Xuancun Lu, Zhengxian Huang, Xinfeng Li, Chi Zhang, Xiaoyu Ji, Wenyuan Xu

• We reveal an intent–behavior gap in jailbreaking LLM-based robots: malicious-looking policies rarely translate into harmful physical executions, because existing attacks overlook robot-specific syntax constraints and physical feasibility. We propose POEF, an automated red-teaming framework that embeds these constraints into both prompt optimization and evaluation, achieving an 80% behavior jailbreak success rate on the Unitree G1, the Franka arm, and simulators, and we present two defenses.

Kun Wang, Xuancun Lu, Ruochen Zhou, Kai Wang, Tongjun Ye, Yihao Shao, Chen Yan, Xiaoyu Ji, Wenyuan Xu

• We present GhostTac, the first contactless attack that manipulates tactile sensing via electromagnetic interference (EMI). By exploiting nonlinear rectification and limited-bandwidth amplification, crafted EMI signals become a persistent DC offset that bypasses on-board filtering, enabling fine-grained control over sensor outputs and inducing harmful robot behaviors such as excessive grasping force. We validate GhostTac on 15 tactile sensors across 10 modules and 2 dexterous hands, with case studies on grasping, slip detection, and material classification.

Xuancun Lu, Jiaxiang Chen, Shilin Xiao, Zizhi Jin, Zhangrui Chen, Hanwen Yu, Bohan Qian, Ruochen Zhou, Xiaoyu Ji, Wenyuan Xu

• We present the first systematic study of physical sensor attacks against Vision-Language-Action (VLA) models. Our “Real-Sim-Real” framework automatically simulates six camera attacks and two microphone attacks and validates them on real robots, exposing vulnerabilities whose severity depends critically on task type and model design. We further develop an adversarial-training-based defense that improves robustness to these out-of-distribution perturbations while preserving model performance.

Zizhi Jin, Qinhong Jiang, Xuancun Lu, Chen Yan, Xiaoyu Ji, Wenyuan Xu

• We show that a LiDAR’s laser receiving circuit, monitoring sensors, and beam-steering modules still couple with intentional electromagnetic interference (IEMI) despite strict EMC testing. Exploiting these attack surfaces, PhantomLiDAR achieves Points Interference, Injection, Removal, and even LiDAR Power-Off, demonstrated on five COTS LiDARs in both simulated and real-world moving scenarios, along with sensor- and vehicle-level defenses.

Zizhi Jin, Xuancun Lu, Bo Yang,Yushi Chen, Chen Yan, Xiaoyu Ji, Wenyuan Xu

• Our new benchmark features 5 types of LiDAR attacks and 6 types of camera attacks. Different from traditional benchmarks, we take the physical sensor attacks into consideration during the corruption construction. Then, we systematically investigate 7 MSF-based and 5 single-modality 3D object detection models with different fusion architectures.

Xinfeng Li, Chen Yan, Xuancun Lu, Zihan Zeng, Xiaoyu Ji, Wenyuan Xu

• We propose VRIFLE, an inaudible adversarial perturbation (IAP) attack via ultrasound delivery that can manipulate ASRs as a user speaks.