As artificial intelligence transitions from digital assistants to physical agents like autonomous vehicles, drones, and service robots, the stakes of its errors rise dramatically. A comprehensive review published in Machine Intelligence Research on July 13, 2026, systematically maps the security and ethical risks when vision-language models (VLMs) and vision-language-action models (VLAs) guide embodied systems. The study, conducted by researchers from the Institute of Automation, Chinese Academy of Sciences, University College London, Minzu University of China, and the China Academy of Electronics and Information Technology, underscores that in these systems, a misperception or manipulated command can lead to physical harm, not just misinformation.
The review traces the use of VLMs and VLAs across four critical functions: perception, planning, instruction following, and human-robot interaction. It reveals how failures at any stage can cascade. For instance, biased training data or weak visual-language alignment can cause a model to hallucinate objects, while forged traffic signs or adversarial perturbations can misguide an autonomous vehicle's planning. Privacy risks also emerge from continuous sensing, which may expose personal data such as identity, location, and behavior. The authors argue that these vulnerabilities are not isolated but interconnected, requiring a holistic defense strategy.
To counter these threats, the researchers propose a multi-layered defense framework that spans the entire pipeline from sensor input to physical execution. This includes hallucination filtering, cross-modal forgery detection, defenses against adversarial attacks, and privacy-preserving techniques like differential privacy and homomorphic encryption. Additionally, they emphasize the importance of interpretability and human oversight. A trustworthy robot must be able to explain its actions, recognize uncertainty, and fall back safely when faced with ambiguous instructions or unexpected conditions.
The study's central insight is that no single safeguard suffices. As the authors note, 'the central challenge is not simply making models more accurate, but ensuring that a system remains safe when its sensors, language inputs, and operating conditions are imperfect.' They advocate for combining defenses, implementing transparent risk metrics, and ensuring continuous monitoring. This approach is essential for applications ranging from autonomous transport to healthcare assistance and warehouse automation.
For developers and regulators, the survey offers a practical checklist for evaluating embodied systems before deployment. It calls for designs that address technical robustness, regulatory alignment, social equity, and environmental sustainability. The authors also warn that laboratory successes may not translate to noisy, real-world environments, stressing the need for cross-disciplinary collaboration and stress testing that measures safe behavior under adverse conditions.
The review appears in a special issue of the journal focused on the security and ethics of generative AI, and it was funded by several Chinese and UK research grants (DOI:10.1007/s11633-025-1626-x). As embodied AI becomes more prevalent, this research provides a crucial roadmap for ensuring that these systems are not only capable but also dependable and safe in the physical world.
