Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

This paper claims that a seven-layer security model plus a 39×35 risk-weighted attack–defense matrix turns humanoid cybersecurity into a comparable maturity score, giving Digit 79.5%, G1 EDU 48.9%, and Pepper 39.9%.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

A seven-layer humanoid security model with a 39x35 risk-weighted scoring method, demonstrated on Pepper, G1 EDU, and Digit.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection Useful SoK synthesis of humanoid security; the quantitative RISK-MAP scores are unverifiable because all input parameters are withheld, and the abstract overstates cross-platform benchmarking that the paper's own §5.2 caveat disclaims. the 4 major comments →

arxiv 2508.17481 v2 pith:RCIEU7QR submitted 2025-08-24 cs.CR cs.RO

SoK: Cybersecurity Assessment of Humanoid Ecosystem

Priyanka Prakash Surve , Asaf Shabtai , Yuval Elovici This is my paper
classification cs.CR cs.RO
keywords humanoid robot securityseven-layer security modelattack–defense matrixrisk-weighted scoringROS/ROS2 middleware securityadversarial machine learningcross-layer vulnerability propagationsecurity maturity assessment
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that humanoid-robot security can be assessed systematically rather than case by case. It proposes a seven-layer architecture model—physical, sensing and perception, data processing, middleware, decision-making, application, and social interface—and maps 39 documented attacks and 35 defenses onto it. It then builds RISK-MAP, a 39-by-35 risk-weighted attack–defense matrix that turns this mapping into a security maturity percentage per platform, validated with 1,000 Monte Carlo runs. Applying it to Digit, G1 EDU, and Pepper yields 79.5%, 48.9%, and 39.9%, respectively. If the method holds, engineers get a shared vocabulary and a comparable number for where to spend security effort before humanoids are widely deployed.

Core claim

On its own terms, the paper claims that humanoid robots have a security profile distinct from both conventional IT and industrial cyber-physical systems, because they are perimeter-less, tightly couple perception to actuation in real-time loops, and inherit vulnerabilities from Linux, ROS/ROS2 middleware, AI accelerators, and over-the-air updates. The central discovery is a layered threat taxonomy plus a quantitative scoring procedure: each attack gets a baseline severity (likelihood × impact), each platform filters attacks by applicability, each defense is rated for baseline effectiveness and for how completely the platform implements it, and the final RISK-MAP score is the severity-weighte

What carries the argument

The seven-layer humanoid security model, adapted from the OSI layering idea, is the organizing object: it maps 39 attacks and 35 defenses onto natural functional boundaries (physical, sensing and perception, data processing, middleware, decision-making, application, social interface). The carrying mechanism is RISK-MAP, a 39×35 coverage matrix whose entries γij (defense baseline effectiveness) are multiplied by platform implementation µj to give effective coverage, combined per attack as 1−∏(1−εij), and averaged over severity weights to yield the final percentage. A 7×7 coupling matrix D=(αS+βE)∘(1−M) extends the machinery to two-hop attack cascades and residual-risk scores.

Load-bearing premise

The percentages rest on hand-assigned inputs—per-attack likelihood and impact, the 39×35 defense-effectiveness values, and per-platform implementation levels taken from literature and datasheets rather than measurement—so if those assignments are not valid indicators of real security posture, the maturity scores are not meaningful.

What would settle it

Run RISK-MAP on Pepper in its documented configuration, then in a lab attempt a representative subset of the 39 attacks (firmware reflash via debug port, ROS/DDS replay, unauthenticated NAOqi API call, LiDAR spoof) and record actual success rates and impacts; if the measured values diverge from the paper's assumed likelihood, impact, and coverage inputs beyond the Monte Carlo band, the maturity score does not measure real security posture.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Security teams can use RISK-MAP as a checklist: for each of the 39 attacks, the matrix shows which defenses exist, how effective they are rated, and whether the platform implements them.
  • Cross-platform benchmarking becomes possible on a shared 39-attack / 35-defense grid, so gaps appear as missing rows or columns rather than scattered case studies.
  • Layer and cascade diagnostics point to structural choke-points—physical-layer weaknesses and corridors like S→DP→DM—where hardening would yield the largest risk reduction.
  • Monte Carlo bands (e.g., ±3.2%, ±4.1%, ±2.8%) give a quantitative uncertainty estimate so the scores can be used despite expert-judgment inputs.
  • The paper's stated scope says scores are diagnostic for individual robots and for ecosystem-wide trends, not for ranking robots with very different capabilities.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference — the transferability premise of Table 1 is testable: several attacks are demonstrated on industrial arms, quadrupeds, drones, or vehicles and extended to humanoids with "could" statements; a direct empirical demonstration on a bipedal humanoid would confirm or refute those mappings.
  • Editorial inference — the independence assumption in combining defenses (1−∏(1−ε)) likely overestimates stacking when defenses share failure modes; modeling correlated defense failures would tighten the scores.
  • Editorial inference — the same seven-layer taxonomy and RISK-MAP procedure could be applied to other embodied AI systems (legged robots, mobile manipulators, drones), allowing security postures to be compared across robot classes rather than just humanoids.
  • Editorial inference — the paper's own caveat that a less capable platform can score higher by lacking vulnerable components implies the next needed tool: a capability-normalized benchmark.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The manuscript is a SoK that consolidates 89 papers to define a seven-layer security model for humanoid robots; it catalogs 39 attack vectors and 35 defenses (Tables 1–2), introduces RISK-MAP, a risk-weighted 39×35 attack-defense scoring method, and demonstrates it on Digit, G1 EDU, and Pepper, reporting aggregate scores 79.5%, 48.9%, and 39.9% with Monte Carlo intervals. An appendix adds a cross-layer cascade model that produces CRR values. The paper's central quantitative claim is that RISK-MAP enables systematic evaluation, cross-platform benchmarking, and investment guidance.

