Pith. sign in

REVIEW 3 major objections 4 minor 153 references

Embodied AI trustworthiness is a system property, not a model score

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 00:44 UTC pith:X6EBHBAP

load-bearing objection A serious, honest position piece that gives the field a useful four-layer vocabulary; the T0–T5 ladder is a scaffold awaiting thresholds, so its comparative-evaluation claim is still a promise. the 3 major comments →

arxiv 2607.26121 v1 pith:X6EBHBAP submitted 2026-07-28 cs.RO cs.AIcs.CY

Towards Trustworthy Embodied Intelligence: A Systems Framework and Graded Trustworthiness Levels

Xinyu Yang , Tianxing Chen , Honghao Su , Minxuan Wang , Chenze Yu , Zhangzheng Tu , Yue Chen , Yuxiao Huo
show 33 more authors
Lingfeng Zhang Yan Huang Yan Qin Shaolong Zhu Qiwei Liang Hekun Tian Shujia Liu Guangyu Chen Junhao Gong Zixuan Li Wenwei Lin Zijian Lin Wenxuan Zhu Eric J Chen Yue Yuan Qize Yu Jiaqi Liang Haowen Yan Hengfei Zhao Weijie Wan Zikun Xiao Junyuan Tang Baijun Chen Kai-Chong Lei Kaixuan Wang Kailun Su Zanxin Chen Yao Mu Renjing Xu Chuqiao Lyu Qi Xiong Ping Luo Wenbo Ding
This is my paper
classification cs.RO cs.AIcs.CY
keywords embodied intelligencetrustworthy AIsafetysustained safe successassurancedeployment governancerobot safetyevaluation
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper proposes that an embodied AI system—a robot or autonomous agent that acts in the physical world—should be called trustworthy only when the whole deployed system reliably completes its tasks while keeping risk within acceptable bounds over time. It defines this goal as "sustained safe success" and argues that trustworthiness is an end-to-end property of the deployed system, not of any single model, component, or benchmark score. The paper organizes the supporting mechanisms into four interdependent layers—model, system, evidence, and deployment—and proposes a six-level graded hierarchy (T0–T5) for expressing the strength of a system's bounded trustworthiness claim. A sympathetic reader would care because as embodied AI moves from digital inference to physical interaction, task completion alone can conceal unsafe behavior, and this framework supplies a common structure for comparing, evaluating, and governing deployment claims.

Core claim

The central claim is that trustworthiness is an end-to-end property of a deployed system, not an attribute of an individual model, component, or benchmark score. The paper defines trustworthy embodied intelligence as sustained safe success: reliable completion of intended tasks while physical, semantic, procedural, and operational risks remain within acceptable bounds. It identifies the model layer, which proposes actions with calibrated uncertainty and safety preferences; the system layer, which realizes authorized actions dependably through sensing, computing, control, hardware safeguards, fault containment, and fallback; the evidence layer, which substantiates bounded claims through evalu

What carries the argument

The central object is the bounded trustworthiness claim, expressed as the tuple ⟨system version, task, embodiment, operating domain, authority, evidence⟩, together with the four-layer framework that supports it. The four layers—model, system, evidence, deployment—are functional responsibilities rather than software modules, and the paper stresses cross-layer failure propagation through the semantic–physical gap, the action–consequence gap, and cross-layer non-compositionality. The key quantitative instrument is the safe-success rate, SSR = N(task completed ∧ no unacceptable violation)/N(evaluated trials), which separates four outcome classes: safe success, safe failure, unsafe success, and u

Load-bearing premise

The framework assumes that 'unacceptable violation' and 'acceptable residual risk' can be specified and measured for each application; without that, the safe-success rate and T-level assessments cannot be applied.

What would settle it

A system that meets all T4 assessment dimensions but whose claim lapses after a small unmonitored change—for example, a camera recalibration—without any deployment-layer detection would falsify the claim that a bounded claim's validity is maintained by the four layers. Concretely, audit a deployed robot across such a change and check whether its monitored assumptions trigger revalidation before harm occurs.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Evaluation of embodied systems should report safe success, unsafe success, safe failure, and unsafe failure, rather than a single completion rate.
  • A highly capable model can still be at T1 or T2 if system safeguards, evidence, or deployment governance are missing; capability alone does not raise a TEI level.
  • Deployment should define an explicit operational boundary and use runtime admission, boundary monitoring, intervention, and change control to preserve the validity of the trustworthiness claim.
  • The T0–T5 hierarchy offers a common structure for comparative evaluation, bounded deployment, and future standardization, while remaining non-normative and requiring domain-specific profiles.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Editorial: If the safe-success-rate categories were widely adopted, benchmark suites would need to include scenario-conditioned risk reporting and severity weighting, so that a minor safety-filter activation and a high-energy collision are not counted equally.
  • Editorial: The T-level framework implies a staged-approval model for regulators: a low T-level would authorize only tightly constrained deployments, while T4–T5 would be needed for open-ended operation.
  • Editorial: The paper leaves open the 'assurance-preserving reconfiguration' problem — deciding which tool, payload, or controller changes are minor versus claim-invalidating. An automated impact-analysis tool for revalidation triggers would be a concrete next step.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. This position/survey paper argues that trustworthiness for embodied intelligence cannot be established by any single model, component, or benchmark score. It defines trustworthy embodied intelligence as “sustained safe success,” organized around four interdependent layers—model, system, evidence, and deployment—and proposes a non-normative T0–T5 hierarchy for grading the strength of bounded deployment claims. The paper reviews a broad literature spanning embodied AI, robotics, control, dependable computing, fault tolerance, and autonomous driving, and it connects these fields through the four-layer framework and the proposed TEI levels.

