Security and Privacy in Large-Model-Driven Embodied Agents: Attacks, Defenses, and Future Directions
cs.CR
Submitted: 2026-08-19
Updated: 2026-08-19
License: http://creativecommons.org/licenses/by-nc-nd/4.0/
The gist: Large-model-driven embodied agents integrate foundation models with perception, reasoning, planning, and physical action, extending conventional model-level risks into embodied closed loops.
Terminology
Abstract
Large-model-driven embodied agents integrate foundation models with perception, reasoning, planning, and physical action, extending conventional model-level risks into embodied closed loops. Existing studies on their security and privacy remain fragmented across different system components and operational stages, making it difficult to understand how risks arise, propagate, and ultimately affect physical behavior or sensitive information. This survey presents a lifecycle-based analysis of security and privacy in large-model-driven embodied agents. We organize existing research into five stages: model construction and supply chain, multimodal input and interaction, semantic reasoning and task planning, action execution and physical feedback, and long-term deployment. Within this lifecycle, we systematically review representative attacks, defenses, and evaluation methods. Our analysis shows that attack entry, consequence realization, and defense intervention often occur at different stages of the embodied closed loop. It further reveals substantial gaps in end-to-end protection, real-world evaluation, and long-term privacy governance. This survey provides a unified perspective for understanding current progress and identifying critical directions for securing large-model-driven embodied agents.
Sources
- The Safety Challenge of World Models for Embodied AI Agents: A Review
- CHAI: Command Hijacking against embodied AI
- SafeMind: Benchmarking and Mitigating Safety Risks in Embodied LLM Agents
- HazardArena: Evaluating Semantic Safety in Vision-Language-Action Models
- Manipulation Facing Threats: Evaluating Physical Vulnerabilities in End-to-End Vision Language Action Models
- MinD: Learning A Dual-System World Model for Real-Time Planning and Implicit Risk Analysis
- SafeGen-LLM: Enhancing Safety Generalization in Task Planning for Robotic Systems
- LIBERO-Plus: In-depth Robustness Analysis of Vision-Language-Action Models
- From Words to Safety: Language-Conditioned Safety Filtering for Robot Navigation
- Learning from Mistakes: Post-Training for Driving VLA with Takeover Data
- State Backdoor: Towards Stealthy Real-world Poisoning Attack on Vision-Language-Action Model in State Space
- VLSA: Vision-Language-Action Models with Plug-and-Play Safety Constraint Layer
- SafeManip: A Property-Driven Benchmark for Temporal Safety Evaluation in Robotic Manipulation
- Trust in LLM-controlled Robotics: a Survey of Security Threats, Defenses and Challenges
- A Framework for Benchmarking and Aligning Task-Planning Safety in LLM-Based Embodied Agents
- ANNIE: Be Careful of Your Robots
- Propagating Unsafe Actions in LLM Controlled Multi-Robot Collaboration via Single Robot Compromise
- Can We Trust Embodied Agents? Exploring Backdoor Attacks against Embodied LLM-based Decision-Making Systems
- Adversarial Attacks on Robotic Vision Language Action Models
- Constrained Decoding for Safe Robot Navigation Foundation Models
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills
- Token Composition: A Graph Based on EVM Logs