Phantom Force: EMI Attack Injects 9x Fake Forces into Robotic Tactile Sensors

Forum topic · 二一 · 2026-05-14

Summary

A new attack presented at ACM ASIA CCS 2026 targets robot tactile sensing rather than language models. Many robotic fingertip sensors rely on the Hall effect: a small magnet embedded in flexible material shifts under force, and magnetic field changes are converted into force readings. Researchers Zirui Kong, Youqian Zhang, and Sze Yiu Chau show that directional electromagnetic interference (EMI) can inject magnetic fields indistinguishable from genuine physical deformation, creating 'phantom forces.' In experiments, perceived forces were amplified over 9x, inferred force directions deviated by up to 65 degrees, and learned tactile classification models were fully disabled. Consequences include a robot crushing a delicate component while believing it holds an egg softly, or dropping a hazardous chemical container after sensing near-zero force. The key insight: sensors based on external fields (Hall, capacitive, inductive, magnetic) cannot physically distinguish real forces from injected fields. The paper, 'Phantom Force: Injecting Adversarial Tactile Perceptions into Embodied Intelligence via EMI' (arXiv:2605.13492), highlights a neglected physical attack surface of embodied AI beyond model jailbreaks and alignment.

Phantom Force: Fooling a Robot's Hand with Electromagnetic Waves

When people discuss AI safety, they usually mean "a jailbroken model saying dangerous things." The truly frightening attacks lie elsewhere.

A new attack targets the tactile system of robots — using electromagnetic interference to inject "phantom forces," making a robot believe it is gently holding an egg while it is actually squeezing with 9 times the intended force.

---

The Hall Effect: A Fatal Weakness in Tactile Sensors

Embodied intelligence robots rely on tactile sensors to interact with the physical world. The most popular class of fingertip sensors is based on the Hall effect: a small magnet embedded in flexible material shifts slightly when the finger contacts an object, and the sensor measures magnetic field changes to compute the magnitude and direction of applied force.

Hall effect sensors are cheap, durable, and sensitive to force and tiny deformations. The only problem: they work by measuring magnetic fields. And magnetic fields can be injected from outside.

Researchers found that via directional electromagnetic interference (EMI) signal injection, a Hall sensor can be tricked into perceiving forces that do not exist at all. They call these "phantom forces."

---

Attack Effects

Experiments demonstrate:

Perceived force amplified by over 9x
Inferred force direction deviating by 65 degrees
Learning-based tactile classification models fully disabled
Robots taking dangerous actions because they "feel" forces that should not exist

Concrete scenario: a robotic arm is grasping a precision electronic component. From a few meters away, an attacker injects signals with an EM transmitter. The sensor tells the control system: "I'm under enormous pressure! The object is rigid, grip harder!" The robot then squeezes with up to 9x the normal force — crushing the component.

In another scenario: a robot is transporting a hazardous chemical container. Under interference, the sensor reports "very small force, the object is light as a feather." The robot relaxes its grip — and the container drops.

---

Why Nobody Noticed Before

Adversarial attacks on vision have been studied for years — special patterns fooling cameras, self-driving cars misclassifying pedestrians, face recognition misidentifying people. But tactile attacks went unexplored. The reason was simple: touch was considered a "physical" process — force is real, not as easily reprogrammed as vision.

But that's wrong. If your sensor is based on an electromagnetic field principle, and an attacker can inject an artificial field into it, then "real force" and "phantom force" are completely indistinguishable at the sensor level. There is no physical difference — both are magnetic field changes.

---

Commentary

This is a physical attack exploiting physics to attack a physical sensor. Elegant, direct, and currently without any off-the-shelf defense.

It reminds us that AI safety cannot focus only on model "alignment" and "jailbreaks." Once an AI system is connected to the physical world — sensors, actuators, materials — vulnerabilities can exist at any physical interface. Hall sensors are just one example. Any sensor based on external fields — capacitive, inductive, magnetic — is theoretically vulnerable.

The paper was accepted at ACM ASIA CCS 2026, a top computer security conference — a sign that the security community is taking "physical attack surfaces of embodied intelligence" seriously.

---

Reference Paper

Zirui Kong, Youqian Zhang, Sze Yiu Chau. "Phantom Force: Injecting Adversarial Tactile Perceptions into Embodied Intelligence via EMI." ACM ASIA CCS 2026, arXiv:2605.13492.