Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

SoK: Cybersecurity Assessment of Humanoid Ecosystem

T0 review · 4 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that a seven-layer security model plus a 39×35 risk-weighted attack–defense matrix turns humanoid cybersecurity into a comparable maturity score, giving Digit 79.5%, G1 EDU 48.9%, and Pepper 39.9%.

desk verdict Useful SoK synthesis of humanoid security; the quantitative RISK-MAP scores are unverifiable because all input parameters are withheld, and the abstract overstates cross-platform benchmarking that the paper's own §5.2 caveat disclaims. read the letter →

arxiv 2508.17481 v2 pith:RCIEU7QR submitted 2025-08-24 cs.CR cs.RO

Priyanka Prakash Surve , Asaf Shabtai , Yuval Elovici This is my paper
classification cs.CRcs.RO
keywords humanoidrobotsecurityseven-layermodelattack–defensematrixrisk-weightedscoringROS/ROS2middlewareadversarialmachinelearningcross-layervulnerabilitypropagationmaturityassessment
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that humanoid-robot security can be assessed systematically rather than case by case. It proposes a seven-layer architecture model—physical, sensing and perception, data processing, middleware, decision-making, application, and social interface—and maps 39 documented attacks and 35 defenses onto it. It then builds RISK-MAP, a 39-by-35 risk-weighted attack–defense matrix that turns this mapping into a security maturity percentage per platform, validated with 1,000 Monte Carlo runs. Applying it to Digit, G1 EDU, and Pepper yields 79.5%, 48.9%, and 39.9%, respectively. If the method holds, engineers get a shared vocabulary and a comparable number for where to spend security effort before humanoids are widely deployed.

What carries the argument

The seven-layer humanoid security model, adapted from the OSI layering idea, is the organizing object: it maps 39 attacks and 35 defenses onto natural functional boundaries (physical, sensing and perception, data processing, middleware, decision-making, application, social interface). The carrying mechanism is RISK-MAP, a 39×35 coverage matrix whose entries γij (defense baseline effectiveness) are multiplied by platform implementation µj to give effective coverage, combined per attack as 1−∏(1−εij), and averaged over severity weights to yield the final percentage. A 7×7 coupling matrix D=(αS+βE)∘(1−M) extends the machinery to two-hop attack cascades and residual-risk scores.

What would settle it

Run RISK-MAP on Pepper in its documented configuration, then in a lab attempt a representative subset of the 39 attacks (firmware reflash via debug port, ROS/DDS replay, unauthenticated NAOqi API call, LiDAR spoof) and record actual success rates and impacts; if the measured values diverge from the paper's assumed likelihood, impact, and coverage inputs beyond the Monte Carlo band, the maturity score does not measure real security posture.

Watch

Extended reading notes

Core claim

On its own terms, the paper claims that humanoid robots have a security profile distinct from both conventional IT and industrial cyber-physical systems, because they are perimeter-less, tightly couple perception to actuation in real-time loops, and inherit vulnerabilities from Linux, ROS/ROS2 middleware, AI accelerators, and over-the-air updates. The central discovery is a layered threat taxonomy plus a quantitative scoring procedure: each attack gets a baseline severity (likelihood × impact), each platform filters attacks by applicability, each defense is rated for baseline effectiveness and for how completely the platform implements it, and the final RISK-MAP score is the severity-weighte

Load-bearing premise

The percentages rest on hand-assigned inputs—per-attack likelihood and impact, the 39×35 defense-effectiveness values, and per-platform implementation levels taken from literature and datasheets rather than measurement—so if those assignments are not valid indicators of real security posture, the maturity scores are not meaningful.

Editorial extensions

If this is right

  • Security teams can use RISK-MAP as a checklist: for each of the 39 attacks, the matrix shows which defenses exist, how effective they are rated, and whether the platform implements them.
  • Cross-platform benchmarking becomes possible on a shared 39-attack / 35-defense grid, so gaps appear as missing rows or columns rather than scattered case studies.
  • Layer and cascade diagnostics point to structural choke-points—physical-layer weaknesses and corridors like S→DP→DM—where hardening would yield the largest risk reduction.
  • Monte Carlo bands (e.g., ±3.2%, ±4.1%, ±2.8%) give a quantitative uncertainty estimate so the scores can be used despite expert-judgment inputs.
  • The paper's stated scope says scores are diagnostic for individual robots and for ecosystem-wide trends, not for ranking robots with very different capabilities.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference — the transferability premise of Table 1 is testable: several attacks are demonstrated on industrial arms, quadrupeds, drones, or vehicles and extended to humanoids with "could" statements; a direct empirical demonstration on a bipedal humanoid would confirm or refute those mappings.
  • Editorial inference — the independence assumption in combining defenses (1−∏(1−ε)) likely overestimates stacking when defenses share failure modes; modeling correlated defense failures would tighten the scores.
  • Editorial inference — the same seven-layer taxonomy and RISK-MAP procedure could be applied to other embodied AI systems (legged robots, mobile manipulators, drones), allowing security postures to be compared across robot classes rather than just humanoids.
  • Editorial inference — the paper's own caveat that a less capable platform can score higher by lacking vulnerable components implies the next needed tool: a capability-normalized benchmark.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The manuscript is a SoK that consolidates 89 papers to define a seven-layer security model for humanoid robots; it catalogs 39 attack vectors and 35 defenses (Tables 1–2), introduces RISK-MAP, a risk-weighted 39×35 attack-defense scoring method, and demonstrates it on Digit, G1 EDU, and Pepper, reporting aggregate scores 79.5%, 48.9%, and 39.9% with Monte Carlo intervals. An appendix adds a cross-layer cascade model that produces CRR values. The paper's central quantitative claim is that RISK-MAP enables systematic evaluation, cross-platform benchmarking, and investment guidance.

Significance. If the quantitative claims were auditable, this would be a significant contribution: no prior SoK ties a layered humanoid architecture to a reproducible scoring method; the taxonomy alone is useful for structuring threat/defense mapping; the layer diagnostics (Fig. 4a) and corridor analysis (Fig. 4b) give actionable targets; the PRISMA-based corpus is a useful resource. However, the central numerical result is not independently verifiable from the manuscript, and the authors' own scope caveat limits the cross-platform interpretation. The contribution is currently better described as a framework and illustrative case study than as a validated benchmark.

