As artificial intelligence (AI) moves beyond screens into cars, drones, service robots and collaborative machines, a new survey published in Machine Intelligence Research highlights the security and ethical risks when vision-language models guide these embodied systems. The review, led by researchers from the Institute of Automation, Chinese Academy of Sciences, University College London, Minzu University of China, and the China Academy of Electronics and Information Technology, connects failures across perception, planning, instruction following and human-robot interaction. It underscores that a mistaken description or manipulated command can become a physical action, making robust safeguards essential.
Vision-language models (VLMs) link images with text, while vision-language-action models (VLAs) extend that to robot plans and control signals. These technologies enable natural-language instruction and flexible task execution, but they also create a chain of dependency. Flawed data can distort perception, weak visual-language alignment can produce hallucinations, and malicious inputs can redirect decisions. In a chatbot, such errors may generate misinformation; in an autonomous vehicle or industrial robot, they may lead to collisions or damaged equipment. Existing safeguards are often benchmark-specific, fragmented, or too computationally costly for real-time use, prompting the need for unified and adaptive defenses.
The survey, published online on July 13, 2026, with DOI 10.1007/s11633-025-1626-x, organizes security threats and defensive approaches across four functions: perception, planning, instruction following, and human-robot interaction. It shows how failures can cascade. Biased training data or weak encoders can cause models to describe objects that are not present. Forged traffic signs or cloned voices can misguide perception. Adversarial perturbations and multimodal jailbreak prompts may bypass safety controls, while persistent sensing can expose identity and location. Countermeasures are organized into connected layers, including hallucination filtering, cross-modal forgery detection, defenses against perturbations, privacy-preserving computation, and safeguards for physical control.
The authors emphasize that no single filter can secure an embodied agent. Protection must follow the entire path from sensor input to model reasoning to physical execution. They advocate for combined defenses, transparent risk metrics, continuous monitoring, and human oversight for critical decisions. A trustworthy robot must explain its actions, recognize uncertainty, and fall back safely. Technical progress must move alongside privacy protection, fairness, accountability, and responsible governance.
For developers and regulators, the survey provides a practical checklist for evaluating embodied systems before deployment. Future platforms could combine interpretable reasoning, attack detection, privacy-preserving computation, and dynamic safety controls. The authors call for designs that address technical robustness, regulatory alignment, social equity, and environmental sustainability together. Such an approach could support safer autonomous transport, healthcare assistance, warehouse automation, and collaborative robotics, while making responsibility easier to trace. The review also warns that laboratory results may not transfer to noisy, culturally diverse, and resource-constrained environments, stressing the need for cross-disciplinary testing that measures safe behavior under stress.
