具身智能（Embodied AI）将感知、认知、规划与交互集成于在开放世界中自主运作的智能体。
本综述系统梳理了500余篇论文，构建了从感知→认知→规划→行动交互→智能体系统的五层分类体系，
揭示了对抗攻击、后门攻击、越狱攻击和硬件级攻击的全链路风险与防御手段，
为建造"能力强且安全可靠"的具身智能体提供路线图。Embodied AI integrates perception, cognition, planning, and interaction into agents that operate autonomously in the open world. This survey systematically reviews more than 500 papers and builds a five-layer taxonomy running from perception to cognition, planning, action and interaction, and agentic systems, exposing the end-to-end risks of adversarial attacks, backdoor attacks, jailbreak attacks, and hardware-level attacks together with the defenses against them, and offering a roadmap for building embodied agents that are both highly capable and reliably safe.
具身智能正快速进入交通、医疗、工业与辅助机器人等高风险领域。与数字AI不同，具身智能体在不确定感知、不完整知识和动态人机交互下行动，一旦出现故障可直接导致物理伤害。
然而，当前安全研究高度碎片化——针对视觉感知、语言模型、规划器、硬件传感器的工作分散在不同社区，缺乏统一框架。Embodied AI is rapidly entering high-stakes domains such as transportation, healthcare, industry, and assistive robotics. Unlike digital AI, embodied agents act under uncertain sensing, incomplete knowledge, and dynamic human-robot interaction, so a single failure can directly cause physical harm. Current safety research, however, is highly fragmented: work on visual perception, language models, planners, and hardware sensors is scattered across separate communities and lacks a unified framework.
"Unlike digital AI systems, embodied agents must act under uncertain sensing, incomplete knowledge, and dynamic human-robot interactions, where failures can directly lead to physical harm."
具身智能安全综述总览图：涵盖感知、认知、规划、行动交互和智能体系统五个层面的攻击与防御研究，共综合分析558篇论文。Overview of the embodied AI safety survey: it spans attack and defense research across the five levels of perception, cognition, planning, action and interaction, and agentic systems, synthesizing 558 papers in total.
核心洞察是"能力与风险的二元性"（capability vs. risk duality）：随着具身系统自主性增强，其攻击面也按比例扩大，且漏洞可跨层级级联传播。
例如，感知层的对抗扰动可导致认知层产生错误的世界模型，进而引发规划层生成危险轨迹，最终导致有害的物理行为。The central insight is the capability vs. risk duality: as embodied systems become more autonomous, their attack surface expands proportionally, and vulnerabilities can cascade across layers. An adversarial perturbation at the perception layer, for example, can induce an erroneous world model at the cognition layer, which in turn leads the planning layer to generate dangerous trajectories and finally results in harmful physical behavior.
能力与风险二元性示意图：随着具身AI能力提升（自主性、多模态感知、开放世界交互），相应的安全风险也按层级扩大，包括对抗攻击、越狱攻击和硬件级威胁。Illustration of the capability-risk duality: as embodied AI capabilities grow (autonomy, multimodal perception, open-world interaction), the corresponding safety risks expand layer by layer, including adversarial attacks, jailbreak attacks, and hardware-level threats.
02分类体系 · TaxonomyTaxonomy
本综述提出一套多层分类体系（multi-level taxonomy），将具身智能安全研究统一组织为五个能力层，每层涵盖若干子类，并系统梳理各层的攻击手段与防御方法。This survey proposes a multi-level taxonomy that organizes embodied AI safety research into five capability layers, each covering several subcategories, and systematically reviews the attacks and defenses at every layer.
五层分类体系结构图：从感知（Perception）到认知（Cognition）、规划（Planning）、行动与交互（Action & Interaction）、智能体系统（Agentic Systems），每层列出主要攻击类型与防御策略，共涵盖558篇论文。Structure of the five-layer taxonomy: from Perception to Cognition, Planning, Action & Interaction, and Agentic Systems, each layer listing its main attack types and defense strategies, covering 558 papers in total.
感知层是具身智能体与物理世界交互的第一道关口，也是当前研究最密集的领域（199篇）。
子类别包括：The perception layer is the first gateway through which an embodied agent interacts with the physical world, and it is also the most densely studied area (199 papers). Its subcategories are:
视觉攻击（Visual）：对抗补丁（adversarial patches）、纹理扰动、对抗性3D物体（58篇）Visual attacks: adversarial patches, texture perturbations, and adversarial 3D objects (58 papers)
跨模态攻击（Cross-Modal）：利用视觉-语言对齐的漏洞（11篇）Cross-modal attacks: exploiting vulnerabilities of vision-language alignment (11 papers)
感知融合的脆弱性是最被忽视的挑战之一：多传感器融合系统（如视觉+LiDAR）在单模态防御下仍可被跨模态攻击绕过。The fragility of perception fusion is one of the most overlooked challenges: multi-sensor fusion systems (e.g., vision + LiDAR) can still be bypassed by cross-modal attacks even when single-modality defenses are in place.