Significance. If accepted, the framework could provide a useful common vocabulary and architectural reference for safety and assurance in embodied AI, and it appropriately stresses bounded deployment claims, assurance cases, and lifecycle governance. The paper is careful to describe the hierarchy as analytical rather than a certification scheme, and it repeatedly acknowledges that thresholds and acceptable-residual-risk criteria are domain-specific. Its strengths include a broad cross-layer synthesis, explicit treatment of failure propagation, and alignment with existing standards and assurance concepts. However, the central evaluative claim—that the T0–T5 hierarchy supports comparative evaluation and bounded deployment—is not yet operationalized. The only formal evaluative object, the safe-success rate in Eq. (1), depends on an uninterpreted primitive “unacceptable violation,” and the T-level assessment in Section 8.1 depends on undefined thresholds for “adequate support.” The paper is therefore best read as a template or agenda for future standardization rather than a complete comparative instrument.

major comments (3)
  1. [§8.1–8.5 and Eq. (1)] The T-level assignment function is underdetermined. Section 8.1 says a TEI level is the least adequately supported of five dimensions, but “adequately supported” is not defined, and Section 8.5 defers quantitative thresholds and acceptable residual risk to domain-specific profiles. Concretely, the same system with the same evidence could be T2 under one permissible profile (e.g., one severe violation per 10^3 trials is acceptable) and T4 under another (one per 10^6 trials), because the least-supported dimension changes. Since the paper supplies no constraint on choosing these cutoffs, the claimed functions of comparative evaluation and bounded deployment (Section 1.2, contribution 4) are not well-defined. The authors acknowledge this deferral, but acknowledgement does not remove the tension; the paper should either provide a working example of a profile and its induced T-level, or explic
  2. [§6.2, Eq. (1)] The safe-success rate is introduced as the primary joint outcome, yet it is an unweighted trial fraction. The same equation treats a high-energy collision and a minor safety-filter activation as equivalent failures, while Section 6.2 subsequently states that these should not be weighted equally. The paper says SSR should be interpreted together with component outcomes, but then SSR is not itself the “primary joint outcome” in any decision-relevant sense. A severity- or exposure-weighted statistic, or a vector of scenario-conditioned rates with the violation predicate made explicit, would be more consistent with the stated safety goals. As written, Eq. (1) is a useful definitional starting point but not a measurable metric without a specification of the unacceptable-violation predicate.
  3. [§3.2 and §8.1] The four-layer decomposition and the five assessment dimensions are asserted as jointly necessary, but no derivation or empirical evidence is provided for their completeness. This is load-bearing for the paper’s central claim that “no single layer can establish end-to-end trustworthiness” and that a TEI level cannot exceed the least adequately supported dimension. I am not asking for a formal completeness proof in a survey, but the paper should clarify whether these are normative proposals or intended descriptive claims about existing systems. If the latter, at least one illustrative application of the framework to a concrete system would help show that the dimensions can be jointly assessed and that the hierarchy yields stable classifications.
minor comments (4)
  1. [§1] “Weusetrustworthy embodied intelligenceto” is missing spaces; please correct “We use trustworthy embodied intelligence to”.
  2. [§6.2, Eq. (1)] The notation N(task completed ∧ no unacceptable violation) / N(evaluated trials) uses the same symbol N for both the numerator and denominator; consider N_safe_success / N_total for clarity.
  3. [§8.4, Table 4] The table aligns AgiBot G1–G5, SAE L0–L5, and TEI T0–T5 row by row. The text cautions that the alignment is illustrative only, but the visual presentation still invites cross-hierarchy equivalence inferences. Consider adding an explicit sentence that the rows are not intended to imply comparable levels of capability, autonomy, or trustworthiness.
  4. [Appendix D and [146]] Reference [146] is first-party company material, and Appendix D correctly notes that internal and industry materials should be labeled as first-party sources. In the main text, however, the discussion around Section 8.4 and the roadmap (Section 9.2) cites company material without that label at the point of use. Adding an explicit first-party marker at the citation site would be more transparent.

Circularity Check

0 steps flagged

No significant circularity: TEI is a proposed definition; T-level grading is admittedly underdetermined, and self-citations are disclosed and non-load-bearing.

full rationale

This is a position/survey paper, not a predictive derivation. Its central claim — 'Trustworthiness is therefore an end-to-end property of a deployed system, not an attribute of an individual model, component, or benchmark score' — is introduced as a definition of 'sustained safe success', and the four-layer framework and T0–T5 hierarchy are organizing proposals rather than results fitted to data. Eq. 1 defines the safe-success rate as N(task completed ∧ no unacceptable violation)/N(evaluated trials); 'no unacceptable violation' is a declared primitive, and the paper explicitly defers operational thresholds to 'domain-specific standards' (Section 8.5: 'Domain-specific standards must define the quantitative thresholds, acceptable residual risk, required evidence, and independent assessment needed to substantiate each level'). That deferral makes the hierarchy underdetermined as a comparative instrument (a correctness/scope limitation, acknowledged in Sections 8.5 and 10), but it is not a circular reduction: the level definitions do not presuppose the levels they are supposed to grade. The relation to AgiBot/SAE taxonomies is declared 'illustrative only' (Section 8.4), so this is not renaming. Several supporting artifacts (SafeDojo [58], RoboDojo [98], RM-Bench [118], RobotWin [94,95], UniVTac [121]) come from the same labs, and [146] is first-party company material; however, these are used as illustrative examples/benchmarks, and the paper explicitly labels [146] as 'Company material; source supplied in Chinese' and instructs in Appendix D that 'Internal and industry materials should remain explicitly identified as first-party sources and should not be treated as independent validation.' No fitted input is renamed as a prediction, and no uniqueness/ansatz is imported via self-citation. The central definitional claim is therefore self-contained, and the self-citation pattern is disclosed and non-load-bearing.

