security · p. 12

Planning and decision-making security

• Planning can remain unsafe despite correct perception because reward hacking, unsafe exploration, poisoned data, adversarial goals, or incomplete constraints can shape decisions.Long-horizon subgoals that seem locally reasonable may collectively violate constraints or cause unintended side effects.Source: Planning and decision-making security · p. 12
• Safe planning should make constraints explicit, ground goals in physical feasibility and social context, support inspection, and respond conservatively to uncertainty.The section also calls for accounting for action preconditions, forbidden states, human intent, environmental constraints, and reversibility.Source: Planning and decision-making security · pp. 12–13

Control software security

• Control attacks can tamper with commands, measurements, or actuator signals; added security checks also risk dangerous latency in real-time control.The section prioritizes command integrity, timing predictability, availability, and physical safety.Source: Control software security · p. 13
• Control safety filters check commands against physical limits and can modify unsafe commands or switch to verified fallback controllers.These safeguards address upstream learned planners or LLM-based agents that may lack formal safety guarantees.Source: Control software security · p. 13

Large models and embodied AI agent security

• Large-model vulnerabilities can cross into physical behavior through prompt injection, jailbreaks, and backdoors; the proposed architecture treats model outputs as untrusted suggestions.The section recommends independent verifiers, action-level authorization, limited tool access, and human approval for high-risk actions.Source: Large models and embodied AI agent… · p. 13

System software and middleware security

• Insecure middleware can enable eavesdropping, message injection, parameter changes, denial of service, or impersonation across a robot’s distributed components.ROS 2 uses DDS-based communication and security mechanisms, while secure deployment depends on policy generation and configuration.Source: System software and middleware security · p. 13
• Topic-level access control is insufficient alone; information-flow policies should restrict component communication to declared roles.The cited work proposes cryptographically binding and checking manifests and publish-subscribe declarations at startup.Source: System software and middleware security · p. 13

Data and privacy security

• Embodied data can reveal private spaces, identities, routines, health conditions, and behavior, while privacy risks also arise through robot interactions.The passages cover both model-level leakage and context-dependent disclosure to other people.Source: Data and privacy security · p. 14
• Privacy protections span collection through deployment, including data minimization, encryption, consent management, redaction, and context-aware policies.The same observation may be harmless in a warehouse but highly sensitive in a hospital room or private home.Source: Data and privacy security · p. 14

Software security protection mechanisms

• The protection framework spans secure development, defense-in-depth deployment, runtime monitoring and enforcement, and cross-layer security evaluation.Evaluation should examine cascading impacts across layers rather than relying only on module-level benchmarks.Source: Software security protection mechanisms · p. 14

Cross-layer coupling and risk propagation in embodied AI

• Software–hardware risks propagate bidirectionally: software defects can alter physical behavior, while physical or embedded faults can corrupt the information used by software.Timing, semantic, and physical contract failures can leave a system operating on a coherent but false state and producing unsafe actions.Source: Cross-layer coupling and risk… · pp. 14–15
• A coupling view shifts analysis from a vulnerability’s location to how far an abnormality propagates toward physical consequences.The survey frames composite risk as a chain connecting entry points, propagation paths, and physical outcomes.Source: Cross-layer coupling and risk… · p. 15

Analytical framework for composite attack chains.

• The chain-level framework uses entry point, propagation path, coupling interface, physical consequence, and stealth or persistence to characterize composite attacks.Chains A–C serve as cross-reference anchors for representative attack categories, not as an exhaustive taxonomy.Source: Analytical framework for composite… · p. 15
• Local sensor, controller, and communication abnormalities can become unsafe actuation when downstream modules accept corrupted states or lose synchronization.The same closed-loop paths may begin with non-adversarial sensor degradation, timing faults, software defects, or component wear.Source: Analytical framework for composite… · p. 15
• Remote updates and model-supply-chain attacks can carry malicious or faulty artifacts across the update-to-deployment boundary into trusted decision or control logic.Cloud-side task manipulation can also become dangerous when semantic corruption crosses the task-to-action interface and produces executable behavior.Source: Analytical framework for composite… · p. 16
• Robot data uploaded to cloud services can expose maps, activity patterns, and physical-space structure, making data leakage a reverse-direction physical risk.The section notes that encrypted traffic may still reveal activity patterns through metadata.Source: Analytical framework for composite… · p. 16

Cross-layer co-protection for software–hardware coupled risks

• Software–hardware co-protection is a closed-loop architecture that monitors task intent, verifies physical feasibility, and intervenes before unsafe behavior reaches actuation.It is not simply a collection of independent defenses attached to separate layers.Source: Cross-layer co-protection for… · pp. 16–17
• Cross-layer verification should check task, temporal, information-flow, and physical contracts from sensing through execution.The surveyed approaches include perception contracts, physical-law checks, and control-invariant monitoring.Source: Cross-layer co-protection for… · p. 16
• At the execution boundary, unsafe plans, commands, or policies should be filtered, modified, isolated, rolled back, or replaced by a safe state.Runtime assurance monitors a primary controller and can modify unsafe inputs or switch to a backup controller.Source: Cross-layer co-protection for… · pp. 16–17
• Cloud reasoning and model updates should not confer execution authority; tasks, updates, commands, and capabilities need explicit authorization, monitoring, audit, and recovery boundaries.The proposed governance separates agent cognition from execution oversight and includes policy checks, capability admission, rollback, and human override.Source: Cross-layer co-protection for… · p. 17
• Compound-chain evaluation should record propagation depth, intervention point, physical consequence, and post-incident recovery.Identification must locate both the entry point and propagation path; mitigation should interrupt the chain at one or more coupling interfaces.Source: Cross-layer co-protection for… · p. 17