Significance. If the quantitative claims were auditable, this would be a significant contribution: no prior SoK ties a layered humanoid architecture to a reproducible scoring method; the taxonomy alone is useful for structuring threat/defense mapping; the layer diagnostics (Fig. 4a) and corridor analysis (Fig. 4b) give actionable targets; the PRISMA-based corpus is a useful resource. However, the central numerical result is not independently verifiable from the manuscript, and the authors' own scope caveat limits the cross-platform interpretation. The contribution is currently better described as a framework and illustrative case study than as a validated benchmark.

major comments (4)
  1. [§5.1, Eq. (1) and Steps 3–4] The report is not reproducible. The severity ω_i requires λ_i and ι_i for all 39 attacks; effective coverage ε^P_i,j = γ_i,j μ^P_j requires the 39×35 matrix Γ and the 35-entry vector μ^P for each platform; none of these are tabulated, linked, or deposited. Table 3's scores and ± ranges therefore cannot be checked against the method. The Monte Carlo analysis in the same section and in Appendix A perturbs the same hidden values by ±25% and so tests sensitivity to those priors, not their correctness. Since the abstract's 'validated through Monte Carlo analysis' and the paper's quantitative benchmarking claims rest entirely on these numbers, this is a load-bearing gap.
  2. [Table 1 and §1] The evidence basis for the 39 attack vectors is largely extrapolative. The table is headed 'Empirical attack vectors,' yet many rows are demonstrated on industrial arms, quadrupeds, vehicles, or voice assistants and transferred to humanoids by statements such as 'On humanoids, ... could ...' The Introduction itself notes that no major publicly documented cyberattacks have targeted humanoids. Step 1 derives λ_i from 'historical data ... and expert feasibility assessment.' Without a per-attack justification for why non-humanoid demonstrations support humanoid likelihood/impact values, the transferability premise silently enters Eq. (1) and propagates into every score. This should be made explicit or the affected rows reclassified as hypothetical and their weights adjusted.
  3. [§5.2, 'Methodological scope and results interpretation'] The abstract's claim that RISK-MAP 'supports cross-platform benchmarking' is contradicted by the paper's own caveat: comparing functionally dissimilar platforms requires normalization against a common capability baseline, 'a feature not currently implemented.' Because the three case-study robots differ substantially in capability, the reported ordering Digit > G1 EDU > Pepper may reflect differences in attack surface rather than security maturity. The claims in the abstract and Section 1 should be narrowed to 'diagnostic assessment for individual platforms' and the cross-platform ordering should be presented as illustrative only.
  4. [Appendix A, Eq. (2)–(5)] The cascade analysis is also non-reproducible. The coupling matrix D is built from S, E, and M matrices, and CRR depends on attack weights w_a and layer coverage C_r(l); none of these matrices or weights are reported. Consequently, the CRR values in Figure 4b and the 'Key Findings' (e.g., DP→DM→AP CRR≈0.113) cannot be recomputed, and the Monte Carlo bands in the appendix do not cover the missing S/E/M inputs. The 'structural corridors' claim is thus unsupported by published data.
minor comments (4)
  1. [Table 2, AP-D4] Reference placeholder '[?]' for 'Muratore et al.' appears in the defense description; the reference list does not contain this entry. Please replace with a full citation or remove.
  2. [Related Work (§2)] The sentence about CPS security frameworks cites [108], which is listed as 'Generating adversarial point clouds...' rather than a CPS security framework. This citation appears mismatched; please verify the intended source.
  3. [Appendix A and §5.1] Typography: 'Dii = 1 fbut' should read 'Dii = 1 but'; 'Second,We define' should read 'Second, we define'.
  4. [Figures 4a–4b] The charts include many fine-grained values without a machine-readable source. If the authors add data availability, consider including a compact appendix table or repository link so the layer scores and CRR numbers can be inspected.

Circularity Check

2 steps flagged

RISK-MAP scores are deterministic functions of undisclosed expert inputs; its Monte Carlo 'validation' only perturbs those same priors, and the seven-layer model is induced from and then 'confirmed' by the same attack/defense corpus.

specific steps
  1. self definitional [§2.2, §3.1 (Threat Validation), §4.1 (mapping as confirmation)]
    "During our content analysis, threats that initially appeared unrelated; consistently aligned with the same architectural layers. ... Threat Validation: Verifying that the 39 distinct attack vectors identified in our analysis align with the identified functional boundaries. ... Using this model, we mapped 39 attacks and 35 defenses to specific architectural layers, as we have done in Tables 1 and 2. This mapping demonstrates that threat patterns consistently align with architectural function, confirming the model’s practical utility."

    The seven-layer model was induced from the same 39-attack/35-defense corpus it is later used to organize: §3.1 identifies the layers from the literature review and 'validates' them by checking that those same attack vectors align with the layers. §4.1 then presents that alignment as confirmation ('confirming the model’s practical utility'). This is a self-consistency loop: the model is defined from the corpus, mapped back onto the corpus, and the resulting fit is offered as evidence. It does not independently establish that the layers are the natural boundaries of humanoid architectures, nor does it validate cross-platform assessment utility.

  2. other [§5.1 'Addressing Methodological Uncertainties with Monte Carlo Simulation'; Summary]
    "We addressed this by running 1,000 Monte Carlo [6, 69] iterations of RISK-MAP with input values randomly sampled within (±25%) intervals, providing statistically robust measures of platform security despite underlying data uncertainty."