认知层涵盖指令理解（instruction understanding）、世界模型（world models）和推理（reasoning）的安全漏洞。
大语言模型（LLM）和视觉语言动作模型（VLA）在此层面面临prompt injection、幻觉（hallucination）利用等独特威胁。The cognition layer covers safety vulnerabilities in instruction understanding, world models, and reasoning. Large language models (LLM) and vision-language-action models (VLA) face distinctive threats at this level, such as prompt injection and the exploitation of hallucination.
规划层涵盖任务规划（task planning）、轨迹规划（trajectory planning）和多智能体协调（multi-agent coordination）的安全问题。
越狱攻击（jailbreak attacks）对规划系统的不稳定性尤为突出——攻击者可通过精心设计的指令诱导智能体执行危险动作序列。The planning layer covers safety issues in task planning, trajectory planning, and multi-agent coordination. The instability that jailbreak attacks induce in planning systems is especially pronounced: an attacker can use carefully crafted instructions to lead an agent into executing a dangerous action sequence.
此层聚焦机器人控制（robot control）、人机交互（human-agent interaction）和协作（collaboration）安全。
开放场景下的人机交互可信度问题（trustworthiness of human-agent interaction in open-ended scenarios）是当前最紧迫的研究缺口之一。This layer focuses on the safety of robot control, human-agent interaction, and collaboration. The trustworthiness of human-agent interaction in open-ended scenarios is one of the most pressing research gaps today.
随着具身智能体获得工具使用（tool use）、记忆（memory）和自演化（self-evolving）能力，新的系统级风险涌现，包括跨系统的级联风险（cascading risks）和供应链攻击。As embodied agents acquire tool use, memory, and self-evolving capabilities, new system-level risks emerge, including cross-system cascading risks and supply-chain attacks.
综述全局概览图：展示具身智能安全研究的攻击类型（adversarial, backdoor, jailbreak, hardware-level）与防御手段（attack detection, safe training, robust inference, risk-aware interaction）在五层体系中的分布，以及与视觉、语言、多模态基础模型进展的关联。Global overview of the survey: it shows how attack types (adversarial, backdoor, jailbreak, hardware-level) and defenses (attack detection, safe training, robust inference, risk-aware interaction) in embodied AI safety research are distributed across the five-layer taxonomy, and how they relate to progress in vision, language, and multimodal foundation models.
Robust inference：推理时平滑（randomized smoothing）、输入净化（input purification）、集成防御Robust inference: randomized smoothing at inference time, input purification, and ensemble defenses
本综述通过系统收集与分类558篇论文，揭示了具身智能安全领域的研究分布、空白与三大被忽视的核心挑战。By systematically collecting and classifying 558 papers, this survey reveals the distribution of research, the remaining blank spots, and three overlooked core challenges in embodied AI safety.
能力层Capability layer
论文数量Number of papers
主要攻击类型Main attack types
研究成熟度Research maturity
感知（Perception）Perception
199
对抗样本、传感器欺骗Adversarial examples, sensor spoofing
较成熟Relatively mature
行动与交互（Action & Interaction）Action & Interaction
112
控制劫持、人机交互操控Control hijacking, manipulation of human-agent interaction
综述明确指出当前领域存在三个严重被低估的研究缺口（verbatim from paper）：The survey explicitly points out three severely underestimated research gaps in the field (verbatim from paper):
"The fragility of multimodal perception fusion, the instability of planning under jailbreak attacks, and the trustworthiness of human–agent interaction in open-ended scenarios."
多模态感知融合的脆弱性Fragility of Multimodal Perception Fusion
现有对抗防御大多针对单一模态（图像或点云），而多传感器融合系统在面对跨模态协同攻击时防御能力严重不足。
例如，视觉-LiDAR融合的自动驾驶系统可被针对两个模态不一致性设计的攻击轻易绕过单模态防御。Most existing adversarial defenses target a single modality (images or point clouds), whereas multi-sensor fusion systems remain seriously under-defended against coordinated cross-modal attacks. An autonomous-driving system fusing vision and LiDAR, for example, can easily have its single-modality defenses bypassed by attacks designed around the inconsistency between the two modalities.