Axiom & Free-Parameter Ledger

0 free parameters · 4 axioms · 0 invented entities

No numeric free parameters or physical invented entities appear. The load-bearing assumptions are conceptual: the necessity/completeness of the four-layer model, the joint non-substitutability of capability and safety, and the operationalizability of acceptable risk thresholds.

axioms (4)
  • domain assumption Task capability and safety are jointly necessary and not substitutable.
    Stated in Section 1 and used throughout the framework; no empirical evidence is given for why they cannot substitute.
  • ad hoc to paper Assumptions and failures propagate across layers, so no single layer can establish end-to-end trustworthiness.
    This is the core structural claim behind the four-layer architecture, asserted in Sections 1 and 3.2 rather than proven.
  • ad hoc to paper The four-layer decomposition (model, system, evidence, deployment) is complete for embodying trustworthiness mechanisms.
    Sections 3.2 and 4–7 assume this categorization covers all relevant mechanisms; no completeness argument is supplied.
  • ad hoc to paper An ordinal T0–T5 hierarchy can meaningfully grade bounded trustworthiness claims across five jointly necessary dimensions.
    Introduced in Section 8; the paper acknowledges domain-specific thresholds are required but none are defined, so the ordinal comparability is assumed.

pith-pipeline@v1.3.0-alltime-deepseek · 31417 in / 9480 out tokens · 85973 ms · 2026-08-01T00:44:10.044573+00:00 · methodology

0 comments
read the original abstract

Embodied intelligence integrates learned perception and decision making with real-time computation, control, and physical interaction. Because failures can cause immediate physical or operational harm, task completion alone does not establish trustworthiness. We define trustworthy embodied intelligence as the sustained capacity to execute specified tasks reliably under environmental and system variation while maintaining risk within acceptable bounds. We term this objective sustained safe success. Its supporting mechanisms are organized into four interdependent layers. The model layer generates task-competent action proposals with calibrated uncertainty and explicit safety preferences. The system layer realizes authorized actions dependably through integrated sensing, computation, control, hardware safeguards, fault containment, and fallback. The evidence layer substantiates bounded claims through evaluation, verification, validation, traceability, and structured assurance arguments. The deployment layer maintains claim validity through runtime monitoring, authority management, intervention, incident response, and controlled updates. Because assumptions and failures propagate across these layers, neither model capability, isolated safeguards, nor benchmark performance alone can establish end-to-end trustworthiness. Drawing on embodied AI, robotics, control, dependable computing, distributed systems, and autonomous driving, we further propose a non-normative hierarchy of trustworthiness levels. This hierarchy grades the strength of bounded deployment claims across task capability, safety, system assurance, operational governance, and supporting evidence, providing a basis for bounded deployment, comparative evaluation, research prioritization, and future standardization.

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

153 extracted references · 43 linked inside Pith

  1. [1]

    Rt-1: Robotics transformer for real-world control at scale

    Anthony Brohan, Noah Brown, Justice Carbajal, Yevgen Chebotar, Joseph Dabis, Chelsea Finn, Keerthana Gopalakr- ishnan, Karol Hausman, Alex Herzog, Jasmine Hsu, et al. Rt-1: Robotics transformer for real-world control at scale. arXiv preprint arXiv:2212.06817, 2022

    Pith/arXiv arXiv 2022

  2. [2]

    Palm-e: An embodied multimodal language model.arXiv preprint arXiv:2303.03378, 2023

    Danny Driess, Fei Xia, Mehdi SM Sajjadi, Corey Lynch, Aakanksha Chowdhery, Brian Ichter, Ayzaan Wahid, Jonathan Tompson, Quan Vuong, Tianhe Yu, et al. Palm-e: An embodied multimodal language model.arXiv preprint arXiv:2303.03378, 2023

    Pith/arXiv arXiv 2023

  3. [3]

    Rt-2: Vision-language-action models transfer web knowledge to robotic control

    Brianna Zitkovich, Tianhe Yu, Sichun Xu, Peng Xu, Ted Xiao, Fei Xia, Jialin Wu, Paul Wohlhart, Stefan Welker, Ayzaan Wahid, et al. Rt-2: Vision-language-action models transfer web knowledge to robotic control. InConference on Robot Learning, pages 2165–2183. PMLR, 2023

    2023

  4. [4]

    Openvla: An open-source vision-language-action model.arXiv preprint arXiv:2406.09246, 2024

    Moo Jin Kim, Karl Pertsch, Siddharth Karamcheti, Ted Xiao, Ashwin Balakrishna, Suraj Nair, Rafael Rafailov, Ethan Foster, Grace Lam, Pannag Sanketi, et al. Openvla: An open-source vision-language-action model.arXiv preprint arXiv:2406.09246, 2024

    Pith/arXiv arXiv 2024

  5. [5]