major comments (4)
  1. [§5.1, Eq. (1) and Steps 3–4] The report is not reproducible. The severity ω_i requires λ_i and ι_i for all 39 attacks; effective coverage ε^P_i,j = γ_i,j μ^P_j requires the 39×35 matrix Γ and the 35-entry vector μ^P for each platform; none of these are tabulated, linked, or deposited. Table 3's scores and ± ranges therefore cannot be checked against the method. The Monte Carlo analysis in the same section and in Appendix A perturbs the same hidden values by ±25% and so tests sensitivity to those priors, not their correctness. Since the abstract's 'validated through Monte Carlo analysis' and the paper's quantitative benchmarking claims rest entirely on these numbers, this is a load-bearing gap.
  2. [Table 1 and §1] The evidence basis for the 39 attack vectors is largely extrapolative. The table is headed 'Empirical attack vectors,' yet many rows are demonstrated on industrial arms, quadrupeds, vehicles, or voice assistants and transferred to humanoids by statements such as 'On humanoids, ... could ...' The Introduction itself notes that no major publicly documented cyberattacks have targeted humanoids. Step 1 derives λ_i from 'historical data ... and expert feasibility assessment.' Without a per-attack justification for why non-humanoid demonstrations support humanoid likelihood/impact values, the transferability premise silently enters Eq. (1) and propagates into every score. This should be made explicit or the affected rows reclassified as hypothetical and their weights adjusted.
  3. [§5.2, 'Methodological scope and results interpretation'] The abstract's claim that RISK-MAP 'supports cross-platform benchmarking' is contradicted by the paper's own caveat: comparing functionally dissimilar platforms requires normalization against a common capability baseline, 'a feature not currently implemented.' Because the three case-study robots differ substantially in capability, the reported ordering Digit > G1 EDU > Pepper may reflect differences in attack surface rather than security maturity. The claims in the abstract and Section 1 should be narrowed to 'diagnostic assessment for individual platforms' and the cross-platform ordering should be presented as illustrative only.
  4. [Appendix A, Eq. (2)–(5)] The cascade analysis is also non-reproducible. The coupling matrix D is built from S, E, and M matrices, and CRR depends on attack weights w_a and layer coverage C_r(l); none of these matrices or weights are reported. Consequently, the CRR values in Figure 4b and the 'Key Findings' (e.g., DP→DM→AP CRR≈0.113) cannot be recomputed, and the Monte Carlo bands in the appendix do not cover the missing S/E/M inputs. The 'structural corridors' claim is thus unsupported by published data.
minor comments (4)
  1. [Table 2, AP-D4] Reference placeholder '[?]' for 'Muratore et al.' appears in the defense description; the reference list does not contain this entry. Please replace with a full citation or remove.
  2. [Related Work (§2)] The sentence about CPS security frameworks cites [108], which is listed as 'Generating adversarial point clouds...' rather than a CPS security framework. This citation appears mismatched; please verify the intended source.
  3. [Appendix A and §5.1] Typography: 'Dii = 1 fbut' should read 'Dii = 1 but'; 'Second,We define' should read 'Second, we define'.
  4. [Figures 4a–4b] The charts include many fine-grained values without a machine-readable source. If the authors add data availability, consider including a compact appendix table or repository link so the layer scores and CRR numbers can be inspected.

Circularity Check

2 steps flagged · score 5.0 of 10

RISK-MAP scores are deterministic functions of undisclosed expert inputs; its Monte Carlo 'validation' only perturbs those same priors, and the seven-layer model is induced from and then 'confirmed' by the same attack/defense corpus.

  1. self definitional [§2.2, §3.1 (Threat Validation), §4.1 (mapping as confirmation)]
    "During our content analysis, threats that initially appeared unrelated; consistently aligned with the same architectural layers. ... Threat Validation: Verifying that the 39 distinct attack vectors identified in our analysis align with the identified functional boundaries. ... Using this model, we mapped 39 attacks and 35 defenses to specific architectural layers, as we have done in Tables 1 and 2. This mapping demonstrates that threat patterns consistently align with architectural function, confirming the model’s practical utility."

    The seven-layer model was induced from the same 39-attack/35-defense corpus it is later used to organize: §3.1 identifies the layers from the literature review and 'validates' them by checking that those same attack vectors align with the layers. §4.1 then presents that alignment as confirmation ('confirming the model’s practical utility'). This is a self-consistency loop: the model is defined from the corpus, mapped back onto the corpus, and the resulting fit is offered as evidence. It does not independently establish that the layers are the natural boundaries of humanoid architectures, nor does it validate cross-platform assessment utility.

  2. other [§5.1 'Addressing Methodological Uncertainties with Monte Carlo Simulation'; Summary]
    "We addressed this by running 1,000 Monte Carlo [6, 69] iterations of RISK-MAP with input values randomly sampled within (±25%) intervals, providing statistically robust measures of platform security despite underlying data uncertainty."

    The Monte Carlo step perturbs exactly the expert-assigned inputs that already determine the output: λ_i and ι_i (Eq. 1), γ_ij and μ_j (Step 3), and w_a in Appendix A. The final RISK-MAP score is a deterministic function of these values, so resampling them with ±25% noise only measures sensitivity to the authors' priors. It cannot validate that the scores reflect real security posture; the confidence intervals are generated from the same assumptions they are claimed to confirm. Calling this 'validated through Monte Carlo analysis' (Abstract) is a self-referential validation loop.

full rationale

The derivation chain for the quantitative scores is formally well-defined (Eq. 1 through the final weighted average), and the scores are not, in themselves, circular: they are explicit—though undisclosed—functions of the authors' chosen λ_i, ι_i, γ_ij, and μ_j. The circularity lies in the two validation moves. First, the seven-layer model is extracted from the same literature corpus that is later mapped onto it, and the alignment is presented as confirmation of the model's utility. Second, the Monte Carlo analysis perturbs the very same expert inputs that produce the scores, so it demonstrates robustness to the authors' priors rather than agreement with any independent measure of security. The paper also concedes that cross-platform benchmarking would require capability normalization 'not currently implemented,' weakening the abstract's benchmarking claim; that is a scope limitation, not a circular step. The withheld input values make the scores non-reproducible, but non-reproducibility is a correctness/evidence problem separate from circularity. No load-bearing self-citation chain was found; the authors' own prior works appear only as ordinary supporting references. Overall, the central quantitative claims are partially circular through their self-referential validation, but the taxonomy and scoring framework retain independent content as a structured assessment instrument.

Assumptions & free parameters 7 free parameters · 5 assumptions · 0 invented entities

The central quantitative claim depends on a large set of author-assigned parameters that are not published: attack likelihoods and impacts, the full defense coverage matrix, and per-platform implementation levels. The seven-layer model itself rests on the assumption that OSI-style layering and cross-platform transferability of attacks are valid for humanoids. The ledger is heavy because the paper's validation is internal: Monte Carlo noise is applied to the same subjective inputs, and the model is built from and verified against the same literature corpus.

free parameters (7)
  • Per-attack likelihood lambda_i = not published
    Assigned from CVE/threat intelligence/expert judgment (Section 5.1 Step 1); values not given, yet determine all scores.
  • Per-attack impact iota_i = not published
    Assigned on 0-1 severity scale; not published.
  • Defense coverage matrix Gamma (gamma_ij) = not published
    39x35 matrix of defense effectiveness, 'guided by empirical evidence' but actual entries absent.
  • Implementation vector mu_P = not published
    Per-platform defense implementation levels (0-1), based on datasheet inspection; not published for Digit, G1 EDU, Pepper.
  • Coupling weights alpha, beta = alpha=0.6, beta=0.4
    Chosen in Appendix A for cross-layer coupling matrix D; no sensitivity analysis reported for these.
  • Path thresholds epsilon, MIN_PROP = epsilon=0.3, MIN_PROP=0.1
    Chosen for cascade path enumeration; not justified.
  • Monte Carlo noise range = +/-25%
    Chosen for uncertainty analysis; no justification for the width.
assumptions (5)
  • domain assumption OSI layering is an appropriate foundation for humanoid security architecture
    Section 3.1 states OSI provides the closest conceptual alignment; this frames the entire seven-layer model.
  • domain assumption Attacks and defenses demonstrated on non-humanoid platforms transfer to humanoids
    Table 1 repeatedly extrapolates from industrial arms, quadrupeds, AVs, and drones with 'On humanoids... could...'.
  • ad hoc to paper Defenses combine independently (multiplicative coverage)
    Section 5.1 Step 4 assumes independence, kappa_P_i = 1 - product(...). No empirical support for independence.
  • domain assumption The literature-derived seven functional layers reflect real architectural boundaries
    Section 2.2/3.1 asserts clustering reflects architectural boundaries, not researcher focus.
  • ad hoc to paper +/-25% uniform noise in MC captures parameter uncertainty
    Section 5.1 MC. The range is chosen without justification and only covers the published scales, not structural uncertainty.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SoK: Cybersecurity Assessment of Humanoid Ecosystem." pith.science (2026). https://pith.science/paper/RCIEU7QR

