As artificial intelligence moves from digital assistants to physical machines like autonomous vehicles, drones, and service robots, ensuring safety becomes a critical challenge. A new survey published in the journal Machine Intelligence Research provides a detailed map of the security and ethical risks posed by vision-language models (VLMs) and vision-language-action models (VLAs) that guide these embodied systems. The review, conducted by researchers from the Institute of Automation, Chinese Academy of Sciences, University College London, Minzu University of China, and the China Academy of Electronics and Information Technology, highlights how a mistaken description or manipulated command can lead to physical harm.
The study, available online with DOI: 10.1007/s11633-025-1626-x, examines the chain of dependency in embodied intelligence (EI). VLMs connect images with text, while VLAs extend this to robot plans and control signals, enabling natural-language instruction and flexible task execution. However, this creates vulnerabilities: flawed data can distort perception, weak visual-language alignment can produce hallucinations, and malicious inputs can redirect decisions. In a chatbot, such errors might generate misinformation; in an autonomous vehicle or industrial robot, they could lead to collisions or failed missions.
The researchers organized the major security threats into categories including hallucinations, synthetic forgeries, adversarial attacks, privacy leakage, and unsafe execution. They also demonstrated how failures can cascade across perception, planning, instruction following, and human-robot interaction. For instance, biased training data or poor cross-modal alignment can make a model describe objects that are not present. Forged traffic signs, altered labels, or cloned voices can misguide perception and planning. Tiny adversarial perturbations, hidden backdoor triggers, and multimodal jailbreak prompts may bypass safety controls, while persistent sensing can expose identity, location, and personal behavior.
To counter these threats, the review proposes layered defenses that follow the entire path from sensor input to model reasoning, system architecture, and physical execution. These include hallucination filtering, cross-modal forgery detection, defenses against adversarial attacks, privacy-preserving techniques like differential privacy and homomorphic encryption, and safeguards for navigation and physical control. Additionally, the authors emphasize the importance of interpretability, intent alignment, and risk assessment so robots can handle ambiguous instructions and correct actions when needed.
The central insight is that no single filter can secure an embodied agent; protection must be combined and adaptive. The authors stress that the challenge is not just making models more accurate but ensuring safety when sensors, language inputs, and operating conditions are imperfect. They call for transparent risk metrics, continuous monitoring, and human oversight for critical decisions. A trustworthy robot must explain its actions, recognize uncertainty, and fall back safely instead of acting with false confidence.
For developers and regulators, the survey offers a practical checklist for evaluating embodied systems before deployment. Future platforms could combine interpretable reasoning, attack detection, privacy-preserving computation, and dynamic safety controls under reproducible evaluation protocols. The authors advocate for designs that address technical robustness, regulatory alignment, social equity, and environmental sustainability together. This approach could support safer autonomous transport, healthcare assistance, warehouse automation, and collaborative robotics while making responsibility easier to trace when failures occur.
However, the review warns that strong laboratory results may not transfer cleanly to noisy, culturally diverse, and resource-constrained environments. Progress will depend on cross-disciplinary cooperation and testing that measures not only task success but safe behavior under stress. The research appears in the journal's special issue on the security and ethics of generative AI, underscoring the growing importance of these issues as AI becomes more physical.
