"Your Robot Was Trained on a Lie": Collision Mesh Poisoning Attacks on Robotic Manipulation

Published September 18, 2026 · Category: Robotics

Overview

arXiv:2609.18122v1 Announce Type: cross Abstract: Learning-enabled robotic manipulation increasingly relies on robot simulators for policy training and evaluation before real-world deployment. Inside a simulator, a 3D asset contains two separate geometries: a visual mesh used for rendering and a collision mesh used for physical interaction. For computational efficiency, the collision mesh is deliberately a coarse approximation that need not have the same geometry as the visual mesh, a legitimate and pervasive discrepancy we call the Visual--Collision Gap (V--C Gap). We show that the V--C Gap opens a new and practical attack surface, and propose Collision Mesh Poisoning (CMP), the first poisoning attack against robotic manipulation delivered through the 3D asset supply chain. An attacker modifies only the collision mesh of a 3D asset, leaving the visual mesh and all other components unchanged. A policy trained and evaluated with the poisoned asset behaves normally throughout simulation, yet degrades, fails, or creates physical safety risks once deployed in the real world. Since current asset review practices cover malware, copyright, and format compliance, but not visual--collision consistency, poisoned assets can be distributed through legitimate supply chain channels. We evaluate several defenses and our results show that they are insufficient to defend against CMP, highlighting the need for new defenses.

Source

Originally published at arxiv.org.

Related Articles

• GAVEL: Graph World Models for Verified and Efficient Long-Horizon LLM Task Planning
• Time-Efficient Iterative Learning Planning for Safety-Critical Dynamic Obstacle Avoidance
• MoWAM: Explicit Future Motion Prediction for Efficient World Action Models