aiqbench analysis
This study establishes a critical safety baseline by demonstrating that state-of-the-art learning-based surgical robotics policies are highly vulnerable to imperceptible visual perturbations, which can reduce task success rates by an average of 61%. The research validates these risks through 560 physical experiments using photometric attacks that mimic natural lighting variations, highlighting a significant gap between current model robustness and the safety requirements for clinical deployment. For the robotics community, these findings underscore the urgent need for adversarial defense mechanisms before such AI systems can be trusted in life-critical environments.
Adversarial Attacks on Learned Policies for Surgical Robotic Tasks
arXiv:2606.11535v1 Announce Type: new Abstract: Learning-based policies are being considered to augment the dexterity of human surgeons in robot-assisted surgery. Can the end-to-end mapping from visual observations to robot actions be vulnerable to adversarial attacks, potentially leading to patient injury? In this paper, we present the first study of adversarial threats to learning-based policies in surgical robotics. We investigate two threat modes: (a) disruptive attacks, where imperceptible visual perturbations interrupt policy execution, and (b) steering attacks, where such perturbations steer policy actions toward attacker-specified directions. We formulate three adversarial attack methods, each with increasing access to policy information, and evaluate their impact on two surgical subtasks: debridement and suturing. Our evaluation covers three end-to-end policy architectures: ACT, Diffusion Policy, and Pi0. In addition, we introduce a new class of photometric adversarial attacks that mimic natural visual changes, such as lighting variations, to generate effective yet visually plausible perturbations. Results from 560 physical experiments using phantoms for debridement and suturing suggest that state-of-the-art policies can be significantly disrupted, resulting in an average 61% reduction in surgical subtask success rates. Project page: https://sites.google.com/view/adversary-surgery
Abstract:Learning-based policies are being considered to augment the dexterity of human surgeons in robot-assisted surgery. Can the end-to-end mapping from visual observations to robot actions be vulnerable to adversarial attacks, potentially leading to patient injury? In this paper, we present the first study of adversarial threats to learning-based policies in surgical robotics. We investigate two threat modes: (a) disruptive attacks, where imperceptible visual perturbations interrupt policy execution, and (b) steering attacks, where such perturbations steer policy actions toward attacker-specified directions. We formulate three adversarial attack methods, each with increasing access to policy information, and evaluate their impact on two surgical subtasks: debridement and suturing. Our evaluation covers three end-to-end policy architectures: ACT, Diffusion Policy, and Pi0. In addition, we introduce a new class of photometric adversarial attacks that mimic natural visual changes, such as lighting variations, to generate effective yet visually plausible perturbations. Results from 560 physical experiments using phantoms for debridement and suturing suggest that state-of-the-art policies can be significantly disrupted, resulting in an average 61% reduction in surgical subtask success rates. Project page: this https URL
Robotics (cs.RO)
arXiv:2606.11535 [cs.RO]
(or arXiv:2606.11535v1 [cs.RO] for this version)
https://doi.org/10.48550/arXiv.2606.11535 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 271 words
Related coverage
Adversarial Vulnerabilities of Learned Telesurgery Policies
arXiv · Sep 29, 2026
Test-time Adversarial Takeover: A Real-time Hijacking Interface against Robotic Diffusion Policies
arXiv · Jun 10, 2026
The Alignment Problem: Computer Science Meets Analytic Philosophy
LessWrong · Oct 18, 2026
Links #3: 2026/06 Part 1
LessWrong · Jun 15, 2026