    The Monte Carlo step perturbs exactly the expert-assigned inputs that already determine the output: λ_i and ι_i (Eq. 1), γ_ij and μ_j (Step 3), and w_a in Appendix A. The final RISK-MAP score is a deterministic function of these values, so resampling them with ±25% noise only measures sensitivity to the authors' priors. It cannot validate that the scores reflect real security posture; the confidence intervals are generated from the same assumptions they are claimed to confirm. Calling this 'validated through Monte Carlo analysis' (Abstract) is a self-referential validation loop.

full rationale

The derivation chain for the quantitative scores is formally well-defined (Eq. 1 through the final weighted average), and the scores are not, in themselves, circular: they are explicit—though undisclosed—functions of the authors' chosen λ_i, ι_i, γ_ij, and μ_j. The circularity lies in the two validation moves. First, the seven-layer model is extracted from the same literature corpus that is later mapped onto it, and the alignment is presented as confirmation of the model's utility. Second, the Monte Carlo analysis perturbs the very same expert inputs that produce the scores, so it demonstrates robustness to the authors' priors rather than agreement with any independent measure of security. The paper also concedes that cross-platform benchmarking would require capability normalization 'not currently implemented,' weakening the abstract's benchmarking claim; that is a scope limitation, not a circular step. The withheld input values make the scores non-reproducible, but non-reproducibility is a correctness/evidence problem separate from circularity. No load-bearing self-citation chain was found; the authors' own prior works appear only as ordinary supporting references. Overall, the central quantitative claims are partially circular through their self-referential validation, but the taxonomy and scoring framework retain independent content as a structured assessment instrument.

Axiom & Free-Parameter Ledger

7 free parameters · 5 axioms · 0 invented entities

The central quantitative claim depends on a large set of author-assigned parameters that are not published: attack likelihoods and impacts, the full defense coverage matrix, and per-platform implementation levels. The seven-layer model itself rests on the assumption that OSI-style layering and cross-platform transferability of attacks are valid for humanoids. The ledger is heavy because the paper's validation is internal: Monte Carlo noise is applied to the same subjective inputs, and the model is built from and verified against the same literature corpus.

free parameters (7)
  • Per-attack likelihood lambda_i = not published
    Assigned from CVE/threat intelligence/expert judgment (Section 5.1 Step 1); values not given, yet determine all scores.
  • Per-attack impact iota_i = not published
    Assigned on 0-1 severity scale; not published.
  • Defense coverage matrix Gamma (gamma_ij) = not published
    39x35 matrix of defense effectiveness, 'guided by empirical evidence' but actual entries absent.
  • Implementation vector mu_P = not published
    Per-platform defense implementation levels (0-1), based on datasheet inspection; not published for Digit, G1 EDU, Pepper.
  • Coupling weights alpha, beta = alpha=0.6, beta=0.4
    Chosen in Appendix A for cross-layer coupling matrix D; no sensitivity analysis reported for these.
  • Path thresholds epsilon, MIN_PROP = epsilon=0.3, MIN_PROP=0.1
    Chosen for cascade path enumeration; not justified.
  • Monte Carlo noise range = +/-25%
    Chosen for uncertainty analysis; no justification for the width.
axioms (5)
  • domain assumption OSI layering is an appropriate foundation for humanoid security architecture
    Section 3.1 states OSI provides the closest conceptual alignment; this frames the entire seven-layer model.
  • domain assumption Attacks and defenses demonstrated on non-humanoid platforms transfer to humanoids
    Table 1 repeatedly extrapolates from industrial arms, quadrupeds, AVs, and drones with 'On humanoids... could...'.
  • ad hoc to paper Defenses combine independently (multiplicative coverage)
    Section 5.1 Step 4 assumes independence, kappa_P_i = 1 - product(...). No empirical support for independence.
  • domain assumption The literature-derived seven functional layers reflect real architectural boundaries
    Section 2.2/3.1 asserts clustering reflects architectural boundaries, not researcher focus.
  • ad hoc to paper +/-25% uniform noise in MC captures parameter uncertainty
    Section 5.1 MC. The range is chosen without justification and only covers the published scales, not structural uncertainty.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of SoK: Cybersecurity Assessment of Humanoid Ecosystem." pith.science (2026). https://pith.science/paper/RCIEU7QR

@misc{pith2026250817481,
  author       = {Pith},
  title        = {Pith review of: SoK: Cybersecurity Assessment of Humanoid Ecosystem},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RCIEU7QR}},
  note         = {Machine review of arXiv:2508.17481}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Humanoids are progressing toward practical deployment across healthcare, industrial, defense, and service sectors. While typically considered cyber-physical systems (CPSs), their dependence on traditional networked software stacks (e.g., Linux operating systems), robot operating system (ROS) middleware, and over-the-air update channels, creates a distinct security profile that exposes them to vulnerabilities conventional CPS models do not fully address. Prior studies have mainly examined specific threats, such as LiDAR spoofing or adversarial machine learning (AML). This narrow focus overlooks how an attack targeting one component can cascade harm throughout the robot's interconnected systems. We address this gap through a systematization of knowledge (SoK) that takes a comprehensive approach, consolidating fragmented research from robotics, CPS, and network security domains. We introduce a seven-layer security model for humanoid robots, organizing 39 known attacks and 35 defenses across the humanoid ecosystem-from hardware to human-robot interaction. Building on this security model, we develop a quantitative 39x35 attack-defense matrix with risk-weighted scoring, validated through Monte Carlo analysis. We demonstrate our method by evaluating three real-world robots: Pepper, G1 EDU, and Digit. The scoring analysis revealed varying security maturity levels, with scores ranging from 39.9% to 79.5% across the platforms. This work introduces a structured, evidence-based assessment method that enables systematic security evaluation, supports cross-platform benchmarking, and guides prioritization of security investments in humanoid robotics.

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. CEDAR-42001: From ISO/IEC 42001 Conformity to Architecture-Aware, Audit-Visible Assurance Posture for AI Cyber-Physical Systems

    cs.CY 2026-06 unverdicted novelty 6.0

    CEDAR-42001 enriches ISO 42001 conformity audits for AI-CPS with architecture layer attribution, five-dimensional maturity profiles, risk-proportionate targets, and rulebook-derived actions, shown via synthetic fleet ...