    Kevin Black, Noah Brown, Danny Driess, Adnan Esmail, Michael Equi, Chelsea Finn, Niccolo Fusai, Lachy Groom, Karol Hausman, Brian Ichter, et al.𝜋0: A vision-language-action flow model for general robot control.arXiv preprint arXiv:2410.24164, 2024

    Pith/arXiv arXiv 2024

  6. [6]

    Mastering diverse domains through world models.arXiv preprint arXiv:2301.04104, 2023

    Danijar Hafner, Jurgis Pasukonis, Jimmy Ba, and Timothy Lillicrap. Mastering diverse domains through world models.arXiv preprint arXiv:2301.04104, 2023

    Pith/arXiv arXiv 2023

  7. [7]

    Tactile robotics: An outlook.IEEE Transactions on Robotics, 2025

    Shan Luo, Nathan F Lepora, Wenzhen Yuan, Kaspar Althoefer, Gordon Cheng, and Ravinder Dahiya. Tactile robotics: An outlook.IEEE Transactions on Robotics, 2025

    2025

  8. [8]

    Expressive whole-body control for humanoid robots.arXiv preprint arXiv:2402.16796, 2024

    Xuxin Cheng, Yandong Ji, Junming Chen, Ruihan Yang, Ge Yang, and Xiaolong Wang. Expressive whole-body control for humanoid robots.arXiv preprint arXiv:2402.16796, 2024

    Pith/arXiv arXiv 2024

  9. [9]

    A comprehensive survey on physical risk control in the era of foundation model-enabled robotics.arXiv preprint arXiv:2505.12583, 2025

    Takeshi Kojima, Yaonan Zhu, Yusuke Iwasawa, Toshinori Kitamura, Gang Yan, Shu Morikuni, Ryosuke Takanami, Alfredo Solano, Tatsuya Matsushima, Akiko Murakami, et al. A comprehensive survey on physical risk control in the era of foundation model-enabled robotics.arXiv preprint arXiv:2505.12583, 2025

    Pith/arXiv arXiv 2025

  10. [10]

    Safety in embodied ai: A survey of risks, attacks, and defenses.arXiv preprint arXiv:2605.02900, 2026

    Xiao Li, Xiang Zheng, Yifeng Gao, Xinyu Xia, Yixu Wang, Xin Wang, Ye Sun, Yunhan Zhao, Ming Wen, Jiayu Li, et al. Safety in embodied ai: A survey of risks, attacks, and defenses.arXiv preprint arXiv:2605.02900, 2026

    Pith/arXiv arXiv 2026

  11. [11]

    What breaks embodied ai security: Llm vulnerabilities, cps flaws, or something else?High-Confidence Computing, page 100403, 2026

    Boyang Ma, Hechuan Guo, Peizhuo Lv, Minghui Xu, Xuelong Dai, YeChao Zhang, Yijun Yang, and Yue Zhang. What breaks embodied ai security: Llm vulnerabilities, cps flaws, or something else?High-Confidence Computing, page 100403, 2026

    2026

  12. [12]

    Sim-to-real transfer of robotic control with dynamics randomization.arXiv preprint arXiv:1710.06537, 2017

    Xue Bin Peng, Marcin Andrychowicz, Wojciech Zaremba, and Pieter Abbeel. Sim-to-real transfer of robotic control with dynamics randomization.arXiv preprint arXiv:1710.06537, 2017

    Pith/arXiv arXiv 2017

  13. [13]

    Domain randomization for transferring deep neural networks from simulation to the real world

    Josh Tobin, Rachel Fong, Alex Ray, Jonas Schneider, Wojciech Zaremba, and Pieter Abbeel. Domain randomization for transferring deep neural networks from simulation to the real world. In2017 IEEE/RSJ international conference on intelligent robots and systems (IROS), pages 23–30. IEEE, 2017

    2017

  14. [14]

    Safe embodied ai for long-horizon tasks: A cross-layer analysis of robotic manipulation.arXiv preprint arXiv:2606.05660, 2026

    Dabin Kim, Daemin Park, Sangyub Lee, Jinsik Kim, Yeongtak Oh, Jongho Shin, and Sungroh Yoon. Safe embodied ai for long-horizon tasks: A cross-layer analysis of robotic manipulation.arXiv preprint arXiv:2606.05660, 2026

    Pith/arXiv arXiv 2026

  15. [15]

    Basic concepts and taxonomy of dependable and secure computing.IEEE transactions on dependable and secure computing, 1(1):11–33, 2004

    Algirdas Avizienis, J-C Laprie, Brian Randell, and Carl Landwehr. Basic concepts and taxonomy of dependable and secure computing.IEEE transactions on dependable and secure computing, 1(1):11–33, 2004

    2004

  16. [16]

    Control barrier functions: Theory and applications

    Aaron D Ames, Samuel Coogan, Magnus Egerstedt, Gennaro Notomista, Koushil Sreenath, and Paulo Tabuada. Control barrier functions: Theory and applications. In2019 18th European control conference (ECC), pages 3420–

  17. [17]

    Harnessing embodied agents: Runtime governance for policy-constrained execution.arXiv preprint arXiv:2604.07833, 2026

    Xue Qin, Simin Luan, John See, Zeyd Boukhers, Cong Yang, and Zhijun Li. Harnessing embodied agents: Runtime governance for policy-constrained execution.arXiv preprint arXiv:2604.07833, 2026

    Pith/arXiv arXiv 2026

  18. [18]

