A comprehensive survey published in Machine Intelligence Research examines the security and ethical risks when vision-language models (VLMs) and vision-language-action models (VLAs) are used in embodied intelligence (EI) systems such as autonomous vehicles, drones, service robots, and collaborative machines. The review, conducted by researchers from the Institute of Automation, Chinese Academy of Sciences, University College London, Minzu University of China, and the China Academy of Electronics and Information Technology, highlights that as AI moves beyond screens into the physical world, a mistaken description or manipulated command can result in physical actions with serious consequences.
VLMs connect images with text, while VLAs extend this to robot plans and control signals, enabling natural-language instruction, scene understanding, and flexible task execution. However, this creates a chain of dependency: flawed data can distort perception, weak visual-language alignment can produce hallucinations, and malicious inputs can redirect decisions. In a chatbot, such errors might cause misinformation, but in an autonomous vehicle or industrial robot, they can lead to collisions, damaged equipment, or failed missions. The authors note that existing safeguards are often benchmark-specific, fragmented across system layers, or too computationally costly for real-time use, necessitating deeper research into unified, adaptive safeguards for multimodal agents in uncertain physical conditions.
The survey tracks VLM and VLA use across four functions: perception, planning, instruction following, and human-robot interaction (HRI). It shows how failures can cascade. Biased training data, weak visual encoders, or poor cross-modal alignment can make a model describe objects that are not present. Forged traffic signs, altered labels, cloned voices, or deceptive captions can misguide perception and planning. Tiny adversarial perturbations, hidden backdoor triggers, and multimodal jailbreak prompts may bypass safety controls, while persistent sensing can expose identity, location, possessions, and social behavior. The authors organize countermeasures into connected layers, including hallucination filtering, vision-grounded alignment, cross-modal forgery detection, watermarking, provenance tracing, defenses against perturbations, backdoors and jailbreaks, differential privacy (DP), secure multi-party computation (SMPC), homomorphic encryption (HE), and safeguards for navigation, communications, and physical control. They also propose using causal explanations, intent alignment, and risk assessment so robots can interpret ambiguous instructions, anticipate hazards, and correct actions. The central insight is that no single filter can secure an embodied agent; protection must follow the entire path from sensor input to model reasoning, system architecture, and physical execution.
The authors state that the central challenge is not simply making models more accurate, but ensuring a system remains safe when its sensors, language inputs, and operating conditions are imperfect. Defenses should be combined rather than deployed as isolated patches, with transparent risk metrics, continuous monitoring, and human oversight for critical decisions. A trustworthy robot must also explain what it is doing, recognize when it is uncertain, and fall back safely instead of acting with false confidence. Technical progress must move alongside privacy protection, fairness, accountability, and responsible governance.
For developers and regulators, the survey provides a practical checklist for evaluating embodied systems before large-scale deployment. Future platforms could combine interpretable reasoning, attack detection, privacy-preserving computation, and dynamic safety controls under reproducible, open evaluation protocols. The authors call for designs that address four dimensions together: technical robustness, regulatory alignment, social equity, and environmental sustainability. Such an approach could support safer autonomous transport, healthcare assistance, warehouse automation, industrial inspection, and collaborative robotics, while making responsibility easier to trace when failures occur. The review also warns that strong laboratory results may not transfer cleanly to noisy, culturally diverse, and resource-constrained environments. Progress will depend on cross-disciplinary cooperation and testing that measures not only task success, but safe behavior under stress.
The full study is available under DOI 10.1007/s11633-025-1626-x. This research was partially supported by the National Natural Science Foundation of China, the Strategic Priority Research Program of Chinese Academy of Sciences, and the Engineering and Physical Sciences Research Council (EPSRC) Funded Grant, UK.
