Robot safety engineering has a long, disciplined history of asking one question: what happens when something breaks? Sensors fail, motors stall, batteries die — and the machine is designed to fail safely anyway. An IEEE Spectrum feature published this week poses a different question, and it’s uncomfortable: what happens when nothing breaks, but an attacker changes what the robot sees, decides or does anyway?
The evidence the feature leans on isn’t hypothetical. In 2017, researchers showed with BadNets that a stop sign wearing a few carefully placed stickers could be classified as a speed limit sign — while the same network kept reading every other stop sign perfectly. The model wasn’t broken. It was loyal to someone else.
Eight years on, the attacks followed the robots. BadVLA, presented at NeurIPS 2025, demonstrated backdoors in vision-language-action models — the architecture now powering commercial humanoids — causing conditioned deviations in a robot’s action trajectories whenever a specific trigger appears. The model behaves normally until the trigger. Then it doesn’t.
The 2025 GoBA paper made the trigger problem mundane: ordinary objects — the paper’s example is a coffee mug — worked as attack triggers with a 97 percent success rate, without degrading the model’s performance on clean inputs. No visible failure. No anomaly to flag. A robot that passes every test can still misbehave every time a mug is on the table.
Then comes the vendor half of the story. The feature is bylined by VicOne, a cybersecurity company focused on automotive and robotics software, and its answer is a product: Radeis, a physical AI safety validator demonstrated on NVIDIA Isaac Sim, which tests adversarial visual inputs against a robot’s behaviour before deployment.
That arrangement deserves the caveat it sounds like. The research citations are checkable and real — BadNets, BadVLA and GoBA are published papers — but the proposed solution comes from the company that wrote the article, and a validator has a structural limit of its own: you cannot test a trigger nobody has imagined yet.
Why it still matters: the industry is putting vision-language-action models into machines that share footpaths and kitchens. Agility’s Digit 5 safety architecture is engineered for accidents — a person walking too close — not for adversarial inputs, which is exactly the gap the feature describes. The US response to untrusted humanoid hardware was to ban it at the border; there is no equivalent filter for a poisoned model running on trusted hardware. And software teams spent this year digesting what a supply-chain attack looks like at scale — physical AI adds a new surface where the payload is an image.
The most interesting thing in the feature isn’t the product. It’s the trajectory of the research: backdoors went from sticker-defaced stop signs in 2017 to household objects as triggers in 2025. The trigger got cheaper while the robots got more autonomous. That gap — between what safety testing assumes and what an adversary can now stage — is the actual story.