Evolution path of existing safety benchmarks

• Embodied safety risks arise because software faults and attacks can propagate through perception and action to cause equipment damage or human injury.Benchmarking therefore needs to extend beyond textual safety to the consequences of physical execution.Source: EMBODIED SECURITY AND SAFETY BENCHMARKS · p. 17, Evolution path of existing safety… · p. 17
• Simulation metrics do not necessarily transfer directly to real robots because sensor drift, latency, wear, and contact dynamics can alter safety outcomes.Episode resets also do not demonstrate physical recovery when persistent damage and recovery costs are omitted.Source: Evolution path of existing safety… · p. 17
• Interactive benchmarks assess temporally extended action sequences as agents change environmental states and respond to evolving hazards.EARBench evaluates planning-phase risk awareness, while IS-Bench examines execution responses such as protective stops or safe fallback modes.Source: Evolution path of existing safety… · p. 17
• Multimodal safety evaluation should test cross-modal consistency and conflict resolution because visual or other channel perturbations can affect embodied decisions.LIBERO-Plus perturbation experiments found evaluated models less affected by abstract language perturbations than visual disruptions, without establishing modality over-reliance.Source: Evolution path of existing safety… · p. 17

Mainstream embodied safety benchmarks

• The proposed benchmarking framework maps evaluations to the four-layer architecture and an evolution from static semantic auditing to interactive physical simulation.It connects digital vulnerabilities with S1–S5 physical consequence grading; Table 4 summarizes representative benchmarks by targets and layers.Source: Mainstream embodied safety benchmarks · p. 17, Table 4 · p. 18
• Adversarial and jailbreak benchmarks test how malicious instructions or perturbations can bypass model safety and transmit risk toward physical consequences.BadRobot includes 277 malicious queries; SafeAgentBench varies hazard visibility and delay across explicit, abstract, and long-horizon implicit tasks.Source: Mainstream embodied safety benchmarks · pp. 17–18
• Interactive and domain-specific benchmarks assess planning and reactive mitigation, while specialized settings expose limits of generalized safety tests.LABSHIELD reports an average 32.0% safety-performance drop for generalized large models in high-risk chemical-reagent scenarios.Source: Mainstream embodied safety benchmarks · p. 18
• Real-world validation can test Sim-to-Real transfer, while S1–S5 grades distinguish task and physical consequences from the status of independent safety mechanisms.The proposed attack matrix organizes scenarios by vulnerability, attack vector, and potential S1–S5 consequence, distinguishing observed outcomes from projections.Source: Mainstream embodied safety benchmarks · pp. 18–19

Layer-specific challenges

• Physical-interaction research should address sensor degradation, actuator wear, calibration drift, and limited generalization across platforms and operating conditions.Proposed directions include self-diagnosing sensors, heterogeneous redundancy, online calibration, health-aware control, and independently enforced force, speed, and workspace limits.Source: Layer-specific challenges · p. 19
• Middleware security must protect communications and interfaces without violating real-time control budgets.Evaluation should report worst-case latency, deadline misses, jitter, packet loss, and effects on closed-loop stability, not only average overhead.Source: Layer-specific challenges · p. 19
• VLA runtime verification should assess the full observation–reasoning–action sequence against task, temporal, and physical constraints.When verification fails, systems may clarify, re-perceive, invoke a conservative controller, or enter a verified safe state.Source: Layer-specific challenges · p. 19
• Cloud–edge and fleet safety requires verifiable model and data provenance, update attestation, staged deployment, rollback, and quarantine mechanisms.Research should examine how poisoned maps, backdoored models, or malicious updates propagate among heterogeneous robots alongside communication, privacy, and availability costs.Source: Layer-specific challenges · p. 19

Cross-layer challenges

• Offline certification is insufficient for changing, partially observed environments, so recoverability should be treated as an independent safety attribute.The survey defines safety through controllability, interpretability, recoverability, and alignment, noting that physical actions can be irreversible.Source: Cross-layer challenges · p. 19
• Runtime assurance should monitor a verified safety envelope and enable safe degradation, including conservative control, sensor isolation, or hardware-level stops.The proposed layered architecture assigns flexible reasoning to large models, hard-constraint enforcement to verified monitors, and final containment to hardware.Source: Cross-layer challenges · p. 19
• Future safety analysis should extend from individual agents to fleets because failures can propagate through shared maps, updates, middleware, and coordinated planning.The outlook calls for studying whether compromised robots or malicious updates can induce synchronized unsafe fleet behavior.Source: Cross-layer challenges · p. 19
• Future benchmarks should measure closed-loop consequences—including severity, detection time, recoverability, damage potential, and human intervention—across layers.The proposed evaluations combine perturbations and failures with physical constraints and recovery outcomes; simulation should be complemented by digital twins, hardware-in-the-loop tests, and bounded real-world validation.Source: Cross-layer challenges · pp. 19–20

CONCLUSION

• The four-layer architecture connects physical interaction, middleware, algorithmic decisions, and cloud–edge data to cross-layer risk propagation.Sensor spoofing or compromised over-the-air updates can affect downstream perception, decision-making, or control, potentially producing unsafe behavior when protections are insufficient.Source: CONCLUSION · p. 20
• The survey advocates combining semantic and contextual assessment with physical-constraint enforcement through runtime assurance and platform-appropriate hardware safeguards.Effectiveness depends on safety specifications, implementation, and operating conditions.Source: CONCLUSION · p. 20
• Interactive, closed-loop benchmarking should evaluate multimodal and cross-layer risks using controllability, interpretability, recoverability, and alignment metrics.Such evaluations can characterize capabilities and limitations under defined conditions and inform safer deployment in environments shared with humans.Source: CONCLUSION · p. 20