    Md Muzakkir Quamar and Ali Nasir. Review on fault diagnosis and fault-tolerant control scheme for robotic manipulators: Recent advances in ai, machine learning, and digital twin.arXiv preprint arXiv:2402.02980, 2024

    Pith/arXiv arXiv 2024

  19. [19]

    Robot collisions: A survey on detection, isolation, and identification.IEEE Transactions on Robotics, 33(6):1292–1312, 2017

    Sami Haddadin, Alessandro De Luca, and Alin Albu-Schäffer. Robot collisions: A survey on detection, isolation, and identification.IEEE Transactions on Robotics, 33(6):1292–1312, 2017

    2017

  20. [20]

    Physical human-robot interaction: A critical review of safety constraints.arXiv preprint arXiv:2601.19462, 2026

    Riccardo Zanella, Federico Califano, and Stefano Stramigioli. Physical human-robot interaction: A critical review of safety constraints.arXiv preprint arXiv:2601.19462, 2026

    arXiv 2026

  21. [21]

    On calibration of modern neural networks

    Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q Weinberger. On calibration of modern neural networks. In International conference on machine learning, pages 1321–1330. PMLR, 2017

    2017

  22. [22]

    A baseline for detecting misclassified and out-of-distribution examples in neural networks.arXiv preprint arXiv:1610.02136, 2016

    Dan Hendrycks and Kevin Gimpel. A baseline for detecting misclassified and out-of-distribution examples in neural networks.arXiv preprint arXiv:1610.02136, 2016

    Pith/arXiv arXiv 2016

  23. [23]

    Do as i can, not as i say: Grounding language in robotic affordances.arXiv preprint arXiv:2204.01691, 2022

    Michael Ahn, Anthony Brohan, Noah Brown, Yevgen Chebotar, Omar Cortes, Byron David, Chelsea Finn, Chuyuan Fu, Keerthana Gopalakrishnan, Karol Hausman, et al. Do as i can, not as i say: Grounding language in robotic affordances.arXiv preprint arXiv:2204.01691, 2022. 30

    Pith/arXiv arXiv 2022

  24. [24]

    Concrete problems in ai safety.arXiv preprint arXiv:1606.06565, 2016

    Dario Amodei, Chris Olah, Jacob Steinhardt, Paul Christiano, John Schulman, and Dan Mané. Concrete problems in ai safety.arXiv preprint arXiv:1606.06565, 2016

    Pith/arXiv arXiv 2016

  25. [25]

    Zhiwei Gao, Carlo Cecati, and Steven X Ding. A survey of fault diagnosis and fault-tolerant techniques—part i: Fault diagnosis with model-based and signal-based approaches.IEEE transactions on industrial electronics, 62(6): 3757–3767, 2015

    2015

  26. [26]

    A survey of algorithms for black-box safety validation of cyber-physical systems.Journal of Artificial Intelligence Research, 2021

    Anthony Corso, Robert J Moss, Mark Koren, Ritchie Lee, and Mykel J Kochenderfer. A survey of algorithms for black-box safety validation of cyber-physical systems.Journal of Artificial Intelligence Research, 2021

    2021

  27. [27]

    Survey on scenario-based safety assessment of automated vehicles.IEEE access, 8:87456–87477, 2020

    Stefan Riedmaier, Thomas Ponn, Dieter Ludwig, Bernhard Schick, and Frank Diermeyer. Survey on scenario-based safety assessment of automated vehicles.IEEE access, 8:87456–87477, 2020

    2020

  28. [28]

    Driving to safety: How many miles of driving would it take to demonstrate autonomous vehicle reliability?Transportation research part A: policy and practice, 94:182–193, 2016

    Nidhi Kalra and Susan M Paddock. Driving to safety: How many miles of driving would it take to demonstrate autonomous vehicle reliability?Transportation research part A: policy and practice, 94:182–193, 2016

    2016

  29. [29]

    Meaningful human control over autonomous systems: A philosophical account.Frontiers in Robotics and AI, 5, 2018

    Filippo Santoni de Sio and Jeroen Van den Hoven. Meaningful human control over autonomous systems: A philosophical account.Frontiers in Robotics and AI, 5, 2018

    2018

  30. [30]

    Using simplicity to control complexity.IEEE Software, 18(4):20, 2001

    Lui Sha. Using simplicity to control complexity.IEEE Software, 18(4):20, 2001

    2001

  31. [31]

    Leveson.Engineering a safer world: systems thinking applied to safety

    Nancy G. Leveson.Engineering a safer world: systems thinking applied to safety. Engineering systems. MIT press, Cambridge (Mass.), 2011. ISBN 9780262016629 9781628703399

    2011

  32. [32]

    ISO 21448:2022: Road vehicles — Safety of the intended function- ality

    International Organization for Standardization. ISO 21448:2022: Road vehicles — Safety of the intended function- ality. International Standard, 2022

    2022

  33. [33]

    Assuring safety-critical machine learning enabled systems: Challenges and promise

    Alwyn E Goodloe. Assuring safety-critical machine learning enabled systems: Challenges and promise. In2022 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW), pages 326–332. IEEE, 2022

    2022

  34. [34]

    Physically grounded vision-language models for robotic manipulation

    Jensen Gao, Bidipta Sarkar, Fei Xia, Ted Xiao, Jiajun Wu, Brian Ichter, Anirudha Majumdar, and Dorsa Sadigh. Physically grounded vision-language models for robotic manipulation. In2024 IEEE International Conference on Robotics and Automation (ICRA), pages 12462–12469. IEEE, 2024