@misc{pith2026250817481,
  author       = {Pith},
  title        = {Pith review of: SoK: Cybersecurity Assessment of Humanoid Ecosystem},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RCIEU7QR}},
  note         = {Machine review of arXiv:2508.17481}
}
read the original abstract

Humanoids are progressing toward practical deployment across healthcare, industrial, defense, and service sectors. While typically considered cyber-physical systems (CPSs), their dependence on traditional networked software stacks (e.g., Linux operating systems), robot operating system (ROS) middleware, and over-the-air update channels, creates a distinct security profile that exposes them to vulnerabilities conventional CPS models do not fully address. Prior studies have mainly examined specific threats, such as LiDAR spoofing or adversarial machine learning (AML). This narrow focus overlooks how an attack targeting one component can cascade harm throughout the robot's interconnected systems. We address this gap through a systematization of knowledge (SoK) that takes a comprehensive approach, consolidating fragmented research from robotics, CPS, and network security domains. We introduce a seven-layer security model for humanoid robots, organizing 39 known attacks and 35 defenses across the humanoid ecosystem-from hardware to human-robot interaction. Building on this security model, we develop a quantitative 39x35 attack-defense matrix with risk-weighted scoring, validated through Monte Carlo analysis. We demonstrate our method by evaluating three real-world robots: Pepper, G1 EDU, and Digit. The scoring analysis revealed varying security maturity levels, with scores ranging from 39.9% to 79.5% across the platforms. This work introduces a structured, evidence-based assessment method that enables systematic security evaluation, supports cross-platform benchmarking, and guides prioritization of security investments in humanoid robotics.

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. CEDAR-42001: From ISO/IEC 42001 Conformity to Architecture-Aware, Audit-Visible Assurance Posture for AI Cyber-Physical Systems

    cs.CY 2026-06 unverdicted novelty 6.0 of 10

    CEDAR-42001 enriches ISO 42001 conformity audits for AI-CPS with architecture layer attribution, five-dimensional maturity profiles, risk-proportionate targets, and rulebook-derived actions, shown via synthetic fleet ...

Reference graph

Works this paper leans on

123 extracted references · 1 canonical work pages · cited by 1 Pith paper

  1. [1]

    Managing end-to-end timing jitters in ros2 computation chains

    Hazem Abaza, Debayan Roy, Bohdan Trach, Wanli Chang, Selma Saidi, Antonios Motakis, Wei Ren, and Yutao Liu. Managing end-to-end timing jitters in ros2 computation chains. In Proceedings of the 32nd In- ternational Conference on Real-Time Networks and Systems, pages 229–241, 2024

    2024

  2. [2]

    Hard- log: Practical tamper-proof system auditing using a novel audit device

    Adil Ahmad, Sangho Lee, and Marcus Peinado. Hard- log: Practical tamper-proof system auditing using a novel audit device. In 2022 IEEE Symposium on Secu- rity and Privacy (SP), pages 1791–1807. IEEE, 2022

    2022

  3. [3]

    Detecting data injection attacks in ros systems using machine learning

    Rodrigo Abrantes Antunes, Bruno L Dalmazo, and Paulo LJ Drews. Detecting data injection attacks in ros systems using machine learning. In 2022 Latin American Robotics Symposium (LARS), 2022 Brazilian Symposium on Robotics (SBR), and 2022 Workshop on Robotics in Education (WRE), pages 1–6. IEEE, 2022

    2022

  4. [4]

    Alexander Mois Aroyo, Francesco Rea, Giulio Sandini, and Alessandra Sciutti. Trust and social engineering in human robot interaction: Will a robot make you disclose sensitive information, conform to its recom- mendations or gamble? IEEE Robotics and Automation Letters, 3(4):3701–3708, 2018

    2018

  5. [5]

    How to backdoor federated learning

    Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deb- orah Estrin, and Vitaly Shmatikov. How to backdoor federated learning. In International conference on ar- tificial intelligence and statistics , pages 2938–2948. PMLR, 2020

    2020

  6. [6]

    A weighted monte carlo simulation approach to risk assessment of information security management system

    Seyed Mojtaba Hosseini Bamakan and Mohammad Dehghanimohammadabadi. A weighted monte carlo simulation approach to risk assessment of information security management system. International Journal of Enterprise Information Systems (IJEIS), 11(4):63–78, 2015

    2015

  7. [7]

    dr0wned– {Cyber- Physical} attack with additive manufacturing

    Sofia Belikovetsky, Mark Yampolskiy, Jinghui Toh, Jacob Gatlin, and Yuval Elovici. dr0wned– {Cyber- Physical} attack with additive manufacturing. In 11th USENIX workshop on offensive technologies (WOOT 17), 2017

    2017

  8. [8]

    Digital twin enabled runtime verification for autonomous mobile robots under un- certainty

    Joakim Schack Betzer, Jalil Boudjadar, Mirgita Frash- eri, and Prasad Talasila. Digital twin enabled runtime verification for autonomous mobile robots under un- certainty. In 2024 28th International Symposium on Distributed Simulation and Real Time Applications (DS-RT), pages 10–17. IEEE, 2024

    2024

Show all 123 references
  1. [9]

    State estimation for legged robots-consistent fusion of leg kinematics and imu

    Michael Bloesch, Marco Hutter, Mark A Hoepflinger, Stefan Leutenegger, Christian Gehring, C David Remy, and Roland Siegwart. State estimation for legged robots-consistent fusion of leg kinematics and imu. Robotics, 17:17–24, 2013

    2013

  2. [10]

    Cyber security of robots: A comprehen- sive survey

    Alessio Botta, Sayna Rotbei, Stefania Zinno, and Gior- gio Ventre. Cyber security of robots: A comprehen- sive survey. Intelligent Systems with Applications , 18:200237, 2023

    2023

  3. [11]

    Targeted attack on deep rl-based au- tonomous driving with learned visual patterns

    Prasanth Buddareddygari, Travis Zhang, Yezhou Yang, and Yi Ren. Targeted attack on deep rl-based au- tonomous driving with learned visual patterns. In 2022 International Conference on Robotics and Automation (ICRA), pages 10571–10577. IEEE, 2022

    2022

  4. [12]

    Cybersecurity issues in robotic platforms

    Adrián Campazas-Vega, Alberto Miguel-Diez, Mario Hermida-López, Claudia Álvarez-Aparicio, Igna- cio Samuel Crespo-Martínez, and Ángel Manuel Guerrero-Higueras. Cybersecurity issues in robotic platforms. In Proceedings of the 14th International Conference on Business Informatio...

    2023

  5. [13]

    An artic- ulated assistive robot for intuitive hands-on-payload manipulation

    Alexandre Campeau-Lecours, Pierre-Luc Belzile, Thierry Laliberté, Simon Foucault, Boris Mayer-St- Onge, Dalong Gao, and Clément Gosselin. An artic- ulated assistive robot for intuitive hands-on-payload manipulation. Robotics and Computer-Integrated Man- ufacturing, 48:182–187, 2017

    2017

  6. [14]

    You can’t see me: Physical removal attacks on {lidar-based} autonomous vehicles driving frame- works

    Yulong Cao, S Hrushikesh Bhupathiraju, Pirouz Naghavi, Takeshi Sugawara, Z Morley Mao, and Sara Rampazzi. You can’t see me: Physical removal attacks on {lidar-based} autonomous vehicles driving frame- works. In 32nd USENIX security symposium (USENIX Security 23), pages 2993–3010, 2023

    2023

  7. [15]

    Adversary is on the road: Attacks on visual {SLAM} using unnoticeable adversarial patch

    Baodong Chen, Wei Wang, Pascal Sikorski, and Ting Zhu. Adversary is on the road: Attacks on visual {SLAM} using unnoticeable adversarial patch. In 33rd USENIX Security Symposium (USENIX Security 24), pages 6345–6362, 2024

    2024

  8. [16]

    Analyzing impact and systemwide effects of the slowros attack in an industrial automation sce- nario

    Ivan Cibrario Bertolotti, Luca Durante, and Enrico Cambiaso. Analyzing impact and systemwide effects of the slowros attack in an industrial automation sce- nario. Future Internet, 17(4):167, 2025

    2025

  9. [17]

    Formalizing the execution context of behavior trees for runtime verification of deliberative policies

    Michele Colledanchise, Giuseppe Cicala, Daniele E Domenichelli, Lorenzo Natale, and Armando Tac- chella. Formalizing the execution context of behavior trees for runtime verification of deliberative policies. In 2021 IEEE/RSJ International Conference on Intel- ligent Robots and...

