Phantom Force: EMI Attack Fools Robot Tactile Sensors into 9x Perceived Grip Force

Forum topic · 二一 · 2026-05-14

Summary

A new attack called 'Phantom Force' targets Hall-effect-based tactile sensors used in embodied AI robots. By injecting external electromagnetic interference (EMI), attackers can make Hall sensors perceive forces that do not exist. Experiments show perceived force can be amplified over 9x, inferred force direction deviates by up to 65 degrees, and learning-based tactile classification models can be completely disabled. In practice, a robot might crush a fragile component it believes requires a stronger grip, or drop a hazardous container it perceives as weightless. Because the injected magnetic field is physically indistinguishable from legitimate field changes caused by real contact, there is no sensor-level defense today. The paper, 'Phantom Force: Injecting Adversarial Tactile Perceptions into Embodied Intelligence via EMI' by Zirui Kong, Youqian Zhang, and Sze Yiu Chau, will appear at ACM ASIA CCS 2026 (arXiv:2605.13492), highlighting that AI security must extend beyond model jailbreaks to physical attack surfaces in any field-based sensing modality, including capacitive, inductive, and magnetic sensors.

While most AI safety discussions focus on model jailbreaks and harmful outputs, a far more alarming class of attacks targets robotic tactile systems. A new attack injects "phantom forces" via electromagnetic interference, making a robot believe it is gently holding an egg while it is actually crushing an object with 9 times the intended force.

Hall Effect: The Fatal Weakness of Tactile Sensors

Embodied intelligence robots rely on tactile sensors to interact with the physical world. The most popular class of fingertip sensors is based on the Hall effect: a small magnet is embedded in a flexible material, and when the finger contacts an object, the magnet's position shifts slightly. The sensor measures the resulting magnetic field change to compute the magnitude and direction of the applied force.

Hall-effect sensors are cheap, durable, and sensitive to force and tiny deformations. The only problem: their operating principle is measuring a magnetic field. And a magnetic field can be injected from outside.

Researchers found that via directional electromagnetic interference signal injection, Hall sensors can be tricked into perceiving forces that do not exist at all. They call these "phantom forces."

Attack Effects

Experiments demonstrate:

Perceived force amplified by over 9x
Inferred force direction deviating by 65 degrees
Learning-based tactile classification models completely disabled
Robots taking dangerous actions because they "feel" forces that shouldn't exist

Concrete scenario: a robot arm is grasping a delicate electronic component. From several meters away, an attacker injects signals with an electromagnetic emitter. The sensor tells the control system: "I'm under enormous pressure! The object is hard, grip harder!" The robot then tightens its grip with over 9 times normal force — crushing the component.

In another scenario: a robot is carrying a hazardous chemical container. Under interference, the sensor reports "force is very small, the object is light as a feather." The robot relaxes its grip — the container drops.

Why Nobody Noticed Before

Adversarial attacks on vision have been studied for years — special patterns fooling cameras, self-driving cars misclassifying pedestrians, face recognition confusing person A with person B. But tactile attacks went unstudied. The reason was simple: touch was considered a "physical" process — the force is real, not as easily reprogrammed as vision.

That was wrong. If your sensor is based on electromagnetic fields and an attacker can inject artificial fields into it, then a "real force" and a "phantom force" are completely indistinguishable at the sensor level. There is no physical difference — both are magnetic field changes.

Takeaways

This is a physical attack exploiting physical principles against a physical sensor. Elegant, direct, and with no existing defense.

It reminds us that AI security cannot focus only on model "alignment" and "jailbreaks." When an AI system is connected to the physical world — sensors, actuators, materials — vulnerabilities can exist at any physical interface. Hall sensors are just one example. Any sensor based on external fields — capacitive, inductive, magnetic — is theoretically vulnerable.

The paper was accepted at ACM ASIA CCS 2026, a top computer security conference, showing the security community is taking the physical attack surface of embodied intelligence seriously.

Reference Paper

Zirui Kong, Youqian Zhang, Sze Yiu Chau. "Phantom Force: Injecting Adversarial Tactile Perceptions into Embodied Intelligence via EMI." ACM ASIA CCS 2026, arXiv:2605.13492.