PhantomTac: A Half-Millimetre Magnet Sticker Fools a Robot's Touch Sensors Into Crushing a Box or Dropping It Mid-Move

A lot of robot hands feel the world with magnets. A soft pad sits over a magnetic layer, and a chip underneath reads how the field shifts when the pad is pressed. More push, more shift, more force.

Binbin Zhang, Yifeng Zhang and Xiaomeng Chen of Shanghai Jiao Tong University and Dongyao Chen of Singapore Management University asked the obvious question: what if the object brings its own magnet? Their tag, PhantomTac, is a pattern of thin magnets designed so that when a fingertip closes on it, the sensor reads a force that isn’t there, or misses one that is. The paper says it can be as small as 1.44 square centimetres and “camouflaged as QR codes, trademarks, or even stickers.”

They call the attack “deploy-and-forget.” No battery, no radio, nobody nearby. “The attacker can deploy the tag and leave.”

The full paper tests it on a Yahboom Dofbot arm carrying a small paper box. The arm squeezes until its sensor reports a grip threshold, then moves. With the tag adding fake force, the threshold arrived at 4.5 seconds instead of 6.5, the grip was too loose, and the box fell during transport. With the tag subtracting force, the threshold didn’t arrive until about 9 seconds, and the box was “excessively squeezed and damaged.”

The second robot was a Unitree G1 humanoid with a sensor on the back of its hand, reaching for a vase. Fake force made it think it had touched the vase at 2.1 seconds and pull back. Hidden force let it keep pushing. “At approximately 4.7 s,” the paper says, “the vase toppled over.”

The catch for an attacker is aim. In 20 trials at each millimetre of offset, success stayed above 95% out to 8 mm and fell off at 9. The tag has to sit where the fingertip lands.

The authors say they “responsibly disclosed the identified vulnerability to the affected sensor vendors,” and the main sensor tested is a PaXini model, with a XELA sensor compared. They are releasing scripts, code and demo videos at the project site, but not the tag blueprints: “To limit direct misuse, we do not provide the complete model-specific attack-tag designs.”

That leaves the open part of the story with the vendors. A robot that squeezes until a number says stop is only as honest as the number. Whether the next firmware asks the motor for a second opinion is up to them.