    2021

  10. [18]

    Scan- ning the internet for ros: A view of security in 14 robotics research

    Nicholas DeMarinis, Stefanie Tellex, Vasileios P Ke- merlis, George Konidaris, and Rodrigo Fonseca. Scan- ning the internet for ros: A view of security in 14 robotics research. In 2019 International Conference on Robotics and Automation (ICRA), pages 8514–8521. IEEE, 2019

    2019

  11. [19]

    On the (in) security of secure ros2

    Gelei Deng, Guowen Xu, Yuan Zhou, Tianwei Zhang, and Yang Liu. On the (in) security of secure ros2. In Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 739– 753, 2022

    2022

  12. [20]

    A spotlight on security and privacy risks with future household robots: attacks and lessons

    Tamara Denning, Cynthia Matuszek, Karl Koscher, Joshua R Smith, and Tadayoshi Kohno. A spotlight on security and privacy risks with future household robots: attacks and lessons. In Proceedings of the 11th inter- national conference on Ubiquitous computing, pages 105–114, 2009

    2009

  13. [21]

    Credential masquerading and openssl spy: Exploring ros 2 using dds security

    Vincenzo DiLuoffo, William R Michalson, and Berk Sunar. Credential masquerading and openssl spy: Exploring ros 2 using dds security. arXiv preprint arXiv:1904.09179, 2019

    1904 arXiv

  14. [22]

    Robotics cyber security issues

    Hadi Dastan Elikhchi, Thaier Hamid, and Maria Akpo- duado. Robotics cyber security issues. In Interna- tional Conference on Advances in Communication Technology and Computer Engineering , pages 217–

  15. [23]

    Peerguard: Defending multi- agent systems against backdoor attacks through mutual reasoning

    Falong Fan and Xi Li. Peerguard: Defending multi- agent systems against backdoor attacks through mutual reasoning. arXiv preprint arXiv:2505.11642, 2025

    2025 arXiv

  16. [24]

    Roborebound: Multi-robot sys- tem defense with bounded-time interaction

    Neeraj Gandhi, Yifan Cai, Andreas Haeberlen, and Linh Thi Xuan Phan. Roborebound: Multi-robot sys- tem defense with bounded-time interaction. In Pro- ceedings of the Twentieth European Conference on Computer Systems, EuroSys ’25, page 176–192, New York, NY , USA, 2025. Associa...

    2025

  17. [25]

    Adding salt to pepper: A structured security as- sessment over a humanoid robot

    Alberto Giaretta, Michele De Donno, and Nicola Drag- oni. Adding salt to pepper: A structured security as- sessment over a humanoid robot. In Proceedings of the 13th International Conference on Availability, Re- liability and Security, pages 1–8, 2018

    2018

  18. [26]

    The week of universal robots’ bugs

    Endika Gil-Uriarte, Víctor Mayoral Vilches, Oxel Urze- lai, Nuria García, Unai Ayucar, and Juan M. The week of universal robots’ bugs. https://news.aliasrobo tics.com/week-of-universal-robots-bugs-e xposing-insecurity/, March 2020. Alias Robotics News. Accessed: 30-Aug-2025

    2020

  19. [27]

    On ladder logic bombs in industrial control systems

    Naman Govil, Anand Agrawal, and Nils Ole Tippen- hauer. On ladder logic bombs in industrial control systems. In International Workshop on the Security of Industrial Control Systems and Cyber-Physical Sys- tems, pages 110–126. Springer, 2017

    2017

  20. [28]

    Humanoid locomotion and manipulation: Cur- rent progress and challenges in control, planning, and learning

    Zhaoyuan Gu, Junheng Li, Wenlan Shen, Wenhao Yu, Zhaoming Xie, Stephen McCrory, Xianyi Cheng, Abdulaziz Shamsah, Robert Griffin, C Karen Liu, et al. Humanoid locomotion and manipulation: Cur- rent progress and challenges in control, planning, and learning. arXiv preprint arXiv...

    2025 arXiv

  21. [29]

    Cybersecurity of robotics and autonomous systems: Privacy and safety

    Ángel Manuel Guerrero. Cybersecurity of robotics and autonomous systems: Privacy and safety. Robotics: le- gal, ethical and socioeconomic impacts, page 75, 2017

    2017

  22. [30]

    Lifelike agility and play in quadrupedal robots using reinforcement learning and generative pre-trained models

    Lei Han, Qingxu Zhu, Jiapeng Sheng, Chong Zhang, Tingguang Li, Yizheng Zhang, He Zhang, Yuzhen Liu, Cheng Zhou, Rui Zhao, et al. Lifelike agility and play in quadrupedal robots using reinforcement learning and generative pre-trained models. Nature Machine Intelligence, 6(7):78...

    2024

  23. [31]

    Shadow-catcher: Looking into shadows to detect ghost objects in autonomous ve- hicle 3d sensing

    Zhongyuan Hau, Soteris Demetriou, Luis Muñoz- González, and Emil C Lupu. Shadow-catcher: Looking into shadows to detect ghost objects in autonomous ve- hicle 3d sensing. In European Symposium on Research in Computer Security, pages 691–711. Springer, 2021

    2021

  24. [32]

    Canceling inaudible voice commands against voice control sys- tems

    Yitao He, Junyu Bian, Xinyu Tong, Zihui Qian, Wei Zhu, Xiaohua Tian, and Xinbing Wang. Canceling inaudible voice commands against voice control sys- tems. In The 25th Annual International Conference on Mobile Computing and Networking, pages 1–15, 2019

    2019

  25. [33]

    X-detect: Explainable adversarial patch detec- tion for object detectors in retail

    Omer Hofman, Amit Giloni, Yarin Hayun, Ikuya Morikawa, Toshiya Shimizu, Yuval Elovici, and Asaf Shabtai. X-detect: Explainable adversarial patch detec- tion for object detectors in retail. Machine Learning, 113(9):6273–6292, 2024

    2024

  26. [34]

    olle, Luis Scheuch, and Patrick G¨

    Team HULKs, Maximilian Schmidt, Hendrik Sieck, Ole Felber, Konrad Valentin N¨"olle, Luis Scheuch, and Patrick G¨"ottsch. Advancing humanoid robotics with rust: An open framework for runtime efficiency. In Robot World Cup, pages 396–408. Springer, 2024

    2024

  27. [35]

    Understand- ing and overcoming the challenges of building high voltage automotive battery management systems

    Mahmoud Ismail, Patrick Leteinturier, Felix Weidner, Markus Ekler, Klaus Scheibert, Noopuran Sivaguru, Jutta Heinzelmann, and Kishore Sukumar. Understand- ing and overcoming the challenges of building high voltage automotive battery management systems. Infi- neon, 2022

    2022

  28. [36]

    Un-rocking drones: Foundations of acoustic injection attacks and recovery thereof

    Jinseob Jeong, Dongkwan Kim, Joon-Ha Jang, Juhwan Noh, Changhun Song, and Yongdae Kim. Un-rocking drones: Foundations of acoustic injection attacks and recovery thereof. In NDSS, 2023

    2023

  29. [37]

    A study on ros vulnerabilities and counter- measure

    Se-Yeon Jeong, I-Ju Choi, Yeong-Jin Kim, Yong-Min Shin, Jeong-Hun Han, Goo-Hong Jung, and Kyoung- Gon Kim. A study on ros vulnerabilities and counter- measure. In Proceedings of the companion of the 2017 15 ACM/IEEE international conference on human-robot interaction, pages 14...

