As artificial intelligence moves from digital interfaces into the physical world, the stakes rise significantly. A new survey published in the journal Machine Intelligence Research examines the security and ethical risks when vision-language models (VLMs) and vision-language-action models (VLAs) guide embodied systems such as autonomous vehicles, drones, service robots, and industrial machines. These systems can perceive, reason, and act, but they also introduce vulnerabilities where errors can translate into physical harm.
The review, conducted by researchers from the Institute of Automation, Chinese Academy of Sciences; University College London; Minzu University of China; and the China Academy of Electronics and Information Technology, maps the failure points across perception, planning, instruction following, and human-robot interaction. It identifies risks including hallucinations, synthetic forgeries, adversarial attacks, privacy leakage, and unsafe execution. For instance, a model might describe objects that do not exist due to biased training data or weak cross-modal alignment, leading a robot to make wrong decisions. Maliciously crafted inputs, such as forged traffic signs or cloned voices, can manipulate perception and planning, while tiny adversarial perturbations or hidden backdoors may bypass safety controls.
The authors emphasize that these risks are not isolated. In a chatbot, errors may result in misinformation; in an autonomous vehicle or industrial robot, they may lead to collisions, damaged equipment, or failed missions. Existing safeguards are often benchmark-specific, fragmented, or too computationally heavy for real-time use. The survey calls for unified, adaptive defenses that cover the entire pipeline from sensor input to physical action.
To counter these threats, the researchers organize defensive strategies into connected layers. These include hallucination filtering and vision-grounded alignment to improve perception accuracy; cross-modal forgery detection, watermarking, and provenance tracing to verify authenticity; defenses against adversarial perturbations, backdoors, and jailbreaks; privacy-preserving techniques such as differential privacy, secure multi-party computation, and homomorphic encryption; and safeguards for navigation, communications, and physical control. Additionally, they propose using causal explanations, intent alignment, and risk assessment to help robots interpret ambiguous instructions, anticipate hazards, and correct actions.
The central insight is that no single filter can secure an embodied agent. Protection must follow the entire path from sensor input to model reasoning, system architecture, and physical execution. The authors argue that the challenge is not just making models more accurate but ensuring systems remain safe when sensors, language inputs, and operating conditions are imperfect. They advocate for combining defenses rather than deploying isolated patches, with transparent risk metrics, continuous monitoring, and human oversight for critical decisions.
For developers and regulators, the survey provides a practical checklist for evaluating embodied systems before large-scale deployment. Future platforms could integrate interpretable reasoning, attack detection, privacy-preserving computation, and dynamic safety controls under reproducible, open evaluation protocols. The authors call for designs that address four dimensions together: technical robustness, regulatory alignment, social equity, and environmental sustainability.
Such an approach could support safer autonomous transport, healthcare assistance, warehouse automation, industrial inspection, and collaborative robotics, while making responsibility easier to trace when failures occur. However, the review warns that strong laboratory results may not transfer cleanly to noisy, culturally diverse, and resource-constrained environments. Progress depends on cross-disciplinary cooperation and testing that measures not only task success but safe behavior under stress.
The study is published with the DOI 10.1007/s11633-025-1626-x and appears in a special issue on the security and ethics of generative AI. The research was partially supported by the National Natural Science Foundation of China, the Strategic Priority Research Program of the Chinese Academy of Sciences, and the Engineering and Physical Sciences Research Council (EPSRC) in the UK.
