The integration of artificial intelligence into physical systems—autonomous vehicles, drones, and service robots—introduces a new dimension of safety concerns, as errors in perception or instruction can lead to real-world consequences. A comprehensive review published in Machine Intelligence Research examines the security and ethical risks when vision-language models (VLMs) and vision-language-action models (VLAs) guide embodied systems. The study, conducted by researchers from the Institute of Automation, Chinese Academy of Sciences, University College London, Minzu University of China, and the China Academy of Electronics and Information Technology, maps failures across perception, planning, instruction following, and human-robot interaction, and outlines defense mechanisms to mitigate these risks.
The review highlights that VLMs connect images with text, while VLAs extend this to robot plans and control signals, enabling natural-language instruction and flexible task execution. However, this capability creates a dependency chain: flawed data can distort perception, weak visual-language alignment can cause hallucinations, and malicious inputs can redirect decisions. In a chatbot, such errors might generate misinformation; in an autonomous vehicle or industrial robot, they could lead to collisions, equipment damage, or mission failure. Existing safeguards are often benchmark-specific, fragmented, or too computationally expensive for real-time use, necessitating unified and adaptive protections.
The team organized the major security threats into categories: biased training data, weak visual encoders, poor cross-modal alignment, forged traffic signs, altered labels, cloned voices, deceptive captions, adversarial perturbations, hidden backdoor triggers, and multimodal jailbreak prompts. These can bypass safety controls, while persistent sensing may expose identity, location, possessions, and social behavior. The authors propose layered countermeasures, including hallucination filtering, vision-grounded alignment, cross-modal forgery detection, watermarking, provenance tracing, defenses against perturbations and backdoors, differential privacy, secure multi-party computation, homomorphic encryption, and safeguards for navigation and physical control. They also emphasize causal explanations, intent alignment, and risk assessment to help robots interpret ambiguous instructions and anticipate hazards.
The central insight is that no single filter can secure an embodied agent; protection must follow the entire path from sensor input to model reasoning, system architecture, and physical execution. The authors argue that the challenge is not just making models more accurate but ensuring safety when sensors, language inputs, and operating conditions are imperfect. They advocate for combining defenses, transparent risk metrics, continuous monitoring, and human oversight for critical decisions. A trustworthy robot should explain its actions, recognize uncertainty, and fall back safely rather than acting with false confidence.
For developers and regulators, the survey provides a practical checklist for evaluating embodied systems before deployment. Future platforms could integrate interpretable reasoning, attack detection, privacy-preserving computation, and dynamic safety controls under reproducible, open evaluation protocols. The authors call for designs addressing technical robustness, regulatory alignment, social equity, and environmental sustainability. Such an approach could support safer autonomous transport, healthcare assistance, warehouse automation, industrial inspection, and collaborative robotics while making responsibility easier to trace. The review also warns that laboratory results may not transfer to noisy, culturally diverse, and resource-constrained environments, so cross-disciplinary cooperation and stress testing are essential.
The full review is available in the journal's special issue on security and ethics of generative AI, with DOI: 10.1007/s11633-025-1626-x. Funding was provided by the National Natural Science Foundation of China, the Strategic Priority Research Program of the Chinese Academy of Sciences, and the Engineering and Physical Sciences Research Council (EPSRC) of the UK.
