Adversarial Vulnerabilities of Learned Telesurgery Policies

arXiv:2606.11535 · cs.RO · Submitted 2026-06-10 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Robotics Radio. Generated commentary on the latest robotics and control papers.

Rosa: Today's paper: "Adversarial Vulnerabilities of Learned Telesurgery Policies".

Dev: This paper presents "the first study of adversarial threats to learning-based policies in surgical robotics." It investigates two threat modes: "(a) disruptive attacks,

Rosa: First, who's behind it and why it matters.

Title and authors: Rosa: So, we're talking about the paper "Adversarial Vulnerabilities of Learned Telesurgery Policies," and it really centers on the idea that learning-based policies in surgical robotics can be vulnerable to attacks that could cause harm.

Dev: Exactly; the title itself points out that we need to investigate these threats because they are being considered for augmenting human dexterity in robot-assisted surgery, and the core question is whether this end-to-end mapping from vision to action is vulnerable one.

Taro: And what this means for autonomy is that when the world misbehaves—when an attacker subtly steers the policy's actions toward a specific direction—the system doesn't just fail to complete a task, it can actively execute dangerous maneuvers that could harm patients one.

Rosa: It really puts the pressure on us to move beyond just making models that look good in simulation and start building systems that are inherently resilient against these kinds of physical threats outside of the lab one.

Dev: I think we need to focus on those detection mechanisms we talked about, because if we can't detect the perturbation in real-time, the entire loop rate becomes meaningless when a malicious input is injected one.

Taro: I agree with Dev; a proactive defense that understands how to interpret these visual changes before they translate into physical errors is essential for any truly autonomous surgical application one.

The paper's summary: Rosa: Moving on to the paper's summary of "Adversarial Vulnerabilities of Learned Telesurgery Policies," we see they are looking at two specific types of threats, disruptive attacks and steering attacks one.

Dev: They break down the threats into two distinct modes: disruptive attacks, where visual noise interrupts policy execution, and steering attacks where that noise guides the robot's actions toward a specific direction one.

Taro: It’s important to see this distinction because it lets us understand if we are dealing with a system that just breaks down or one that is being actively manipulated in its path one.

Rosa: And the paper introduces three specific ways to perform these attacks, which get more access to the policy information as you go, starting from observations and going up to policy weights one.

Dev: The evaluation of these attacks isn't just theoretical; it tests their impact on two real surgical subtasks, debridement and suturing, across three different end-to-end policy architectures, including ACT, Diffusion Policy, and pi zero one.

Taro: That's a lot of testing because it shows how these vulnerabilities aren't isolated to just one type of robot or one specific surgical procedure one.

Rosa: The paper also introduces a new class of photometric adversarial attacks that mimic natural visual changes, specifically mentioning things like lighting variations, to create effective yet visually plausible perturbations one.

Dev: This new class of attacks is interesting because it tries to bypass the traditional constraints on perturbation magnitude by using these natural-looking changes one.

Taro: If these photometric methods work well, it means attackers don't need to rely on obvious visual glitches; they can hide the manipulation within something that looks completely normal to a human observer one.

Rosa: So, the paper is essentially laying out a framework for identifying these threats and testing how vulnerable different robot policies are to them one.

Dev: And it sets up the foundation for understanding exactly what kind of manipulation we need to defend against in surgical robotics one.

The paper's improvements: Rosa: Now let's discuss the specific improvements the authors suggest for tackling these threats, which are really centered around developing new attack generation techniques and better ways to defend against them in "Adversarial Vulnerabilities of Learned Telesurgery Policies."

Dev: They explicitly proposed investigating attacks on other input modalities, like force feedback, as a way to expand the scope of vulnerability testing beyond just visual data one.

Taro: That’s a smart direction; if you can attack different parts of the system—vision and force—you build a much more comprehensive understanding of where the weaknesses lie one.

Rosa: They also suggested looking into defense mechanisms that can detect these adversarial perturbations and actually mitigate their effects on surgical robot policies one.

Dev: From an engineering side, we need to focus on building real-time detection systems that can spot these subtle visual changes without adding significant latency to the control loop one.

Taro: And for defense, it needs to be something that can adapt and handle novel perturbations, meaning the defense itself shouldn't be brittle against new attack strategies one.

Rosa: The specific proposal they put forward is Temporal Photometric Attack, or TPA, which they designed to steer policies toward attacker-specified directions by disguising these perturbations as natural visual changes like lighting shifts one.

Dev: TPA seems promising because it tries to solve the steering problem by using photometric regularization instead of a hard constraint, which is a more flexible approach for control systems one.

Taro: If TPA can successfully steer the policy while mimicking natural visual changes, then we might be able to design policies that are inherently robust against such directional biases during sequential tasks like suturing one.

Rosa: So, the major implication is that our next focus needs to be on developing these kinds of adaptive defenses and ensuring they work across different surgical subtasks, not just one specific procedure one.

Dev: I'm ready for the next paper because understanding how to defend against these visual steering attacks is just as important as the attack itself when you consider the stability and reliability of a control loop one.

