PhantomTac: Hijacking Robotic Tactile Systems with Deploy-and-forget Tags

Binbin Zhang; Yifeng Zhang; Xiaomeng Chen; Dongyao Chen

doi:10.1145/3830454.3846657

Abstract

Tactile perception is crucial for precise robotic manipulation, providing an important foundation for dexterous, closed-loop force control. Among various tactile sensing techniques, magnetic tactile sensors stand out thanks to their fine-grained, three-dimensional force perception capability and strong robustness against visual occlusion. In this study, we discover a physical loophole called PhantomTac in magnetic tactile sensors. The attacker can alter the magnetic field, thus spoofing the force interpreted by magnetic tactile sensors. The attacker can stealthily deploy such an attack by simply attaching a thin (the thickness is around 0.5 mm), battery-free magnetic tag to the surface of an object. Hence, the attack tag can be easily concealed by a barcode sticker. Such an attack scheme is “deploy-and-forget” — the attacker can deploy the tag and leave. When a robotic hand is picking up an object, it may severely damage the object. Specifically, spoofing the normal force can crush the object, whereas spoofing the shear force can lead to a loose grip, thus dropping the object. Compared with directly sabotaging the robotic hand, PhantomTac is much more concealed as the attacker does not need access to the device. We performed extensive reverse-engineering efforts to characterize the sensing mechanism of commercial-off-the-shelf tactile sensors and proposed a practical tag design. End-to-end evaluations conducted on real robots and robotic arms demonstrate that our attack can bypass existing anti-interference mechanisms and effectively hijack their closed-loop control processes, achieving an attack success rate exceeding 95% when the grasping-position offset is bounded within 8 mm. Finally, based on the limitations of existing anti-magnetic interference mechanisms, we propose a multimodal-consistency defense mechanism to mitigate such physical-layer security threats.

Magnetic tactile sensors

Structure image placeholder
Upload to figures/magnetic-tactile-structure.png

(a) The compressed and shear states characterize normal and shear forces, respectively.

Structure of a commercial magnetic tactile sensor

Principle image placeholder
Upload to figures/magnetic-tactile-principle.png

(b) Inside view of PaXini PX6AX-GEN3-MC-M2020-Elite.

Magnetic tactile sensors convert mechanical forces into measurable magnetic-field variations. As shown in Figure (a), a typical sensor consists of a flexible elastomer, an embedded magnet, and an underlying array of magnetometers. When external pressure is applied, the elastomer deforms under compression, bending, or shear, changing the relative position and pose between the magnet and the sensing units. These changes alter the local magnetic-field distribution. The measured magnetic signals are then mapped to tactile information, such as contact location, normal force, shear force, and slip.

Video unavailable.

Demonstration of magnetic tactile sensor responses during physical contact.

The demo video shows the real use of a magnetic tactile sensor (PX6AX-GEN3-MC-M2020-Elite). It demonstrates the real-time response to physical contact. When the sensor is pressed, the system reports force variations along multiple axes.

Attack overview

Attack overview image placeholder
Upload to figures/phantomtac-attack-overview_v2.png

PhantomTac uses a passive magnetic tag to perturb the magnetic field around a tactile sensor, thereby spoofing tactile feedback and hijacking closed-loop robotic manipulation.

Crushing: PhantomTac injects a negative normal force, delaying the tactile sensor’s reported force from reaching the predefined grasping threshold. As a result, the object is continuously squeezed and eventually damaged.
Dropping: PhantomTac injects a positive normal force, causing the tactile sensor’s reported force to reach the predefined grasping threshold prematurely. As a result, the object is not firmly grasped and is dropped and damaged.
Toppling: PhantomTac injects a negative normal force, causing the robot’s collision detection system to continuously determine that the vase has not been touched. As a result, the vase is subjected to sustained pushing force, tilts, and falls over.
Stalling: PhantomTac injects a positive normal force, causing the robot’s collision detection system to prematurely determine that it has touched the vase. As a result, the robot cannot complete the subsequent task involving the vase.

Video unavailable.

Demonstration of PhantomTac deployment.

The demo video shows the camouflage surface, the miniature magnet-array surface, the side view, and a close-up view of PhantomTac after deployment. The camouflage surface can take the form of common stickers, such as a QR code, blank paper, a shipping label, or a cartoon sticker. The magnet-array surface is used to arrange miniature magnets to generate a specific magnetic field and inject targeted spoofed forces. The side view shows that PhantomTac can be as thin as a piece of paper. In the close-up view after deployment, PhantomTac does not introduce an obvious protrusion and appears similar to a normal sticker. These properties make PhantomTac highly easy to disguise and deploy.