Reference graph

Works this paper leans on

123 extracted references · 1 canonical work pages · cited by 1 Pith paper

  1. [1]

    Managing end-to-end timing jitters in ros2 computation chains

    Hazem Abaza, Debayan Roy, Bohdan Trach, Wanli Chang, Selma Saidi, Antonios Motakis, Wei Ren, and Yutao Liu. Managing end-to-end timing jitters in ros2 computation chains. In Proceedings of the 32nd In- ternational Conference on Real-Time Networks and Systems, pages 229–241, 2024

    2024

  2. [2]

    Hard- log: Practical tamper-proof system auditing using a novel audit device

    Adil Ahmad, Sangho Lee, and Marcus Peinado. Hard- log: Practical tamper-proof system auditing using a novel audit device. In 2022 IEEE Symposium on Secu- rity and Privacy (SP), pages 1791–1807. IEEE, 2022

    2022

  3. [3]

    Detecting data injection attacks in ros systems using machine learning

    Rodrigo Abrantes Antunes, Bruno L Dalmazo, and Paulo LJ Drews. Detecting data injection attacks in ros systems using machine learning. In 2022 Latin American Robotics Symposium (LARS), 2022 Brazilian Symposium on Robotics (SBR), and 2022 Workshop on Robotics in Education (WRE), pages 1–6. IEEE, 2022

    2022

  4. [4]

    Alexander Mois Aroyo, Francesco Rea, Giulio Sandini, and Alessandra Sciutti. Trust and social engineering in human robot interaction: Will a robot make you disclose sensitive information, conform to its recom- mendations or gamble? IEEE Robotics and Automation Letters, 3(4):3701–3708, 2018

    2018

  5. [5]

    How to backdoor federated learning

    Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deb- orah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In International conference on ar- tificial intelligence and statistics , pages 2938–2948. PMLR, 2020

    2020

  6. [6]

    A weighted monte carlo simulation approach to risk assessment of information security management system

    Seyed Mojtaba Hosseini Bamakan and Mohammad Dehghanimohammadabadi. A weighted monte carlo simulation approach to risk assessment of information security management system. International Journal of Enterprise Information Systems (IJEIS), 11(4):63–78, 2015

    2015

  7. [7]

    dr0wned– {Cyber- Physical} attack with additive manufacturing

    Sofia Belikovetsky, Mark Yampolskiy, Jinghui Toh, Jacob Gatlin, and Yuval Elovici. dr0wned– {Cyber- Physical} attack with additive manufacturing. In 11th USENIX workshop on offensive technologies (WOOT 17), 2017

    2017

  8. [8]

    Digital twin enabled runtime verification for autonomous mobile robots under un- certainty

    Joakim Schack Betzer, Jalil Boudjadar, Mirgita Frash- eri, and Prasad Talasila. Digital twin enabled runtime verification for autonomous mobile robots under un- certainty. In 2024 28th International Symposium on Distributed Simulation and Real Time Applications (DS-RT), pages 10–17. IEEE, 2024

    2024

  9. [9]

    State estimation for legged robots-consistent fusion of leg kinematics and imu

    Michael Bloesch, Marco Hutter, Mark A Hoepflinger, Stefan Leutenegger, Christian Gehring, C David Remy, and Roland Siegwart. State estimation for legged robots-consistent fusion of leg kinematics and imu. Robotics, 17:17–24, 2013

    2013

  10. [10]

    Cyber security of robots: A comprehen- sive survey

    Alessio Botta, Sayna Rotbei, Stefania Zinno, and Gior- gio Ventre. Cyber security of robots: A comprehen- sive survey. Intelligent Systems with Applications , 18:200237, 2023

    2023

  11. [11]

    Targeted attack on deep rl-based au- tonomous driving with learned visual patterns

    Prasanth Buddareddygari, Travis Zhang, Yezhou Yang, and Yi Ren. Targeted attack on deep rl-based au- tonomous driving with learned visual patterns. In 2022 International Conference on Robotics and Automation (ICRA), pages 10571–10577. IEEE, 2022

    2022

  12. [12]

    Cybersecurity issues in robotic platforms

    Adrián Campazas-Vega, Alberto Miguel-Diez, Mario Hermida-López, Claudia Álvarez-Aparicio, Igna- cio Samuel Crespo-Martínez, and Ángel Manuel Guerrero-Higueras. Cybersecurity issues in robotic platforms. In Proceedings of the 14th International Conference on Business Information Security (BISEC 2023), Niš, Serbia, volume 24, pages 4–11, 2023

    2023

  13. [13]

    An artic- ulated assistive robot for intuitive hands-on-payload manipulation

    Alexandre Campeau-Lecours, Pierre-Luc Belzile, Thierry Laliberté, Simon Foucault, Boris Mayer-St- Onge, Dalong Gao, and Clément Gosselin. An artic- ulated assistive robot for intuitive hands-on-payload manipulation. Robotics and Computer-Integrated Man- ufacturing, 48:182–187, 2017

    2017

  14. [14]

    You can’t see me: Physical removal attacks on {lidar-based} autonomous vehicles driving frame- works

    Yulong Cao, S Hrushikesh Bhupathiraju, Pirouz Naghavi, Takeshi Sugawara, Z Morley Mao, and Sara Rampazzi. You can’t see me: Physical removal attacks on {lidar-based} autonomous vehicles driving frame- works. In 32nd USENIX security symposium (USENIX Security 23), pages 2993–3010, 2023

    2023

  15. [15]

    Adversary is on the road: Attacks on visual {SLAM} using unnoticeable adversarial patch

    Baodong Chen, Wei Wang, Pascal Sikorski, and Ting Zhu. Adversary is on the road: Attacks on visual {SLAM} using unnoticeable adversarial patch. In 33rd USENIX Security Symposium (USENIX Security 24), pages 6345–6362, 2024

    2024

  16. [16]

    Analyzing impact and systemwide effects of the slowros attack in an industrial automation sce- nario