    2024

  35. [35]

    Verifiably following complex robot instructions with foundation models

    Benedict Quartey, Eric Rosen, Stefanie Tellex, and George Konidaris. Verifiably following complex robot instructions with foundation models. In2025 IEEE International Conference on Robotics and Automation (ICRA), pages 1–8. IEEE, 2025

    2025

  36. [36]

    3d-vitac: Learning fine-grained manipulation with visuo-tactile sensing.arXiv preprint arXiv:2410.24091, 2024

    Binghao Huang, Yixuan Wang, Xinyi Yang, Yiyue Luo, and Yunzhu Li. 3d-vitac: Learning fine-grained manipulation with visuo-tactile sensing.arXiv preprint arXiv:2410.24091, 2024

    Pith/arXiv arXiv 2024

  37. [37]

    Adversarial patch.arXiv preprint arXiv:1712.09665, 2017

    Tom B Brown, Dandelion Mané, Aurko Roy, Martín Abadi, and Justin Gilmer. Adversarial patch.arXiv preprint arXiv:1712.09665, 2017

    Pith/arXiv arXiv 2017

  38. [38]

    Robust physical-world attacks on deep learning visual classification

    Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. InProceedings of the IEEE conference on computer vision and pattern recognition, pages 1625–1634, 2018

    2018

  39. [39]

    Spatiotemporal attacks for embodied agents

    Aishan Liu, Tairan Huang, Xianglong Liu, Yitao Xu, Yuqing Ma, Xinyun Chen, Stephen J Maybank, and Dacheng Tao. Spatiotemporal attacks for embodied agents. InEuropean Conference on Computer Vision, pages 122–138. Springer, 2020

    2020

  40. [40]

    Badnets: Identifying vulnerabilities in the machine learning model supply chain.arXiv preprint arXiv:1708.06733, 2017

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain.arXiv preprint arXiv:1708.06733, 2017

    Pith/arXiv arXiv 2017

  41. [41]

    Deep evidential regression.Advances in neural information processing systems, 33:14927–14937, 2020

    Alexander Amini, Wilko Schwarting, Ava Soleimany, and Daniela Rus. Deep evidential regression.Advances in neural information processing systems, 33:14927–14937, 2020

    2020

  42. [42]

    Grounding language with visual affordances over unstructured data.arXiv preprint arXiv:2210.01911, 2022

    Oier Mees, Jessica Borja-Diaz, and Wolfram Burgard. Grounding language with visual affordances over unstructured data.arXiv preprint arXiv:2210.01911, 2022

    Pith/arXiv arXiv 2022

  43. [43]

    Code as policies: Language model programs for embodied control

    Jacky Liang, Wenlong Huang, Fei Xia, Peng Xu, Karol Hausman, Brian Ichter, Pete Florence, and Andy Zeng. Code as policies: Language model programs for embodied control. In2023 IEEE International conference on robotics and automation (ICRA), pages 9493–9500. IEEE, 2023

    2023

  44. [44]

    Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection

    Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection. InProceedings of the 16th ACM workshop on artificial intelligence and security, pages 79–90, 2023

    2023

  45. [45]

    Universal and transferable adversarial attacks on aligned language models.arXiv preprint arXiv:2307.15043, 2023

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models.arXiv preprint arXiv:2307.15043, 2023

    Pith/arXiv arXiv 2023

  46. [46]

    Badrobot: Jailbreaking embodied llms in the physical world.arXiv preprint arXiv:2407.20242, 2024

    Hangtao Zhang, Chenyu Zhu, Xianlong Wang, Ziqi Zhou, Changgan Yin, Minghui Li, Lulu Xue, Yichen Wang, Shengshan Hu, Aishan Liu, et al. Badrobot: Jailbreaking embodied llms in the physical world.arXiv preprint arXiv:2407.20242, 2024

    Pith/arXiv arXiv 2024

  47. [47]

    Goal-oriented backdoor attack against vision-language-action models via physical objects.arXiv preprint arXiv:2510.09269, 2025

    Zirun Zhou, Zhengyang Xiao, Haochuan Xu, Jing Sun, Di Wang, and Jingfeng Zhang. Goal-oriented backdoor attack against vision-language-action models via physical objects.arXiv preprint arXiv:2510.09269, 2025

    arXiv 2025

  48. [48]

    Integrated task and motion planning.Annual review of control, robotics, and autonomous systems, 4 (1):265–293, 2021

    Caelan Reed Garrett, Rohan Chitnis, Rachel Holladay, Beomjoon Kim, Tom Silver, Leslie Pack Kaelbling, and Tomás Lozano-Pérez. Integrated task and motion planning.Annual review of control, robotics, and autonomous systems, 4 (1):265–293, 2021. 31

    2021

  49. [49]

    Task and motion planning with large language models for object rearrangement

    Yan Ding, Xiaohan Zhang, Chris Paxton, and Shiqi Zhang. Task and motion planning with large language models for object rearrangement. In2023 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), pages 2086–2092. IEEE, 2023

    2086

  50. [50]

    Constrained policy optimization

    Joshua Achiam, David Held, Aviv Tamar, and Pieter Abbeel. Constrained policy optimization. InInternational conference on machine learning, pages 22–31. Pmlr, 2017

    2017

  51. [51]