    2017

  30. [38]

    Motion planning and control with environment uncertainties for hu- manoid robot

    Zhiyong Jiang, Jiawei Zhang, Yu Wang, Liyan Chen, Jiangcheng Chen, and Siyu Wang. Motion planning and control with environment uncertainties for hu- manoid robot. In 2024 IEEE 14th International Con- ference on CYBER Technology in Automation, Control, and Intelligent Systems (...

    2024

  31. [39]

    Page—practical aes-gcm encryption for low-end microcontrollers

    Kyungho Kim, Seungju Choi, Hyeokdong Kwon, Hyunjun Kim, Zhe Liu, and Hwajeong Seo. Page—practical aes-gcm encryption for low-end microcontrollers. Applied Sciences, 10(9):3131, 2020

    2020

  32. [40]

    Cybersecurity vulnera- bilities in two artificially intelligent humanoids on the market

    Matt Kinzler, Justin Miller, Zhou Wu, Andrew Williams, and Debbie Perouli. Cybersecurity vulnera- bilities in two artificially intelligent humanoids on the market. In Workshop on Technology and Consumer Protection (ConPro ‘19), held in conjunction with the 40th IEEE Symposium ...

    2019

  33. [41]

    Specification gam- ing: the flip side of ai ingenuity

    Victoria Krakovna, Jonathan Uesato, Vladimir Miku- lik, Matthew Rahtz, Tom Everitt, Ramana Kumar, Zac Kenton, Jan Leike, and Shane Legg. Specification gam- ing: the flip side of ai ingenuity. DeepMind Blog, 3, 2020

    2020

  34. [42]

    Do-ra: data-oriented runtime attestation for iot devices

    Boyu Kuang, Anmin Fu, Lu Zhou, Willy Susilo, and Yuqing Zhang. Do-ra: data-oriented runtime attestation for iot devices. Computers & Security , 97:101945, 2020

    2020

  35. [43]

    Ghost talk: Mitigating emi signal injection attacks against analog sensors

    Denis Foo Kune, John Backes, Shane S Clark, Daniel Kramer, Matthew Reynolds, Kevin Fu, Yongdae Kim, and Wenyuan Xu. Ghost talk: Mitigating emi signal injection attacks against analog sensors. In 2013 IEEE symposium on security and privacy , pages 145–159. IEEE, 2013

    2013

  36. [44]

    Data distribution and redistribution-a formal and practical analysis of the dds security standard

    Timm Lauser, Maximilian M ¨"uller, Ingmar Baum- gart, and Christoph Krauß. Data distribution and redistribution-a formal and practical analysis of the dds security standard. In Proceedings of the 40th ACM/SIGAPP Symposium on Applied Computing , pages 1839–1848, 2025

    2025

  37. [45]

    An empirical study of perfor- mance interference: Timing violation patterns and im- pacts

    Ao Li, Jinwen Wang, Sanjoy Baruah, Bruno Sinop- oli, and Ning Zhang. An empirical study of perfor- mance interference: Timing violation patterns and im- pacts. In Proceedings of the 30th IEEE Real-Time and Embedded Technology and Applications Symposium (RTAS’24). IEEE Computer...

    2024

  38. [46]

    Phantom in the opera: adversarial music attack for robot dialogue sys- tem

    Sheng Li, Jiyi Li, and Yang Cao. Phantom in the opera: adversarial music attack for robot dialogue sys- tem. Frontiers in Computer Science, 6:1355975, 2024

    2024

  39. [47]

    Understanding and defending patched-based adversar- ial attacks for vision transformer

    Liang Liu, Yanan Guo, Youtao Zhang, and Jun Yang. Understanding and defending patched-based adversar- ial attacks for vision transformer. 2023

    2023

  40. [48]

    Ro- bust imitation learning from corrupted demonstrations

    Liu Liu, Ziyang Tang, Lanqing Li, and Dijun Luo. Ro- bust imitation learning from corrupted demonstrations. arXiv preprint arXiv:2201.12594, 2022

    2022 arXiv

  41. [49]

    {MicGuard}: A comprehensive detec- tion system against out-of-band injection attacks for different level microphone-based devices

    Tiantian Liu, Feng Lin, Zhongjie Ba, Li Lu, Zhan Qin, and Kui Ren. {MicGuard}: A comprehensive detec- tion system against out-of-band injection attacks for different level microphone-based devices. In 33rd USENIX Security Symposium (USENIX Security 24), pages 3963–3978, 2024

    2024

  42. [50]

    Aurora guard: Real-time face anti-spoofing via light reflection

    Yao Liu, Ying Tai, Jilin Li, Shouhong Ding, Chengjie Wang, Feiyue Huang, Dongyang Li, Wenshuai Qi, and Rongrong Ji. Aurora guard: Real-time face anti-spoofing via light reflection. arXiv preprint arXiv:1902.10311, 2019

    1902 arXiv

  43. [51]

    Certified adversarial robustness for deep reinforcement learning

    Bj¨"orn L¨"utjens, Michael Everett, and Jonathan P How. Certified adversarial robustness for deep reinforcement learning. In conference on Robot Learning , pages 1328–1337. PMLR, 2020

    2020

  44. [52]

    Rogue robots: Testing the limits of an in- dustrial robot’s security

    Federico Maggi, Davide Quarta, Marcello Pogliani, Mario Polino, Andrea M Zanchettin, and Stefano Zanero. Rogue robots: Testing the limits of an in- dustrial robot’s security. Trend Micro, Politecnico di Milano, Tech. Rep, pages 1–21, 2017

    2017

  45. [53]

    Intelligent humanoids in manufacturing to address worker shortage and skill gaps: Case of tesla optimus

    Ali Ahmad Malik, Tariq Masood, and Alexander Brem. Intelligent humanoids in manufacturing to address worker shortage and skill gaps: Case of tesla optimus. arXiv preprint arXiv:2304.04949, 2023

    2023 arXiv

  46. [54]

    Towards a robotic intrusion prevention system: Com- bining security and safety in cognitive social robots

    Francisco Martín, Enrique Soriano-Salvador, José Miguel Guerrero, Gorka Guardiola Muzquiz, Juan Carlos Manzanares, and Francisco J Rodríguez. Towards a robotic intrusion prevention system: Com- bining security and safety in cognitive social robots. Robotics and Autonomous Syst...

