A research paper tested “goal insertion” attacks in simulation and on a Unitree G1, with hardware testing limited to an upper-body task and one static obstacle.
Researchers from Arizona State University and Carnegie Mellon University report a way to steer a humanoid toward a collision using normal task requests. Their method, called Siren, inserts a legitimate intermediate goal between the robot’s current task and its destination.
A safety filter sits between the task controller and the robot’s motors. It changes movement commands when the robot approaches an obstacle, but the paper says the tested optimization-based filters mainly solve for the next control step. They do not predict whether that move leaves the robot unable to recover later.
An intermediate goal can change the robot’s position, speed, or body configuration. When the humanoid resumes its original task, the filter may react too slowly—or request a movement beyond the robot’s available control authority. The robot can then collide even though each goal was valid on its own.
The authors evaluated Siren against seven optimization-based safety filters in simulation and on a Unitree G1 humanoid. In one reported search experiment, Siren identified 3,277 attacks across 35 vulnerable scenarios, compared with 1,760 for random search. Each search algorithm received 125 simulation trials.
The physical test reproduced the same qualitative failure on hardware, including a reported collision. It covered an upper-body task with one static obstacle, not full-body work or dynamic surroundings.
The threat model also assumes the attacker knows the deployed filter, its settings, the environment layout, and the target task. The researchers do not know how often such opportunities occur in ordinary tasks and environments.
For operators, the practical question is whether task schedulers and safety controllers can check the whole queued sequence—not just the next move—before execution.