    Reward constrained policy optimization.arXiv preprint arXiv:1805.11074, 2018

    Chen Tessler, Daniel J Mankowitz, and Shie Mannor. Reward constrained policy optimization.arXiv preprint arXiv:1805.11074, 2018

    Pith/arXiv arXiv 2018

  52. [52]

    A comprehensive survey on safe reinforcement learning.Journal of Machine Learning Research, 16(1):1437–1480, 2015

    Javier Garcıa and Fernando Fernández. A comprehensive survey on safe reinforcement learning.Journal of Machine Learning Research, 16(1):1437–1480, 2015

    2015

  53. [53]

    Safety-oriented human-robot collaboration in construction through human preference alignment.Journal of Intelligent Construction, 3(3):1–15, 2025

    Mao Tian and Zhengbo Zou. Safety-oriented human-robot collaboration in construction through human preference alignment.Journal of Intelligent Construction, 3(3):1–15, 2025

    2025

  54. [54]

    Constrained diffusers for safe planning and control.Advances in Neural Information Processing Systems, 38:34965–34998, 2026

    Jichen Zhang, Liqun Zhao, Antonis Papachristodoulou, and Jack Umenberger. Constrained diffusers for safe planning and control.Advances in Neural Information Processing Systems, 38:34965–34998, 2026

    2026

  55. [55]

    Safe model-based reinforcement learning with an uncertainty-aware reachability certificate.IEEE Transactions on Automation Science and Engineering, 21(3):4129–4142, 2023

    Dongjie Yu, Wenjun Zou, Yujie Yang, Haitong Ma, Shengbo Eben Li, Yuming Yin, Jianyu Chen, and Jingliang Duan. Safe model-based reinforcement learning with an uncertainty-aware reachability certificate.IEEE Transactions on Automation Science and Engineering, 21(3):4129–4142, 2023

    2023

  56. [56]

    A predictive safety filter for learning-based control of constrained nonlinear dynamical systems.Automatica, 129:109597, 2021

    Kim Peter Wabersich and Melanie N Zeilinger. A predictive safety filter for learning-based control of constrained nonlinear dynamical systems.Automatica, 129:109597, 2021

    2021

  57. [57]

    Unisim: A neural closed-loop sensor simulator

    Ze Yang, Yun Chen, Jingkang Wang, Sivabalan Manivasagam, Wei-Chiu Ma, Anqi Joyce Yang, and Raquel Urtasun. Unisim: A neural closed-loop sensor simulator. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1389–1399, 2023

    2023

  58. [58]

    Safedojo: Safe reinforcement learning for vla via interactive world model.arXiv preprint arXiv:2606.20698, 2026

    Kai Tang, Peidong Jia, Zhong Chu, Jixian Wu, Rui Ma, Jiajun Cao, Fangyuan Zhao, Sixiang Chen, Yichen Guo, Xiaowei Chi, et al. Safedojo: Safe reinforcement learning for vla via interactive world model.arXiv preprint arXiv:2606.20698, 2026

    Pith/arXiv arXiv 2026

  59. [59]

    Poisoning attacks against support vector machines.arXiv preprint arXiv:1206.6389, 2012

    Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against support vector machines.arXiv preprint arXiv:1206.6389, 2012

    Pith/arXiv arXiv 2012

  60. [60]

    Robots that ask for help: Uncertainty alignment for large language model planners.arXiv preprint arXiv:2307.01928, 2023

    Allen Z Ren, Anushri Dixit, Alexandra Bodrova, Sumeet Singh, Stephen Tu, Noah Brown, Peng Xu, Leila Takayama, Fei Xia, Jake Varley, et al. Robots that ask for help: Uncertainty alignment for large language model planners.arXiv preprint arXiv:2307.01928, 2023

    Pith/arXiv arXiv 2023

  61. [61]

    Sensor-enabled safety systems for human–robot collaboration: A review.IEEE Sensors Journal, 25(1):65–88, 2024

    Constantin Scholz, Hoang-Long Cao, Emil Imrith, Nima Roshandel, Hamed Firouzipouyaei, Aleksander Burkiewicz, Milan Amighi, Sebastien Menet, Dylan Warawout Sisavath, Antonio Paolillo, et al. Sensor-enabled safety systems for human–robot collaboration: A review.IEEE Sensors Journal, 25(1):65–88, 2024

    2024

  62. [62]

    Robot operating system 2: Design, architecture, and uses in the wild.Science robotics, 7(66):eabm6074, 2022

    Steven Macenski, Tully Foote, Brian Gerkey, Chris Lalancette, and William Woodall. Robot operating system 2: Design, architecture, and uses in the wild.Science robotics, 7(66):eabm6074, 2022

    2022

  63. [63]

    A survey of real-time support, analysis, and advancements in ros 2.arXiv preprint arXiv:2601.10722, 2025

    Daniel Casini, Jian-Jia Chen, Jing Li, Federico Reghenzani, and Harun Teper. A survey of real-time support, analysis, and advancements in ros 2.arXiv preprint arXiv:2601.10722, 2025

    Pith/arXiv arXiv 2025

  64. [64]

    Priority inheritance protocols: An approach to real-time synchronization.IEEE Transactions on computers, 39(9):1175–1185, 1990

    Lui Sha, Ragunathan Rajkumar, and John P Lehoczky. Priority inheritance protocols: An approach to real-time synchronization.IEEE Transactions on computers, 39(9):1175–1185, 1990

    1990

  65. [65]