    Ivan Cibrario Bertolotti, Luca Durante, and Enrico Cambiaso. Analyzing impact and systemwide effects of the slowros attack in an industrial automation sce- nario. Future Internet, 17(4):167, 2025

    2025

  17. [17]

    Formalizing the execution context of behavior trees for runtime verification of deliberative policies

    Michele Colledanchise, Giuseppe Cicala, Daniele E Domenichelli, Lorenzo Natale, and Armando Tac- chella. Formalizing the execution context of behavior trees for runtime verification of deliberative policies. In 2021 IEEE/RSJ International Conference on Intel- ligent Robots and Systems (IROS), pages 9841–9848. IEEE, 2021

    2021

  18. [18]

    Scan- ning the internet for ros: A view of security in 14 robotics research

    Nicholas DeMarinis, Stefanie Tellex, Vasileios P Ke- merlis, George Konidaris, and Rodrigo Fonseca. Scan- ning the internet for ros: A view of security in 14 robotics research. In 2019 International Conference on Robotics and Automation (ICRA), pages 8514–8521. IEEE, 2019

    2019

  19. [19]

    On the (in) security of secure ros2

    Gelei Deng, Guowen Xu, Yuan Zhou, Tianwei Zhang, and Yang Liu. On the (in) security of secure ros2. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 739– 753, 2022

    2022

  20. [20]

    A spotlight on security and privacy risks with future household robots: attacks and lessons

    Tamara Denning, Cynthia Matuszek, Karl Koscher, Joshua R Smith, and Tadayoshi Kohno. A spotlight on security and privacy risks with future household robots: attacks and lessons. In Proceedings of the 11th inter- national conference on Ubiquitous computing, pages 105–114, 2009

    2009

  21. [21]

    Credential masquerading and openssl spy: Exploring ros 2 using dds security

    Vincenzo DiLuoffo, William R Michalson, and Berk Sunar. Credential masquerading and openssl spy: Exploring ros 2 using dds security. arXiv preprint arXiv:1904.09179, 2019

    Pith/arXiv arXiv 1904

  22. [22]

    Robotics cyber security issues

    Hadi Dastan Elikhchi, Thaier Hamid, and Maria Akpo- duado. Robotics cyber security issues. In Interna- tional Conference on Advances in Communication Technology and Computer Engineering , pages 217–

  23. [23]

    Peerguard: Defending multi- agent systems against backdoor attacks through mutual reasoning

    Falong Fan and Xi Li. Peerguard: Defending multi- agent systems against backdoor attacks through mutual reasoning. arXiv preprint arXiv:2505.11642, 2025

    Pith/arXiv arXiv 2025

  24. [24]

    Roborebound: Multi-robot sys- tem defense with bounded-time interaction

    Neeraj Gandhi, Yifan Cai, Andreas Haeberlen, and Linh Thi Xuan Phan. Roborebound: Multi-robot sys- tem defense with bounded-time interaction. In Pro- ceedings of the Twentieth European Conference on Computer Systems, EuroSys ’25, page 176–192, New York, NY , USA, 2025. Association for Computing Ma- chinery

    2025

  25. [25]

    Adding salt to pepper: A structured security as- sessment over a humanoid robot

    Alberto Giaretta, Michele De Donno, and Nicola Drag- oni. Adding salt to pepper: A structured security as- sessment over a humanoid robot. In Proceedings of the 13th International Conference on Availability, Re- liability and Security, pages 1–8, 2018

    2018

  26. [26]

    The week of universal robots’ bugs

    Endika Gil-Uriarte, Víctor Mayoral Vilches, Oxel Urze- lai, Nuria García, Unai Ayucar, and Juan M. The week of universal robots’ bugs. https://news.aliasrobo tics.com/week-of-universal-robots-bugs-e xposing-insecurity/, March 2020. Alias Robotics News. Accessed: 30-Aug-2025

    2020

  27. [27]

    On ladder logic bombs in industrial control systems

    Naman Govil, Anand Agrawal, and Nils Ole Tippen- hauer. On ladder logic bombs in industrial control systems. In International Workshop on the Security of Industrial Control Systems and Cyber-Physical Sys- tems, pages 110–126. Springer, 2017

    2017

  28. [28]

    Humanoid locomotion and manipulation: Cur- rent progress and challenges in control, planning, and learning

    Zhaoyuan Gu, Junheng Li, Wenlan Shen, Wenhao Yu, Zhaoming Xie, Stephen McCrory, Xianyi Cheng, Abdulaziz Shamsah, Robert Griffin, C Karen Liu, et al. Humanoid locomotion and manipulation: Cur- rent progress and challenges in control, planning, and learning. arXiv preprint arXiv:2501.02116, 2025

    Pith/arXiv arXiv 2025

  29. [29]

    Cybersecurity of robotics and autonomous systems: Privacy and safety

    Ángel Manuel Guerrero. Cybersecurity of robotics and autonomous systems: Privacy and safety. Robotics: le- gal, ethical and socioeconomic impacts, page 75, 2017

    2017

  30. [30]

    Lifelike agility and play in quadrupedal robots using reinforcement learning and generative pre-trained models

    Lei Han, Qingxu Zhu, Jiapeng Sheng, Chong Zhang, Tingguang Li, Yizheng Zhang, He Zhang, Yuzhen Liu, Cheng Zhou, Rui Zhao, et al. Lifelike agility and play in quadrupedal robots using reinforcement learning and generative pre-trained models. Nature Machine Intelligence, 6(7):787–798, 2024

    2024

  31. [31]

    Shadow-catcher: Looking into shadows to detect ghost objects in autonomous ve- hicle 3d sensing

    Zhongyuan Hau, Soteris Demetriou, Luis Muñoz- González, and Emil C Lupu. Shadow-catcher: Looking into shadows to detect ghost objects in autonomous ve- hicle 3d sensing. In European Symposium on Research in Computer Security, pages 691–711. Springer, 2021

