Most AI safety discussions focus on jailbreaks making models say dangerous things. This post argues the scarier attacks target the physical layer: a new attack injects "phantom forces" into robot tactile systems via electromagnetic interference (EMI), making a robot believe it is gently holding an egg while actually squeezing with 9 times the intended force.
The vulnerability: Hall-effect tactile sensors
Many fingertip sensors in embodied AI robots are based on the Hall effect: a small magnet embedded in flexible material shifts slightly on contact, and the sensor measures magnetic field changes to compute force magnitude and direction. These sensors are cheap, durable, and sensitive — but they work by measuring magnetic fields, and magnetic fields can be injected externally.
Researchers show that directed EMI signal injection can make Hall sensors perceive forces that do not exist — "phantom forces."
Attack effects
Experiments demonstrate:
- Perceived force amplified by more than 9x
- Inferred force direction deviating by 65 degrees
- Learning-based tactile classification models fully disabled
- Robots performing dangerous actions in response to forces that do not exist
- A robot arm grips a precision electronic component. An attacker injects signals from several meters away. The sensor reports enormous pressure, so the robot tightens with 9x normal force — crushing the component.
- A robot carries a hazardous chemical container. Interference makes the sensor report a feather-light force; the robot loosens its grip and drops the container.
Example scenarios:
Why this went unnoticed
Adversarial attacks on vision (fooling cameras, autonomous driving perception, face recognition) have been studied for years, but tactile attacks were assumed impractical because touch seemed like an inherently "physical" process. That assumption is wrong: if the sensor works on electromagnetic fields and attackers can inject artificial fields, real and phantom forces are indistinguishable at the physics level — both are just magnetic field changes.
Takeaways
This is a physical attack exploiting physics to attack a physical sensor, with no existing defense. AI safety must extend beyond model alignment and jailbreaks: any sensor based on external fields — capacitive, inductive, magnetic — is theoretically vulnerable. The paper's acceptance at ACM ASIA CCS 2026 shows the security community is taking embodied intelligence's physical attack surface seriously.
Reference paper
Zirui Kong, Youqian Zhang, Sze Yiu Chau. "Phantom Force: Injecting Adversarial Tactile Perceptions into Embodied Intelligence via EMI." ACM ASIA CCS 2026, arXiv:2605.13492.