    2025

  47. [55]

    Com- posite 3d-printed metastructures for low-frequency and broadband vibration absorption

    Kathryn H Matlack, Anton Bauhofer, Sebastian Kr¨"odel, Antonio Palermo, and Chiara Daraio. Com- posite 3d-printed metastructures for low-frequency and broadband vibration absorption. Proceedings of the National Academy of Sciences , 113(30):8386–8390, 2016

    2016

  48. [56]

    Devsecops in robotics

    Víctor Mayoral-Vilches, Nuria García-Maestro, McKenna Towers, and Endika Gil-Uriarte. Devsecops in robotics. arXiv preprint arXiv:2003.10402, 2020

    2003 arXiv

  49. [57]

    Can ros be used securely in industry? red teaming ros-industrial

    Víctor Mayoral-Vilches, Martin Pinzger, Stefan Rass, Bernhard Dieber, and Endika Gil-Uriarte. Can ros be used securely in industry? red teaming ros-industrial. arXiv preprint arXiv:2009.08211, 2020. 16

    2009 arXiv

  50. [58]

    Tros: Pro- tecting humanoids ros from privileged attackers

    Giovanni Mazzeo and Mariacarla Staffa. Tros: Pro- tecting humanoids ros from privileged attackers. In- ternational Journal of Social Robotics, 12(3):827–841, 2020

    2020

  51. [59]

    Social engineering and human-robot interactions’ risks

    Ilenia Mercuri. Social engineering and human-robot interactions’ risks. Human Factors in Cybersecurity, 53(53), 2022

    2022

  52. [60]

    Privacy-preserving face recogni- tion using trainable feature subtraction

    Yuxi Mi, Zhizhou Zhong, Yuge Huang, Jiazhen Ji, Jian- qing Xu, Jun Wang, Shaoming Wang, Shouhong Ding, and Shuigeng Zhou. Privacy-preserving face recogni- tion using trainable feature subtraction. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogni...

    2024

  53. [61]

    Cve-2018-5268: Heap- based buffer overflow in opencv 3.3.1

    MITRE Corporation. Cve-2018-5268: Heap- based buffer overflow in opencv 3.3.1. Na- tional Vulnerability Database, 2018. In OpenCV 3.3.1, a heap-based buffer overflow happens in cv::Jpeg2KDecoder::readComponent8u in mod- ules/imgcodecs/src/grfmt_jpeg2000.cpp when parsing a craf...

    2018

  54. [62]

    Humanoid robots: Cybersecurity concerns and firewall implementation

    Safa Munir, Kashaf Khan, Naeem Aslam, Kamran Abid, et al. Humanoid robots: Cybersecurity concerns and firewall implementation. VFAST Transactions on Software Engineering, 11(1):85–100, 2023

    2023

  55. [63]

    Cy- bersecurity best practices for the safety of modern vehi- cles

    National Highway Traffic Safety Administration. Cy- bersecurity best practices for the safety of modern vehi- cles. Pre-final report, National Highway Traffic Safety Administration, Washington, DC, September 2022. Re- lease 2022, Pre-Final

    2022

  56. [64]

    Don’t cross me! cross-layer sys- tem security

    Najmeh Nazari, Chongzhou Fang, Sai Manoj PD, and Houman Homayoun. Don’t cross me! cross-layer sys- tem security. In 2023 60th ACM/IEEE Design Automa- tion Conference (DAC), pages 1–2. IEEE, 2023

    2023

  57. [65]

    Bootloader Secure Boot

    NVIDIA Corporation. Bootloader Secure Boot . NVIDIA Corporation, 2022. NVIDIA Jetson Linux version 34.1.1 Developer Guide documentation for se- cure boot implementation

    2022

  58. [66]

    Secure Boot

    NVIDIA Corporation. Secure Boot. NVIDIA Corpora- tion, 2024. Documentation for Jetson Orin NX, Nano, AGX Orin, Xavier NX, and AGX Xavier series secure boot implementation

    2024

  59. [67]

    A systematic review on social robots in public spaces: threat landscape and attack surface.Computers, 11(12):181, 2022

    Samson O Oruma, Mary Sánchez-Gordón, Ricardo Colomo-Palacios, Vasileios Gkioulos, and Joakim K Hansen. A systematic review on social robots in public spaces: threat landscape and attack surface.Computers, 11(12):181, 2022

    2022

  60. [68]

    Logging to the danger zone: Race condi- tion attacks and defenses on system audit frameworks

    Riccardo Paccagnella, Kevin Liao, Dave Tian, and Adam Bates. Logging to the danger zone: Race condi- tion attacks and defenses on system audit frameworks. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security , pages 1551–1574, 2020

    2020

  61. [69]

    A theory to estimate, bound, and manage systemic cyber- risk

    Ranjan Pal, Konnie Duan, and Rohan Sequeira. A theory to estimate, bound, and manage systemic cyber- risk. In 39th ACM SIGSIM Conference on Principles of Advanced Discrete Simulation, pages 70–80, 2025

    2025

  62. [70]

    Active protection against pcb physical tampering

    Steven Paley, Tamzidul Hoque, and Swarup Bhunia. Active protection against pcb physical tampering. In 2016 17th International Symposium on Quality Elec- tronic Design (ISQED), pages 356–361. IEEE, 2016

    2016

  63. [71]

    Characterizing attacks on deep reinforcement learning

    Xinlei Pan, Chaowei Xiao, Warren He, Shuang Yang, Jian Peng, Mingjie Sun, Jinfeng Yi, Zijiang Yang, Mingyan Liu, Bo Li, et al. Characterizing attacks on deep reinforcement learning. arXiv preprint arXiv:1907.09470, 2019

    1907 arXiv

  64. [72]

    Decentralized information- flow control for ros2

    Nishit V Pandya, Himanshu Kumar, Gokulnath M Pil- lai, and Vinod Ganapathy. Decentralized information- flow control for ros2. InProceedings of the 31st Annual Network and Distributed System Security Symposium (NDSS’24), 2024

    2024

  65. [73]

    An- alyzing security vulnerability and forensic investiga- tion of ros2: a case study

    Yash Patel, Parag H Rughani, and Dhruvil Desai. An- alyzing security vulnerability and forensic investiga- tion of ros2: a case study. In Proceedings of the 8th International Conference on Robotics and Artificial Intelligence, pages 6–12, 2022

    2022

  66. [74]

    Potential cy- berattacks on automated vehicles

    Jonathan Petit and Steven E Shladover. Potential cy- berattacks on automated vehicles. IEEE Transactions on Intelligent transportation systems, 16(2):546–556, 2014

    2014

  67. [75]

    Robust adversarial reinforcement learning

    Lerrel Pinto, James Davidson, Rahul Sukthankar, and Abhinav Gupta. Robust adversarial reinforcement learning. In International conference on machine learn- ing, pages 2817–2826. PMLR, 2017

    2017

  68. [76]

    Secure and lightweight over-the-air software update distribution for connected vehicles

    Christian Plappert and Andreas Fuchs. Secure and lightweight over-the-air software update distribution for connected vehicles. In Proceedings of the 39th Annual Computer Security Applications Conference, pages 268–282, 2023

    2023

  69. [77]

    Se- curity of controlled manufacturing systems in the con- nected factory: the case of industrial robots

    Marcello Pogliani, Davide Quarta, Mario Polino, Mar- tino Vittone, Federico Maggi, and Stefano Zanero. Se- curity of controlled manufacturing systems in the con- nected factory: the case of industrial robots. Jour- nal of Computer Virology and Hacking Techniques , 15(3):161–17...