    End-to-end timing analysis and optimization of multi-executor ros 2 systems

    Harun Teper, Tobias Betz, Mario Günzel, Dominic Ebner, Georg Von Der Brüggen, Johannes Betz, and Jian-Jia Chen. End-to-end timing analysis and optimization of multi-executor ros 2 systems. In2024 IEEE 30th Real-Time and Embedded Technology and Applications Symposium (RTAS), pages 212–224. IEEE, 2024

    2024

  66. [66]

    Timing analysis and priority-driven enhancements of ros 2 multi-threaded executors

    Hoora Sobhani, Hyunjong Choi, and Hyoseung Kim. Timing analysis and priority-driven enhancements of ros 2 multi-threaded executors. In2023 IEEE 29th Real-Time and Embedded Technology and Applications Symposium (RTAS), pages 106–118. IEEE, 2023

    2023

  67. [67]

    Series elastic actuators

    Gill A Pratt and Matthew M Williamson. Series elastic actuators. InProceedings 1995 IEEE/RSJ international conferenceonintelligentrobotsandsystems.Humanrobotinteractionandcooperativerobots, volume1, pages399–406. IEEE, 1995

    1995

  68. [68]

    Impedance control: An approach to manipulation

    Neville Hogan. Impedance control: An approach to manipulation. In1984 American control conference, pages 304–313. IEEE, 1984

    1984

  69. [69]

    Coboskin: Soft robot skin with variable stiffness for safer human–robot collaboration.IEEE Transactions on Industrial Electronics, 68(4):3303–3314, 2020

    Gaoyang Pang, Geng Yang, Wenzheng Heng, Zhiqiu Ye, Xiaoyan Huang, Hua-Yong Yang, and Zhibo Pang. Coboskin: Soft robot skin with variable stiffness for safer human–robot collaboration.IEEE Transactions on Industrial Electronics, 68(4):3303–3314, 2020

    2020

  70. [70]

    A review on fault detection and diagnosis of industrial robots and multi-axis machines.Results in Engineering, 23:102397, 2024

    Ameer H Sabry and Ungku Anisa Bte Ungku Amirulddin. A review on fault detection and diagnosis of industrial robots and multi-axis machines.Results in Engineering, 23:102397, 2024

    2024

  71. [71]

    Review of fault-tolerant control systems used in robotic manipulators.Applied Sciences, 13(4):2675, 2023

    Andrzej Milecki and Patryk Nowak. Review of fault-tolerant control systems used in robotic manipulators.Applied Sciences, 13(4):2675, 2023

    2023

  72. [72]

    Fault-tolerant control of robot manipulators with sensory faults using unbiased active inference

    Mohamed Baioumy, Corrado Pezzato, Riccardo Ferrari, Carlos Hernandez Corbato, and Nick Hawes. Fault-tolerant control of robot manipulators with sensory faults using unbiased active inference. In2021 European Control Conference (ECC), pages 1119–1125. IEEE, 2021. 32

    2021

  73. [73]

    Safe, passive control for mechanical systems with application to physical human-robot interactions

    Wenceslao Shaw Cortez, Christos K Verginis, and Dimos V Dimarogonas. Safe, passive control for mechanical systems with application to physical human-robot interactions. In2021 IEEE International Conference on Robotics and Automation (ICRA), pages 3836–3842. IEEE, 2021

    2021

  74. [74]

    Cyber security of robots: A comprehensive survey

    Alessio Botta, Sayna Rotbei, Stefania Zinno, and Giorgio Ventre. Cyber security of robots: A comprehensive survey. Intelligent Systems with Applications, 18:200237, 2023

    2023

  75. [75]

    Zero trust architecture.NIST special publication, 800 (207):1–52, 2020

    Scott Rose, Oliver Borchert, Stu Mitchell, and Sean Connelly. Zero trust architecture.NIST special publication, 800 (207):1–52, 2020

    2020

  76. [76]

    Sros2: Usable cyber security tools for ros 2

    Victor Mayoral-Vilches, Ruffin White, Gianluca Caiazza, and Mikael Arguedas. Sros2: Usable cyber security tools for ros 2. In2022 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), pages 11253–11259. IEEE, 2022

    2022

  77. [77]

    On the (in) security of secure ros2

    Gelei Deng, Guowen Xu, Yuan Zhou, Tianwei Zhang, and Yang Liu. On the (in) security of secure ros2. InProceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, pages 739–753, 2022

    2022

  78. [78]

    The byzantine generals problem.ACM Trans

    Leslie Lamport, Robert Shostak, and Marshall Pease. The byzantine generals problem.ACM Trans. Program. Lang. Syst., 4(3):382–401, July 1982. ISSN 0164-0925. doi: 10.1145/357172.357176. URLhttps://doi.org/10. 1145/357172.357176

    arXiv 1982

  79. [79]

    An investigation of byzantine threats in multi-robot systems

    Gelei Deng, Yuan Zhou, Yuan Xu, Tianwei Zhang, and Yang Liu. An investigation of byzantine threats in multi-robot systems. InProceedings of the 24th international symposium on research in attacks, intrusions and defenses, pages 17–32, 2021

    2021

  80. [80]

    An overview on multi-agent consensus under adversarial attacks.Annual Reviews in Control, 53:252–272, 2022

    Hideaki Ishii, Yuan Wang, and Shuai Feng. An overview on multi-agent consensus under adversarial attacks.Annual Reviews in Control, 53:252–272, 2022

    2022

Showing first 80 references.