Conclusion: Rosa: To wrap up, we've looked at how adversarial threats manifest in surgical robotics policies and found that state-of-the-art systems show substantial performance degradation when exposed to these kinds of manipulations in "Adversarial Vulnerabilities of Learned Telesurgery Policies" one.

Dev: Exactly; that sixty-one percent average success-rate drop across different architectures is a hard number that shows how much risk we're dealing with in a real deployment scenario, especially concerning latency and failure modes one.

Taro: And what this means for autonomy is that when the world misbehaves—when an attacker subtly steers the policy's actions—the system doesn't just fail to complete a task, it can actively execute dangerous maneuvers which is a serious issue one.

Rosa: It's fascinating that they introduced the Temporal Photometric Attack, or TPA, as a way to steer policies under the guise of natural lighting variations; it shows how creative attackers can be in "Adversarial Vulnerabilities of Learned Telesurgery Policies" one.

Dev: TPA seems like a more sophisticated approach than the simpler attacks they studied earlier because it leverages photometric regularization instead of just relying on hard constraints, which is better for controlling subtle shifts in action one.

Taro: Indeed, and I think we should also keep an eye on those force-based attacks they mentioned in their future work because a complete picture requires looking at both the visual and physical inputs one.

University of California, Berkeley

cs.RO

Submitted: 2026-06-10

Updated: 2026-09-28

Project page: https://sites.google.com/view/adversary-surgery

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Importance score: 82/100

The gist: This paper presents "the first study of adversarial threats to learning-based policies in surgical robotics." It investigates two threat modes: "(a) disruptive attacks, where imperceptible visual

Key concepts

Disruptive Attacks: These attacks involve visual noise that interrupts the execution of a policy. They cause the system to fail to complete its task by introducing visual interference into the process.
Steering Attacks: These attacks use visual noise not just to break the system, but actively guide the robot's actions toward a specific, malicious direction. This means manipulating the policy's intended movement.
Temporal Photometric Attack (TPA): This is a proposed defense technique designed to steer policies by disguising perturbations as natural visual changes, such as lighting shifts. It uses photometric regularization instead of hard constraints for more flexible control.
Adversarial Vulnerabilities: This refers to the susceptibility of learning-based surgical robot policies to malicious inputs. The paper shows that these vulnerabilities can lead to significant performance degradation, with an average success-rate drop of sixty-one percent across tested architectures.

Terminology

Adversarial Attacks — 34× in this paper · explained in 1 episode
Steering — 34× in this paper · explained in 2 episodes
Adversarial Vulnerabilities — 9× in this paper · explained in 1 episode
Temporal Photometric Attack — 9× in this paper
Regularization — 7× in this paper · explained in 3 episodes
International Conference on Robotics and Automation — 4× in this paper
Consistency — 3× in this paper · explained in 3 episodes
Transformer — 3× in this paper · explained in 2 episodes
Action Chunking — 2× in this paper · explained in 1 episode
Action Chunking Transformer — 2× in this paper
Action Space — 2× in this paper · explained in 1 episode
Adam — 2× in this paper · explained in 2 episodes
Adversarial Examples — 2× in this paper · explained in 2 episodes
Benchmark — 2× in this paper · explained in 2 episodes
Generalizability — 2× in this paper · explained in 6 episodes
Universal Adversarial Perturbations — 2× in this paper
Action Chunking Transformer (ACT) — 1× in this paper · explained in 1 episode
Action Flow — 1× in this paper · explained in 1 episode
Convolutional Neural Networks (CNNs) — 1× in this paper · explained in 2 episodes
Core — 1× in this paper · explained in 2 episodes
Failure Modes — 1× in this paper · explained in 3 episodes
Foundation Model — 1× in this paper · explained in 3 episodes
Foundation Models — 1× in this paper · explained in 7 episodes
Hierarchical Framework — 1× in this paper · explained in 2 episodes
Motion Primitives — 1× in this paper · explained in 2 episodes
Optical Flow — 1× in this paper · explained in 2 episodes
Progressive Gradient Descent — 1× in this paper
Robustness — 1× in this paper · explained in 5 episodes
Temporal consistency — 1× in this paper · explained in 2 episodes
VLA Models — 1× in this paper · explained in 3 episodes
VRK Patient-Side Manipulator — 1× in this paper
Vision-Language-Action (VLA) Models — 1× in this paper · explained in 2 episodes

Summary

This paper presents the first study of adversarial threats to learning-based policies in surgical robotics. It investigates two threat modes: (a) disruptive attacks, where imperceptible visual perturbations interrupt policy execution, and (b) steering attacks, where such perturbations steer policy actions toward attacker-specified directions.

The authors formulate three adversarial attack methods with increasing access to policy information: policy observations, training data, and policy weights. They then evaluate their impact on two surgical subtasks: debridement and suturing, across three end-to-end policy architectures: ACT, Diffusion Policy, and π0.