    2019

  70. [78]

    The role of security in human-robot shared environments: A case study in ros-based surveillance robots

    David Portugal, Samuel Pereira, and Micael S Cou- ceiro. The role of security in human-robot shared environments: A case study in ros-based surveillance robots. In 2017 26th IEEE International Symposium on Robot and Human Interactive Communication (RO- MAN), pages 981–986. IEEE, 2017

    2017

  71. [79]

    Cyber security risks in robotics

    Ishaani Priyadarshini. Cyber security risks in robotics. In Detecting and mitigating robotic cyber security risks, pages 333–348. IGI Global Scientific Publishing, 2017

    2017

  72. [80]

    Real- time operating system timing jitter and its impact on motor control

    Frederick M Proctor and William P Shackleford. Real- time operating system timing jitter and its impact on motor control. In Sensors and Controls for Intelligent Manufacturing II, volume 4563, pages 10–16. SPIE, 2001

    2001

  73. [81]

    An experimental security analysis of an in- dustrial robot controller

    Davide Quarta, Marcello Pogliani, Mario Polino, Fed- erico Maggi, Andrea Maria Zanchettin, and Stefano Zanero. An experimental security analysis of an in- dustrial robot controller. In 2017 IEEE Symposium on Security and Privacy (SP), pages 268–286. IEEE, 2017

    2017

  74. [82]

    Ros-defender: Sdn- based security policy enforcement for robotic applica- tions

    Sean Rivera, Sofiane Lagraa, Cristina Nita-Rotaru, Sheila Becker, and Radu State. Ros-defender: Sdn- based security policy enforcement for robotic applica- tions. In 2019 IEEE Security and Privacy Workshops (SPW), pages 114–119. IEEE, 2019

    2019

  75. [83]

    Spying with your robot vacuum cleaner: eavesdropping via lidar sensors

    Sriram Sami, Yimin Dai, Sean Rui Xiang Tan, Niru- pam Roy, and Jun Han. Spying with your robot vacuum cleaner: eavesdropping via lidar sensors. In Proceed- ings of the 18th Conference on Embedded Networked Sensor Systems, pages 354–367, 2020

    2020

  76. [84]

    Persuasive robots should avoid authority: The effects of formal and real authority on persuasion in human-robot inter- action

    Shane P Saunderson and Goldie Nejat. Persuasive robots should avoid authority: The effects of formal and real authority on persuasion in human-robot inter- action. Science robotics, 6(58):eabd5186, 2021

    2021

  77. [85]

    Fin- gerprinting robot movements via acoustic side channel

    Ryan Shah, Mujeeb Ahmed, and Shishir Nagaraja. Fin- gerprinting robot movements via acoustic side channel. arXiv preprint arXiv:2209.10240, 2022

    2022 arXiv

  78. [86]

    Drift with devil: Security of{Multi-Sensor} fusion based localization in {High-Level} autonomous driving under {GPS} spoofing

    Junjie Shen, Jun Yeon Won, Zeyuan Chen, and Qi Al- fred Chen. Drift with devil: Security of{Multi-Sensor} fusion based localization in {High-Level} autonomous driving under {GPS} spoofing. In 29th USENIX secu- rity symposium (USENIX Security 20), pages 931–948, 2020

    2020

  79. [87]

    Rethinking robust- ness assessment: Adversarial attacks on learning-based quadrupedal locomotion controllers

    Fan Shi, Chong Zhang, Takahiro Miki, Joonho Lee, Marco Hutter, and Stelian Coros. Rethinking robust- ness assessment: Adversarial attacks on learning-based quadrupedal locomotion controllers. arXiv preprint arXiv:2405.12424, 2024

    2024 arXiv

  80. [88]

    Ro- bust multiple-path orienteering problem: Securing against adversarial attacks

    Guangyao Shi, Lifeng Zhou, and Pratap Tokekar. Ro- bust multiple-path orienteering problem: Securing against adversarial attacks. IEEE Transactions on Robotics, 39(3):2060–2077, 2023

  81. [89]

    Illusion and dazzle: Adversarial optical chan- nel exploits against lidars for automotive applications

    Hocheol Shin, Dohyun Kim, Yujin Kwon, and Yong- dae Kim. Illusion and dazzle: Adversarial optical chan- nel exploits against lidars for automotive applications. In International conference on cryptographic hard- ware and embedded systems, pages 445–467. Springer, 2017

    2017

  82. [90]

    Pycra: Physical challenge- response authentication for active sensors under spoof- ing attacks

    Yasser Shoukry, Paul Martin, Yair Yona, Suhas Dig- gavi, and Mani Srivastava. Pycra: Physical challenge- response authentication for active sensors under spoof- ing attacks. In Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Secu- rity, pages 1004–...

    2015

  83. [91]

    Secure boot for reconfigurable architectures

    Ali Shuja Siddiqui, Yutian Gui, and Fareena Saqib. Secure boot for reconfigurable architectures. Cryptog- raphy, 4(4):26, 2020

    2020

  84. [92]

    Rocking drones with intentional sound noise on gyroscopic sensors

    Yunmok Son, Hocheol Shin, Dongkwan Kim, Youngseok Park, Juhwan Noh, Kibum Choi, Jungwoo Choi, and Yongdae Kim. Rocking drones with intentional sound noise on gyroscopic sensors. In 24th USENIX security symposium (USENIX Security 15) , pages 881–896, 2015

    2015

  85. [93]

    Physical adversarial examples for object detectors

    Dawn Song, Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Florian Tramer, Atul Prakash, and Tadayoshi Kohno. Physical adversarial examples for object detectors. In 12th USENIX work- shop on offensive technologies (WOOT 18), 2018

    2018

  86. [94]

    Implementing a robot intrusion prevention system (rips) for ros 2

    Enrique Soriano-Salvador, Francisco MartÃn-Rico, and Gorka Guardiola Múzquiz. Implementing a robot intrusion prevention system (rips) for ros 2. arXiv preprint arXiv:2412.19272, 2024

    2024 arXiv

  87. [95]

    Hardening ros via hardware-assisted trusted execution environment

    Mariacarla Staffa, Giovanni Mazzeo, and Luigi Sgaglione. Hardening ros via hardware-assisted trusted execution environment. In 2018 27th IEEE interna- tional symposium on robot and human interactive com- munication (RO-MAN), pages 491–494. IEEE, 2018

    2018

  88. [96]

    Light commands:{Laser-Based} audio injection attacks on {V oice-Controllable} systems

    Takeshi Sugawara, Benjamin Cyr, Sara Ram- pazzi, Daniel Genkin, and Kevin Fu. Light commands:{Laser-Based} audio injection attacks on {V oice-Controllable} systems. In 29th USENIX Security Symposium (USENIX Security 20) , pages 2631–2648, 2020

    2020

  89. [97]

    The future of artificial intelligence- driven robotics: Applications and implications

    Tole Sutikno. The future of artificial intelligence- driven robotics: Applications and implications. IAES Int. J. Robot. Autom, 13:361–372, 2024. 18

    2024

  90. [98]

    The digital twin syn- chronization problem: Framework, formulations, and analysis

    Barı¸ s Tan and Andrea Matta. The digital twin syn- chronization problem: Framework, formulations, and analysis. IISE Transactions, 56(6):652–665, 2024

    2024

  91. [99]

    Sim-to-real: Learning agile locomotion for quadruped robots

    Jie Tan, Tingnan Zhang, Erwin Coumans, Atil Iscen, Yunfei Bai, Danijar Hafner, Steven Bohez, and Vincent Vanhoucke. Sim-to-real: Learning agile locomotion for quadruped robots. arXiv preprint arXiv:1804.10332, 2018

    2018 arXiv

  92. [100]

    Sequential integrity monitoring for kalman filter innovations-based detectors

    Cagatay Tanil, Samer Khanafseh, Mathieu Joerger, and Boris Pervan. Sequential integrity monitoring for kalman filter innovations-based detectors. In Proceed- ings of the 31st International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 20...