    2021

  32. [32]

    Canceling inaudible voice commands against voice control sys- tems

    Yitao He, Junyu Bian, Xinyu Tong, Zihui Qian, Wei Zhu, Xiaohua Tian, and Xinbing Wang. Canceling inaudible voice commands against voice control sys- tems. In The 25th Annual International Conference on Mobile Computing and Networking, pages 1–15, 2019

    2019

  33. [33]

    X-detect: Explainable adversarial patch detec- tion for object detectors in retail

    Omer Hofman, Amit Giloni, Yarin Hayun, Ikuya Morikawa, Toshiya Shimizu, Yuval Elovici, and Asaf Shabtai. X-detect: Explainable adversarial patch detec- tion for object detectors in retail. Machine Learning, 113(9):6273–6292, 2024

    2024

  34. [34]

    olle, Luis Scheuch, and Patrick G¨

    Team HULKs, Maximilian Schmidt, Hendrik Sieck, Ole Felber, Konrad Valentin N¨"olle, Luis Scheuch, and Patrick G¨"ottsch. Advancing humanoid robotics with rust: An open framework for runtime efficiency. In Robot World Cup, pages 396–408. Springer, 2024

    2024

  35. [35]

    Understand- ing and overcoming the challenges of building high voltage automotive battery management systems

    Mahmoud Ismail, Patrick Leteinturier, Felix Weidner, Markus Ekler, Klaus Scheibert, Noopuran Sivaguru, Jutta Heinzelmann, and Kishore Sukumar. Understand- ing and overcoming the challenges of building high voltage automotive battery management systems. Infi- neon, 2022

    2022

  36. [36]

    Un-rocking drones: Foundations of acoustic injection attacks and recovery thereof

    Jinseob Jeong, Dongkwan Kim, Joon-Ha Jang, Juhwan Noh, Changhun Song, and Yongdae Kim. Un-rocking drones: Foundations of acoustic injection attacks and recovery thereof. In NDSS, 2023

    2023

  37. [37]

    A study on ros vulnerabilities and counter- measure

    Se-Yeon Jeong, I-Ju Choi, Yeong-Jin Kim, Yong-Min Shin, Jeong-Hun Han, Goo-Hong Jung, and Kyoung- Gon Kim. A study on ros vulnerabilities and counter- measure. In Proceedings of the companion of the 2017 15 ACM/IEEE international conference on human-robot interaction, pages 147–148, 2017

    2017

  38. [38]

    Motion planning and control with environment uncertainties for hu- manoid robot

    Zhiyong Jiang, Jiawei Zhang, Yu Wang, Liyan Chen, Jiangcheng Chen, and Siyu Wang. Motion planning and control with environment uncertainties for hu- manoid robot. In 2024 IEEE 14th International Con- ference on CYBER Technology in Automation, Control, and Intelligent Systems (CYBER), pages 78–82. IEEE, 2024

    2024

  39. [39]

    Page—practical aes-gcm encryption for low-end microcontrollers

    Kyungho Kim, Seungju Choi, Hyeokdong Kwon, Hyunjun Kim, Zhe Liu, and Hwajeong Seo. Page—practical aes-gcm encryption for low-end microcontrollers. Applied Sciences, 10(9):3131, 2020

    2020

  40. [40]

    Cybersecurity vulnera- bilities in two artificially intelligent humanoids on the market

    Matt Kinzler, Justin Miller, Zhou Wu, Andrew Williams, and Debbie Perouli. Cybersecurity vulnera- bilities in two artificially intelligent humanoids on the market. In Workshop on Technology and Consumer Protection (ConPro ‘19), held in conjunction with the 40th IEEE Symposium on Security and Privacy, 2019

    2019

  41. [41]

    Specification gam- ing: the flip side of ai ingenuity

    Victoria Krakovna, Jonathan Uesato, Vladimir Miku- lik, Matthew Rahtz, Tom Everitt, Ramana Kumar, Zac Kenton, Jan Leike, and Shane Legg. Specification gam- ing: the flip side of ai ingenuity. DeepMind Blog, 3, 2020

    2020

  42. [42]

    Do-ra: data-oriented runtime attestation for iot devices

    Boyu Kuang, Anmin Fu, Lu Zhou, Willy Susilo, and Yuqing Zhang. Do-ra: data-oriented runtime attestation for iot devices. Computers & Security , 97:101945, 2020

    2020

  43. [43]

    Ghost talk: Mitigating emi signal injection attacks against analog sensors

    Denis Foo Kune, John Backes, Shane S Clark, Daniel Kramer, Matthew Reynolds, Kevin Fu, Yongdae Kim, and Wenyuan Xu. Ghost talk: Mitigating emi signal injection attacks against analog sensors. In 2013 IEEE symposium on security and privacy , pages 145–159. IEEE, 2013

    2013

  44. [44]

    Data distribution and redistribution-a formal and practical analysis of the dds security standard

    Timm Lauser, Maximilian M ¨"uller, Ingmar Baum- gart, and Christoph Krauß. Data distribution and redistribution-a formal and practical analysis of the dds security standard. In Proceedings of the 40th ACM/SIGAPP Symposium on Applied Computing , pages 1839–1848, 2025

    2025

  45. [45]

    An empirical study of perfor- mance interference: Timing violation patterns and im- pacts

    Ao Li, Jinwen Wang, Sanjoy Baruah, Bruno Sinop- oli, and Ning Zhang. An empirical study of perfor- mance interference: Timing violation patterns and im- pacts. In Proceedings of the 30th IEEE Real-Time and Embedded Technology and Applications Symposium (RTAS’24). IEEE Computer Society Press, 2024

    2024

  46. [46]

    Phantom in the opera: adversarial music attack for robot dialogue sys- tem

    Sheng Li, Jiyi Li, and Yang Cao. Phantom in the opera: adversarial music attack for robot dialogue sys- tem. Frontiers in Computer Science, 6:1355975, 2024