越狱攻击下规划的不稳定性Instability of Planning under Jailbreak Attacks
基于LLM/VLA的任务规划器对越狱攻击高度敏感。攻击者可通过精心构造的自然语言指令绕过安全约束，诱导智能体执行本不应执行的危险动作，且防御手段明显滞后于攻击方法的演进速度。Task planners built on LLM/VLA are highly sensitive to jailbreak attacks. An attacker can bypass safety constraints with carefully constructed natural-language instructions and induce the agent to perform dangerous actions it should never execute, while defenses clearly lag behind the pace at which attack methods evolve.
开放场景下人机交互的可信度Trustworthiness of Human-Agent Interaction in Open Scenarios
在复杂、开放的真实场景中，人机交互（human-agent interaction）面临身份欺骗、意图误判和社会工程学攻击等独特挑战。
现有研究大多在受控环境中进行，缺乏对开放世界动态条件下人机信任机制的系统性研究。In complex, open-ended real-world scenarios, human-agent interaction faces distinctive challenges such as identity spoofing, intent misjudgment, and social-engineering attacks. Most existing studies are conducted in controlled environments and lack a systematic investigation of human-agent trust mechanisms under dynamic open-world conditions.
综述识别了多个关键研究空白：The survey identifies several critical research blanks:
跨层级级联攻击（cross-layer cascading attacks）的系统性建模方法缺失A systematic modeling methodology for cross-layer cascading attacks is missing
具身AI专用安全评估基准（safety benchmark）匮乏，现有基准多来自数字AI领域Safety benchmarks dedicated to embodied AI are scarce; most existing benchmarks come from the digital AI domain
物理世界中的可迁移性：数字空间的对抗样本在真实物理环境中的有效性和防御策略尚不明确Transferability in the physical world: the effectiveness of digital-space adversarial examples in real physical environments, and the defenses against them, remain unclear
安全与性能的权衡（safety-capability tradeoff）缺乏统一的理论框架The safety-capability tradeoff lacks a unified theoretical framework
04局限性 · LimitationsLimitations
Note:本综述未设独立局限性章节。以下各点综合作者明确说明（stated）与从研究设计推断（inferred）的内容，并逐条标注。This survey has no dedicated limitations section. The points below combine what the authors state explicitly (stated) with what is inferred from the study design (inferred), labeled item by item.
覆盖范围的主观性（inferred）Subjectivity of the coverage (inferred)
尽管收录了558篇论文，综述的论文遴选标准和分类边界不可避免地带有主观性。
部分跨学科工作（如自动驾驶安全、医疗机器人伦理）可能被归入或排除在外，读者需结合各子领域的专门综述使用本文。Although 558 papers are included, the survey's selection criteria and classification boundaries inevitably carry a degree of subjectivity. Some interdisciplinary work (such as autonomous-driving safety or medical-robot ethics) may be included or left out, so readers should use this survey together with the dedicated reviews of each subfield.
快速演进导致的时效性问题（inferred）Timeliness affected by rapid evolution (inferred)
具身AI安全领域发展极为迅速，新攻击手段（尤其是针对VLA和多模态LLM的越狱攻击）层出不穷。
综述内容（截至2026年5月修订）可能在数月内即出现显著新工作，需定期更新配套的
Awesome列表才能保持时效性。The field of embodied AI safety is evolving extremely fast, and new attack techniques — jailbreak attacks against VLA and multimodal LLM in particular — keep appearing. The content of the survey (revised as of May 2026) may be overtaken by significant new work within months, so the accompanying Awesome list has to be updated regularly to stay current.
防御方法的实际部署评估不足（inferred）Insufficient evaluation of defenses in real deployment (inferred)
综述中大多数防御方法在受控实验环境中验证，其在真实物理部署条件下（传感器噪声、计算资源限制、实时性要求）的有效性和鲁棒性尚缺乏系统性评估。
从实验室防御到实际部署之间的"最后一公里"问题是关键研究缺口。Most defenses covered in the survey are validated in controlled experimental environments; their effectiveness and robustness under real physical deployment conditions (sensor noise, limited computing resources, real-time requirements) still lack systematic evaluation. The last-mile problem between laboratory defenses and practical deployment is a key research gap.
认知层研究相对薄弱（stated + inferred）Research on the cognition layer is comparatively weak (stated + inferred)
认知层（Cognition）仅收录38篇论文，是五层中最薄弱的。
综述本身也承认，针对具身智能体世界模型和推理模块的安全研究是目前最欠缺的方向之一，
呼吁未来工作在此方向加大投入。The cognition layer collects only 38 papers, making it the weakest of the five layers. The survey itself also acknowledges that safety research on the world models and reasoning modules of embodied agents is among the most under-explored directions today, and calls for greater investment in future work.