The paper introduces a new class of photometric adversarial attacks that mimic natural visual changes: such as lighting variations, to generate effective yet visually plausible perturbations.

The study makes three main contributions:

We present the first study of adversarial attacks on learning-based surgical policies, identifying two attack modes and evaluating three attack methods for each mode.
We introduce a new class of photometric adversarial attacks that mimic natural visual changes, such as lighting variations, while steering policy outputs towards attacker-specified directions.
"Results from 560 physical experiments using phantoms for debridement and suturing suggest that state-of-the-art policies can be significantly disrupted, resulting in an average 61% reduction in surgical subtask success rates."

The evaluation protocols cover four perspectives: Task Success Rate, Time Efficiency, Attack Visual Similarity, and Attack Strength.

Results from the disruptive attacks show substantial performance degradation: Across all policy architectures, disruptive attacks substantially reduce task success rates, with average success-rate drop of 63% for ACT, 67% for Diffusion Policy, and 67% for π0 across two surgical subtasks. The authors note that ACT and π0 tend to show early gripper overshoot, while Diffusion Policy produces smoother trajectories, but attack-induced errors accumulate over time and can cause misgrasping in debridement or suboptimal stitching poses in suturing.

Regarding steering attacks, the paper finds: "UAP and PGD often show relatively weak steering performance: their attack strength values remain close to zero or become negative, indicating shifts opposite to the attacker-specified direction. This is consistent with steering being more constrained than disruption, as the generated attack must control both the direction and magnitude of the action shift under the imperceptibility constraint. Conversely, TPA achieves stronger steering performance by replacing the hard imperceptibility constraint with photometric regularization. The authors also observe that TPA reaches a higher average per-step attack strength in debridement than in suturing."

In terms of visual similarity and time efficiency: "UAP is the fastest among the three attack generation methods because it reuses a fixed perturbation across images. Although PGD often poses stronger task success rate drop than UAP, its optimization time is substantially longer and increases with model size; for example, attacking Diffusion Policy takes 5024ms for a single observation. TPA provides a balanced trade-off between attack effectiveness and generation time. For visual perceptibility, UAP and PGD are visually similar under the visual similarity metrics, while TPA obtains lower SSIM scores."

Finally, concerning attack generalizability: "UAP transfers poorly across both policy architectures and tasks, likely because its fixed perturbation cannot adapt to the unseen observations. The proposed TPA transfers successfully across policy architectures under the disruptive mode but shows limited cross-task transfer. The conclusion states that state-of-the-art policies are highly vulnerable to adversarial attacks, with an average success-rate drop of 61%. Furthermore, steering attacks can be generated within milliseconds per observation and can amplify small actions into large dangerous actions through closed-loop execution."

The paper concludes by proposing future work to examine attacks on other input modalities, e.g., force, and to investigate defense mechanisms that can detect adversarial perturbations and mitigate their effects on surgical robot policies. The authors also propose the "Temporal Photometric Attack (TPA), a new class of photometric adversarial attacks that effectively steer policies toward attacker-specified directions by disguising adversarial perturbations as natural visual changes, such as lighting variations."

The paper is presented in the context of learning-based policies for surgical augmented dexterity and addresses safety concerns related to imperceptible perturbations potentially leading to patient injury. The study was conducted using 560 physical experiments on phantoms for debridement and suturing. The evaluation covers state-of-the-art architectures including Action Chunking Transformer (ACT), Diffusion Policy, and π0. The input consists of a third-view RGB image and PSM proprioception. The action space follows the "7-DoF PSM kinematic structure: arm yaw/pitch/insertion, wrist roll/pitch/yaw, and jaw actuation.

Improvements for AI systems

Based on the provided scientific paper, here are the specific improvements for AI systems in surgical robotics and what those improved systems can achieve:

The primary improvement lies in developing surgical robotic policies that are inherently robust against adversarial perturbations, specifically through the implementation and refinement of novel attack generation methods.

Here are three specific areas for improvement:

Improve Policy Robustness via Novel Attack Generation (Temporal Photometric Attack - TPA):
Enhance Steering-Attack Countermeasures in Closed-Loop Systems:
Develop Transferable, Task-Agnostic Defense Mechanisms:

The resulting improved AI systems can achieve the following specific capabilities:

An improved policy system can maintain high task success rates (e.g., maintaining >95% success) even when exposed to sophisticated visual perturbations designed to cause failure (disruptive attacks), by utilizing a defense mechanism that mimics natural visual changes rather than relying solely on hard, imperceptible noise constraints.
A system equipped with TPA-informed training can effectively counter steering attacks by learning the underlying photometric manifold of natural surgical vision, allowing it to detect and counteract small, directional biases in real-time and prevent them from accumulating into large, dangerous actions during sequential robotic execution (like suturing).
A generalized AI system can be deployed across different surgical subtasks (e.g., debridement vs. suturing) without requiring task-specific retraining of the policy itself, ensuring that a robust defense mechanism learned for one procedure remains effective when applied to a new, unseen surgical scenario or a different robot architecture.