Phantom Force: Fooling a Robot's Hand with Electromagnetic Waves
When people discuss AI safety, they usually mean "a jailbroken model saying dangerous things." The truly frightening attacks lie elsewhere.
A new attack targets the tactile system of robots — using electromagnetic interference to inject "phantom forces," making a robot believe it is gently holding an egg while it is actually squeezing with 9 times the intended force.
---
The Hall Effect: A Fatal Weakness in Tactile Sensors
Embodied intelligence robots rely on tactile sensors to interact with the physical world. The most popular class of fingertip sensors is based on the Hall effect: a small magnet embedded in flexible material shifts slightly when the finger contacts an object, and the sensor measures magnetic field changes to compute the magnitude and direction of applied force.
Hall effect sensors are cheap, durable, and sensitive to force and tiny deformations. The only problem: they work by measuring magnetic fields. And magnetic fields can be injected from outside.
Researchers found that via directional electromagnetic interference (EMI) signal injection, a Hall sensor can be tricked into perceiving forces that do not exist at all. They call these "phantom forces."
---
Attack Effects
Experiments demonstrate:
- Perceived force amplified by over 9x
- Inferred force direction deviating by 65 degrees
- Learning-based tactile classification models fully disabled
- Robots taking dangerous actions because they "feel" forces that should not exist
In another scenario: a robot is transporting a hazardous chemical container. Under interference, the sensor reports "very small force, the object is light as a feather." The robot relaxes its grip — and the container drops.
---
Why Nobody Noticed Before
Adversarial attacks on vision have been studied for years — special patterns fooling cameras, self-driving cars misclassifying pedestrians, face recognition misidentifying people. But tactile attacks went unexplored. The reason was simple: touch was considered a "physical" process — force is real, not as easily reprogrammed as vision.
But that's wrong. If your sensor is based on an electromagnetic field principle, and an attacker can inject an artificial field into it, then "real force" and "phantom force" are completely indistinguishable at the sensor level. There is no physical difference — both are magnetic field changes.
---
Commentary
This is a physical attack exploiting physics to attack a physical sensor. Elegant, direct, and currently without any off-the-shelf defense.
It reminds us that AI safety cannot focus only on model "alignment" and "jailbreaks." Once an AI system is connected to the physical world — sensors, actuators, materials — vulnerabilities can exist at any physical interface. Hall sensors are just one example. Any sensor based on external fields — capacitive, inductive, magnetic — is theoretically vulnerable.
The paper was accepted at ACM ASIA CCS 2026, a top computer security conference — a sign that the security community is taking "physical attack surfaces of embodied intelligence" seriously.
---
Reference Paper
Zirui Kong, Youqian Zhang, Sze Yiu Chau. "Phantom Force: Injecting Adversarial Tactile Perceptions into Embodied Intelligence via EMI." ACM ASIA CCS 2026, arXiv:2605.13492.