    2018

  93. [101]

    unzel, Georg von der Br ¨

    Harun Teper, Daniel Kuhse, Mario G ¨"unzel, Georg von der Br ¨"uggen, Falk Howar, and Jian-Jia Chen. Thread carefully: Preventing starvation in the ros 2 multithreaded executor. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Sys- tems, 43(11):3588–3599, 2024

    2024

  94. [102]

    Fooling automated surveillance cameras: adversarial patches to attack person detection

    Simen Thys, Wiebe Van Ranst, and Toon Goedemé. Fooling automated surveillance cameras: adversarial patches to attack person detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition workshops, pages 0–0, 2019

    2019

  95. [103]

    Walnut: Waging doubt on the integrity of mems accelerometers with acoustic injec- tion attacks

    Timothy Trippel, Ofir Weisse, Wenyuan Xu, Peter Hon- eyman, and Kevin Fu. Walnut: Waging doubt on the integrity of mems accelerometers with acoustic injec- tion attacks. In 2017 IEEE European symposium on security and privacy (EuroS&P), pages 3–18. IEEE, 2017

    2017

  96. [104]

    Adversarial attacks on optimization based planners

    Sai Vemprala and Ashish Kapoor. Adversarial attacks on optimization based planners. In 2021 IEEE Interna- tional Conference on Robotics and Automation (ICRA), pages 9943–9949. IEEE, 2021

    2021

  97. [105]

    A systematic review on cybersecurity of robotic systems: vulnerabilities trends, threats, attacks, challenges, and proposed frame- work

    Narinder Verma, Neerendra Kumar, Chaman Verma, Zoltán Illés, and Deep Singh. A systematic review on cybersecurity of robotic systems: vulnerabilities trends, threats, attacks, challenges, and proposed frame- work. International Journal of Information Security, 24(3):127, 2025

    2025

  98. [106]

    Hardware- based methods for electronic device protection against invasive and non-invasive attacks

    Marin Vidakovi ´c and Davor Vinko. Hardware- based methods for electronic device protection against invasive and non-invasive attacks. Electronics, 12(21):4507, 2023

    2023

  99. [107]

    Dds security+: Enhancing the data distribution service with tpm-based remote attestation

    Paul Georg Wagner, Pascal Birnstill, and J¨"urgen Bey- erer. Dds security+: Enhancing the data distribution service with tpm-based remote attestation. In Proceed- ings of the 19th International Conference on Availabil- ity, Reliability and Security, pages 1–11, 2024

    2024

  100. [108]

    Generating adversarial point clouds on multi-modal fusion based 3d object detection model

    Huiying Wang, Huixin Shen, Boyang Zhang, Yu Wen, and Dan Meng. Generating adversarial point clouds on multi-modal fusion based 3d object detection model. In International Conference on Information and Com- munications Security, pages 187–203. Springer, 2021

    2021

  101. [109]

    Pseu- dorandom modulation quantum secured lidar

    Qiang Wang, Yong Zhang, Yuannan Xu, Lili Hao, Zi- jing Zhang, Tianyuan Qiao, and Yuan Zhao. Pseu- dorandom modulation quantum secured lidar. Optik, 126(22):3344–3348, 2015

    2015

  102. [110]

    Trojanrobot: Physical- world backdoor attacks against vlm-based robotic ma- nipulation

    Xianlong Wang, Hewen Pan, Hangtao Zhang, Minghui Li, Shengshan Hu, Ziqi Zhou, Lulu Xue, Peijin Guo, Yichen Wang, Wei Wan, et al. Trojanrobot: Physical- world backdoor attacks against vlm-based robotic ma- nipulation. arXiv preprint arXiv:2411.11683, 2024

    2024

  103. [111]

    Security risks of social robots used to persuade and manipulate: A proof of concept study

    Pieter Wolfert, Jorre Deschuyteneer, Djamari Oetringer, Nicole Robinson, and Tony Belpaeme. Security risks of social robots used to persuade and manipulate: A proof of concept study. In Companion of the 2020 ACM/IEEE International Conference on Human-Robot Interaction, pages 5...

    2020

  104. [112]

    Depthfake: Spoofing 3d face authenti- cation with a 2d photo

    Zhihao Wu, Yushi Cheng, Jiahui Yang, Xiaoyu Ji, and Wenyuan Xu. Depthfake: Spoofing 3d face authenti- cation with a 2d photo. In 2023 IEEE symposium on security and privacy (SP), pages 917–933. IEEE, 2023

    2023

  105. [113]

    A dual-agent adversarial framework for robust generalization in deep reinforce- ment learning

    Zhengpeng Xie, Jiahang Cao, Yulong Zhang, Qiang Zhang, and Renjing Xu. A dual-agent adversarial framework for robust generalization in deep reinforce- ment learning. arXiv preprint arXiv:2501.17384, 2025

    2025

  106. [114]

    Novel denial-of-service attacks against cloud-based multi-robot systems

    Yuan Xu, Gelei Deng, Tianwei Zhang, Han Qiu, and Yungang Bao. Novel denial-of-service attacks against cloud-based multi-robot systems. Information Sci- ences, 576:329–344, 2021

    2021

  107. [115]

    Robotics cyber security: Vulnera- bilities, attacks, countermeasures, and recommenda- tions

    Jean-Paul A Yaacoub, Hassan N Noura, Ola Salman, and Ali Chehab. Robotics cyber security: Vulnera- bilities, attacks, countermeasures, and recommenda- tions. International Journal of Information Security, 21(1):115–158, 2022

    2022

  108. [116]

    Ros2 real-time performance optimiza- tion and evaluation

    Yanlei Ye, Zhenguo Nie, Xinjun Liu, Fugui Xie, Zihao Li, and Peng Li. Ros2 real-time performance optimiza- tion and evaluation. Chinese Journal of Mechanical Engineering, 36(1):144, 2023

    2023

  109. [117]

    Temporal consistency checks to detect lidar spoofing attacks on autonomous vehicle percep- tion

    Chengzeng You, Zhongyuan Hau, and Soteris Demetriou. Temporal consistency checks to detect lidar spoofing attacks on autonomous vehicle percep- tion. In Proceedings of the 1st Workshop on Security and Privacy for Mobile AI, pages 13–18, 2021. 19

    2021

  110. [118]

    Security risk assessment of humanoid robotics: Darwin-op2 as case study

    Khalil M Ahmad Yousef, Bassam J Mohd, Mohammad Amra, Yazeed Kamel, and Anas AlMajali. Security risk assessment of humanoid robotics: Darwin-op2 as case study. In 2024 25th International Arab Conference on Information Technology (ACIT), pages 1–5. IEEE, 2024

    2024

  111. [119]

    Improving the per- formance of pseudo-random single-photon counting ranging lidar

    Yang Yu, Bo Liu, and Zhen Chen. Improving the per- formance of pseudo-random single-photon counting ranging lidar. Sensors, 19(16):3620, 2019

    2019

  112. [120]

    {CommanderSong}: A systematic approach for prac- tical adversarial voice recognition

    Xuejing Yuan, Yuxuan Chen, Yue Zhao, Yunhui Long, Xiaokang Liu, Kai Chen, Shengzhi Zhang, Heqing Huang, Xiaofeng Wang, and Carl A Gunter. {CommanderSong}: A systematic approach for prac- tical adversarial voice recognition. In 27th USENIX security symposium (USENIX security 18...

    2018

  113. [121]

    {V oltSchemer}: Use voltage noise to manipulate your wireless charger

    Zihao Zhan, Yirui Yang, Haoqi Shan, Hanqiu Wang, Yier Jin, and Shuo Wang. {V oltSchemer}: Use voltage noise to manipulate your wireless charger. In 33rd USENIX Security Symposium (USENIX Security 24), pages 3979–3995, 2024

    2024

  114. [122]

    Eararray: Defending against dolphinat- tack via acoustic attenuation

    Guoming Zhang, Xiaoyu Ji, Xinfeng Li, Gang Qu, and Wenyuan Xu. Eararray: Defending against dolphinat- tack via acoustic attenuation. In NDSS, 2021

    2021

  115. [123]

    Dolphinat- tack: Inaudible voice commands

    Guoming Zhang, Chen Yan, Xiaoyu Ji, Tianchen Zhang, Taimin Zhang, and Wenyuan Xu. Dolphinat- tack: Inaudible voice commands. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, pages 103–117, 2017. A Cross-Layer Vulnerability Propagation T...

    2017

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.