    2024

  47. [47]

    Understanding and defending patched-based adversar- ial attacks for vision transformer

    Liang Liu, Yanan Guo, Youtao Zhang, and Jun Yang. Understanding and defending patched-based adversar- ial attacks for vision transformer. 2023

    2023

  48. [48]

    Ro- bust imitation learning from corrupted demonstrations

    Liu Liu, Ziyang Tang, Lanqing Li, and Dijun Luo. Ro- bust imitation learning from corrupted demonstrations. arXiv preprint arXiv:2201.12594, 2022

    Pith/arXiv arXiv 2022

  49. [49]

    {MicGuard}: A comprehensive detec- tion system against out-of-band injection attacks for different level microphone-based devices

    Tiantian Liu, Feng Lin, Zhongjie Ba, Li Lu, Zhan Qin, and Kui Ren. {MicGuard}: A comprehensive detec- tion system against out-of-band injection attacks for different level microphone-based devices. In 33rd USENIX Security Symposium (USENIX Security 24), pages 3963–3978, 2024

    2024

  50. [50]

    Aurora guard: Real-time face anti-spoofing via light reflection

    Yao Liu, Ying Tai, Jilin Li, Shouhong Ding, Chengjie Wang, Feiyue Huang, Dongyang Li, Wenshuai Qi, and Rongrong Ji. Aurora guard: Real-time face anti-spoofing via light reflection. arXiv preprint arXiv:1902.10311, 2019

    Pith/arXiv arXiv 1902

  51. [51]

    Certified adversarial robustness for deep reinforcement learning

    Bj¨"orn L¨"utjens, Michael Everett, and Jonathan P How. Certified adversarial robustness for deep reinforcement learning. In conference on Robot Learning , pages 1328–1337. PMLR, 2020

    2020

  52. [52]

    Rogue robots: Testing the limits of an in- dustrial robot’s security

    Federico Maggi, Davide Quarta, Marcello Pogliani, Mario Polino, Andrea M Zanchettin, and Stefano Zanero. Rogue robots: Testing the limits of an in- dustrial robot’s security. Trend Micro, Politecnico di Milano, Tech. Rep, pages 1–21, 2017

    2017

  53. [53]

    Intelligent humanoids in manufacturing to address worker shortage and skill gaps: Case of tesla optimus

    Ali Ahmad Malik, Tariq Masood, and Alexander Brem. Intelligent humanoids in manufacturing to address worker shortage and skill gaps: Case of tesla optimus. arXiv preprint arXiv:2304.04949, 2023

    Pith/arXiv arXiv 2023

  54. [54]

    Towards a robotic intrusion prevention system: Com- bining security and safety in cognitive social robots

    Francisco Martín, Enrique Soriano-Salvador, José Miguel Guerrero, Gorka Guardiola Muzquiz, Juan Carlos Manzanares, and Francisco J Rodríguez. Towards a robotic intrusion prevention system: Com- bining security and safety in cognitive social robots. Robotics and Autonomous Systems, 190:104959, 2025

    2025

  55. [55]

    Com- posite 3d-printed metastructures for low-frequency and broadband vibration absorption

    Kathryn H Matlack, Anton Bauhofer, Sebastian Kr¨"odel, Antonio Palermo, and Chiara Daraio. Com- posite 3d-printed metastructures for low-frequency and broadband vibration absorption. Proceedings of the National Academy of Sciences , 113(30):8386–8390, 2016

    2016

  56. [56]

    Devsecops in robotics

    Víctor Mayoral-Vilches, Nuria García-Maestro, McKenna Towers, and Endika Gil-Uriarte. Devsecops in robotics. arXiv preprint arXiv:2003.10402, 2020

    Pith/arXiv arXiv 2003

  57. [57]

    Can ros be used securely in industry? red teaming ros-industrial

    Víctor Mayoral-Vilches, Martin Pinzger, Stefan Rass, Bernhard Dieber, and Endika Gil-Uriarte. Can ros be used securely in industry? red teaming ros-industrial. arXiv preprint arXiv:2009.08211, 2020. 16

    Pith/arXiv arXiv 2009

  58. [58]

    Tros: Pro- tecting humanoids ros from privileged attackers

    Giovanni Mazzeo and Mariacarla Staffa. Tros: Pro- tecting humanoids ros from privileged attackers. In- ternational Journal of Social Robotics, 12(3):827–841, 2020

    2020

  59. [59]

    Social engineering and human-robot interactions’ risks

    Ilenia Mercuri. Social engineering and human-robot interactions’ risks. Human Factors in Cybersecurity, 53(53), 2022

    2022

  60. [60]

    Privacy-preserving face recogni- tion using trainable feature subtraction

    Yuxi Mi, Zhizhou Zhong, Yuge Huang, Jiazhen Ji, Jian- qing Xu, Jun Wang, Shaoming Wang, Shouhong Ding, and Shuigeng Zhou. Privacy-preserving face recogni- tion using trainable feature subtraction. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 297–307, 2024

    2024

  61. [61]

    Cve-2018-5268: Heap- based buffer overflow in opencv 3.3.1

    MITRE Corporation. Cve-2018-5268: Heap- based buffer overflow in opencv 3.3.1. Na- tional Vulnerability Database, 2018. In OpenCV 3.3.1, a heap-based buffer overflow happens in cv::Jpeg2KDecoder::readComponent8u in mod- ules/imgcodecs/src/grfmt_jpeg2000.cpp when parsing a crafted image file

    2018

  62. [62]

    Humanoid robots: Cybersecurity concerns and firewall implementation

    Safa Munir, Kashaf Khan, Naeem Aslam, Kamran Abid, et al. Humanoid robots: Cybersecurity concerns and firewall implementation. VFAST Transactions on Software Engineering, 11(1):85–100, 2023