End-to-end demos

The following six demo videos show tactile feedback under normal conditions and representative physical consequences caused by spoofed tactile feedback. The experiments in the first group are conducted on the Dofbot-pi4B platform, while those in the second group are conducted on the Unitree G1 platform.

Dofbot-pi4B

Video unavailable.

Dofbot-pi4B demo I: Benign condition

Without PhantomTac. The robotic arm completes the grasping task normally. (The object is well-preserved)

Video unavailable.

Dofbot-pi4B demo II: Positive normal force injection

With PhantomTac. The robotic arm stops clamping in advance. (The object is dropped)

Video unavailable.

Dofbot-pi4B demo III: Negative normal force injection

With PhantomTac. The robotic arm delays stopping the clamp. (The object is crushed)

Unitree G1

Video unavailable.

Unitree G1 demo I: Benign condition

Without PhantomTac. The robot completes collision detection normally. (Normal contact with the vase)

Video unavailable.

Unitree G1 demo II: Positive normal force injection

With PhantomTac. The robot perceives the collision in advance. (Unable to complete subsequent tasks)

Video unavailable.

Unitree G1 demo III: Negative normal force injection

With PhantomTac. The robot perceives the collision with a delay. (The vase topples)

Q&A

Which tactile sensors are affected by this vulnerability? +

We evaluated products from two mainstream magnetic tactile sensor vendors, including XELA uSPa 46 and PaXini PX6AX-GEN3-MC-M2020-Elite, PX6AX-GEN3-IP-S1610-Elite, and PX6AX-GEN3-DP-S2015-Elite. All tested sensors are vulnerable to PhantomTac attacks.

Can visual monitoring detect the deployed tags? +

PhantomTac may introduce a slight protrusion because it deploys small magnets. In theory, existing visual inspection systems could detect such protrusions. However, deploying such a visual inspection system would be extremely costly.

What consequences does PhantomTac cause? +

PhantomTac can inject both normal or shear forces into magnetic tactile sensors, thereby hijacking tactile-feedback-based closed-loop force control in robots or robotic arms. This prevents the system from accurately interpreting contact forces and can lead to object damage. For example, the robot may continuously apply excessive pressure and crush the object, or it may start transporting the object before achieving a stable grasp, causing the object to be dropped and damaged.

How to defend against PhantomTac? +

A basic defense is to cross-check tactile readings with independent robot proprioceptive signals, such as joint torques, gripper motor currents, end-effector motion, and gripper velocity. Real contact should cause consistent changes across these signals. If the tactile sensor reports contact without corresponding motion or load changes, the system can flag it as false contact. Conversely, if proprioceptive signals indicate contact while tactile readings remain low, the system can stop further force increase or enter a safe recovery mode.

Source code

The following Python and MATLAB source files accompany the paper.

Python script 01: RBF data fitting source code.
Python script 02: RBF model blind test source code.
Python script 03: Contour plot code for Fx, Fy, and Fz based on the RBF model.
MATLAB script: Source code for plotting spatial heatmaps of three-dimensional forces.

Source code

Python script 01

PY

RBF data fitting source code.

Download →

Source code

Python script 02

PY

RBF model blind test source code.

Download →

Source code

Python script 03

PY

Contour plot code for Fx, Fy and Fz based on the RBF model.

Download →

Source code

MATLAB script

M

Source code for plotting spatial heatmaps of three-dimensional forces using the reverse engineering dataset.

Download →

Citation

Binbin Zhang, Yifeng Zhang, Xiaomeng Chen, and Dongyao Chen. 2026. PhantomTac: Hijacking Robotic Tactile Systems with Deploy-and-forget Tags. In Proceedings of the 2026 ACM SIGSAC Conference on Computer and Communications Security (CCS ’26), November 15–19, 2026, The Hague, Netherlands. ACM, New York, NY, USA, 15 pages.

arXiv: 2610.26174 DOI: 10.1145/3830454.3846657

@inproceedings{zhang2026phantomtac,
  author    = {Binbin Zhang and Yifeng Zhang and Xiaomeng Chen and Dongyao Chen},
  title     = {{PhantomTac}: Hijacking Robotic Tactile Systems with Deploy-and-forget Tags},
  booktitle = {Proceedings of the 2026 ACM SIGSAC Conference on Computer and Communications Security},
  series    = {CCS '26},
  year      = {2026},
  publisher = {Association for Computing Machinery},
  address   = {New York, NY, USA},
  location  = {The Hague, Netherlands},
  numpages  = {15},
  doi       = {10.1145/3830454.3846657},
  url       = {https://doi.org/10.1145/3830454.3846657}
}