VicOne LAB R7 demonstrates ROS 2 message injection and acoustic input attacks bypassing robot safety controllers

VicOne LAB R7 documented two input-manipulation vectors. Text rendered on a poster altered Gemma 4 E4B robot-dog trajectories. Inaudible audio shifted Nemotron hospital-robot behavior on Jetson AGX Orin. Both cases left task definitions unchanged while sensor or message inputs were altered. The tests replicate published VLA patch attacks that reduced success rates and acoustic resonance attacks previously shown on drone gyroscopes.

Safety logic in collaborative robots and humanoids still depends on the same untrusted sensor streams or DDS topics used for control. When an attacker can force agreement between primary and redundant channels, fault-tree probabilities calculated for random failures no longer bound risk. The VicOne mapping shows identical loss-of-control outcomes from accidental fault or crafted input.

Current ISO 10218 and IEC 61508 assessments treat coordinated faults as low-likelihood events. Deliberate, repeatable injection changes that assumption. Redundant sensors require adversarial test cases that exercise shared physical or network attack surfaces rather than independent random failure modes.

Standards bodies are drafting adversarial robustness clauses for robot safety. Manufacturers that ship without input-integrity checks on safety-critical topics face retrofit costs once certification bodies adopt the new test requirements.