    2023

  63. [63]

    Cy- bersecurity best practices for the safety of modern vehi- cles

    National Highway Traffic Safety Administration. Cy- bersecurity best practices for the safety of modern vehi- cles. Pre-final report, National Highway Traffic Safety Administration, Washington, DC, September 2022. Re- lease 2022, Pre-Final

    2022

  64. [64]

    Don’t cross me! cross-layer sys- tem security

    Najmeh Nazari, Chongzhou Fang, Sai Manoj PD, and Houman Homayoun. Don’t cross me! cross-layer sys- tem security. In 2023 60th ACM/IEEE Design Automa- tion Conference (DAC), pages 1–2. IEEE, 2023

    2023

  65. [65]

    Bootloader Secure Boot

    NVIDIA Corporation. Bootloader Secure Boot . NVIDIA Corporation, 2022. NVIDIA Jetson Linux version 34.1.1 Developer Guide documentation for se- cure boot implementation

    2022

  66. [66]

    Secure Boot

    NVIDIA Corporation. Secure Boot. NVIDIA Corpora- tion, 2024. Documentation for Jetson Orin NX, Nano, AGX Orin, Xavier NX, and AGX Xavier series secure boot implementation

    2024

  67. [67]

    A systematic review on social robots in public spaces: threat landscape and attack surface.Computers, 11(12):181, 2022

    Samson O Oruma, Mary Sánchez-Gordón, Ricardo Colomo-Palacios, Vasileios Gkioulos, and Joakim K Hansen. A systematic review on social robots in public spaces: threat landscape and attack surface.Computers, 11(12):181, 2022

    2022

  68. [68]

    Logging to the danger zone: Race condi- tion attacks and defenses on system audit frameworks

    Riccardo Paccagnella, Kevin Liao, Dave Tian, and Adam Bates. Logging to the danger zone: Race condi- tion attacks and defenses on system audit frameworks. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security , pages 1551–1574, 2020

    2020

  69. [69]

    A theory to estimate, bound, and manage systemic cyber- risk

    Ranjan Pal, Konnie Duan, and Rohan Sequeira. A theory to estimate, bound, and manage systemic cyber- risk. In 39th ACM SIGSIM Conference on Principles of Advanced Discrete Simulation, pages 70–80, 2025

    2025

  70. [70]

    Active protection against pcb physical tampering

    Steven Paley, Tamzidul Hoque, and Swarup Bhunia. Active protection against pcb physical tampering. In 2016 17th International Symposium on Quality Elec- tronic Design (ISQED), pages 356–361. IEEE, 2016

    2016

  71. [71]

    Characterizing attacks on deep reinforcement learning

    Xinlei Pan, Chaowei Xiao, Warren He, Shuang Yang, Jian Peng, Mingjie Sun, Jinfeng Yi, Zijiang Yang, Mingyan Liu, Bo Li, et al. Characterizing attacks on deep reinforcement learning. arXiv preprint arXiv:1907.09470, 2019

    Pith/arXiv arXiv 1907

  72. [72]

    Decentralized information- flow control for ros2

    Nishit V Pandya, Himanshu Kumar, Gokulnath M Pil- lai, and Vinod Ganapathy. Decentralized information- flow control for ros2. InProceedings of the 31st Annual Network and Distributed System Security Symposium (NDSS’24), 2024

    2024

  73. [73]

    An- alyzing security vulnerability and forensic investiga- tion of ros2: a case study

    Yash Patel, Parag H Rughani, and Dhruvil Desai. An- alyzing security vulnerability and forensic investiga- tion of ros2: a case study. In Proceedings of the 8th International Conference on Robotics and Artificial Intelligence, pages 6–12, 2022

    2022

  74. [74]

    Potential cy- berattacks on automated vehicles

    Jonathan Petit and Steven E Shladover. Potential cy- berattacks on automated vehicles. IEEE Transactions on Intelligent transportation systems, 16(2):546–556, 2014

    2014

  75. [75]

    Robust adversarial reinforcement learning

    Lerrel Pinto, James Davidson, Rahul Sukthankar, and Abhinav Gupta. Robust adversarial reinforcement learning. In International conference on machine learn- ing, pages 2817–2826. PMLR, 2017

    2017

  76. [76]

    Secure and lightweight over-the-air software update distribution for connected vehicles

    Christian Plappert and Andreas Fuchs. Secure and lightweight over-the-air software update distribution for connected vehicles. In Proceedings of the 39th Annual Computer Security Applications Conference, pages 268–282, 2023

    2023

  77. [77]

    Se- curity of controlled manufacturing systems in the con- nected factory: the case of industrial robots

    Marcello Pogliani, Davide Quarta, Mario Polino, Mar- tino Vittone, Federico Maggi, and Stefano Zanero. Se- curity of controlled manufacturing systems in the con- nected factory: the case of industrial robots. Jour- nal of Computer Virology and Hacking Techniques , 15(3):161–175, 2019. 17

    2019

  78. [78]

    The role of security in human-robot shared environments: A case study in ros-based surveillance robots

    David Portugal, Samuel Pereira, and Micael S Cou- ceiro. The role of security in human-robot shared environments: A case study in ros-based surveillance robots. In 2017 26th IEEE International Symposium on Robot and Human Interactive Communication (RO- MAN), pages 981–986. IEEE, 2017

    2017

  79. [79]

    Cyber security risks in robotics

    Ishaani Priyadarshini. Cyber security risks in robotics. In Detecting and mitigating robotic cyber security risks, pages 333–348. IGI Global Scientific Publishing, 2017

    2017

  80. [80]

    Real- time operating system timing jitter and its impact on motor control

    Frederick M Proctor and William P Shackleford. Real- time operating system timing jitter and its impact on motor control. In Sensors and Controls for Intelligent Manufacturing II, volume 4563, pages 10–16. SPIE, 2001

    2001

Showing first 80 references.

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.