"Your Robot Was Trained on a Lie": Collision Mesh Poisoning Attacks on Robotic Manipulation

2026-09-16

AI Summary

本文探讨了通过修改3D资产的碰撞网格来对机器人操作实施攻击的问题，提出了碰撞网格投毒(CMP)方法，并指出当前防御手段不足。

Abstract

Learning-enabled robotic manipulation increasingly relies on robot simulators for policy training and evaluation before real-world deployment. Inside a simulator, a 3D asset contains two separate geometries: a visual mesh used for rendering and a collision mesh used for physical interaction. For computational efficiency, the collision mesh is deliberately a coarse approximation that need not have the same geometry as the visual mesh, a legitimate and pervasive discrepancy we call the Visual--Collision Gap (V--C Gap). We show that the V--C Gap opens a new and practical attack surface, and propose Collision Mesh Poisoning (CMP), the first poisoning attack against robotic manipulation delivered through the 3D asset supply chain. An attacker modifies only the collision mesh of a 3D asset, leaving the visual mesh and all other components unchanged. A policy trained and evaluated with the poisoned asset behaves normally throughout simulation, yet degrades, fails, or creates physical safety risks once deployed in the real world. Since current asset review practices cover malware, copyright, and format compliance, but not visual--collision consistency, poisoned assets can be distributed through legitimate supply chain channels. We evaluate several defenses and our results show that they are insufficient to defend against CMP, highlighting the need for new defenses.

Problem

• Visual--Collision Gap
• Collision Mesh Poisoning
• robotic manipulation

Innovation

• Collision Mesh Poisoning
• Visual--Collision Gap
• Robotic Manipulation
• Simulation Training