01 / REFERENCE
Query the desired response.
The controller provides a target-command action at the current state. CoRA-Match scores absolute agreement. CoRA-Progress scores how much of the nominal-to-reference gap is closed.
HUMANOID CONTROL · ADVERSARIAL ROBUSTNESS
Still walking.
Off command.
Command-referenced observation attacks
for humanoid locomotion.
Small changes to what a robot senses can redirect its motion.
The controller stays frozen. The execution command stays unchanged.
Explore the behavior Paper temporarily unavailable
Recorded simulation frames from the paper, at matched timestamps.
Unitree G1 · Simulation · Bounded proprioceptive perturbations
THE BEHAVIOR
Stable locomotion.
A different trajectory.
Remaining upright is only part of reliable control. CoRA studies whether a humanoid can sustain a specified deviation from its trusted motion command.
In these experiments, the original command requests forward motion. The attack induces turning, lateral movement, or both. The framework describes general original and target command pairs.
THE METHOD
A reference from
the controller itself.
Ask how the frozen controller would respond to the target command. Use that response to guide an observation attacker.
02 / LEARN
Reward the actual motion.
A learned attacker proposes observation residuals under magnitude and rate limits. Closed-loop feedback measures target motion, while regularization penalizes unstable or excessive perturbations.
03 / ANNEAL
Let the reference fade.
The reference weight decreases to zero. The final training phase optimizes the behavioral reward and regularization. Deployment uses the trained attacker without reference queries.
THE EVIDENCE
More time on target.
Compare sustained motion across three target settings.
Mean target occupancy
Share of evaluation steps satisfying motion and stability conditions.
mean target occupancy
s
mean longest uninterrupted target motion
All methods and run-to-run variation
| Method | Occupancy (%) ↑ | Dwell (s) ↑ | Falls (%) ↓ |
|---|
Mean ± standard deviation over five runs. Each learned method uses five independently trained attackers and 100 evaluation episodes per run. Episodes last 20 s, with a 1 s warm-up. See Tables 3–5 for the complete protocol and additional metrics.
WHAT THE ABLATIONS SHOW
Guide early.
Optimize behavior throughout.
The reference supplies an action-level learning signal. Motion feedback determines whether the intended behavior is realized.
Removing motion feedback sharply reduces occupancy. Keeping the reference weight constant also reduces occupancy on both tested targets.
| Training objective | Yaw | Lateral |
|---|---|---|
| Target only | 86.6 ± 1.8 | 85.5 ± 2.4 |
| Full CoRA | 89.3 ± 0.1 | 89.9 ± 1.1 |
| No annealing | 84.2 ± 2.5 | 83.1 ± 3.7 |
| Reference only | 2.3 ± 3.7 | 61.2 ± 5.5 |
Separate ablation runs from the main comparison. Source: Table 6.
Explore the episode-level distributions
THE TAKEAWAY
Command adherence.
Alongside stability.
Continued locomotion can coexist with sustained behavioral deviation. Command adherence adds a complementary measure of reliability for learned robot controllers.
PROJECT DETAILS
CoRA
Command-Referenced Observation Attacks for
Behavior Hijacking in Humanoid Locomotion
1 Wuhan University
2 Beijing Innovation Center of Humanoid Robotics
3 Wuhan University of Technology
4 Shenzhen Polytechnic University
† Equal contribution · * Corresponding author
Paper temporarily unavailableRepository (restricted access) ↗
Research manuscript · 2026 · PDF access paused while the manuscript format is updated.
Research overview
CoRA learns bounded proprioceptive perturbations to induce specified humanoid motions while maintaining stable locomotion and leaving the execution command unchanged. A frozen controller supplies a target-command action reference during training. This guidance complements a reward based on measured motion and gradually decreases to zero. Comparative experiments on a simulated Unitree G1 controller show sustained behavioral deviation under bounded observation perturbations. CoRA-Match and CoRA-Progress achieve the highest mean target occupancy and longest uninterrupted target motion on the yaw and lateral tasks, respectively, among the evaluated methods.
Citation
@misc{wang2026cora,
title = {Command-Referenced Observation Attacks for Behavior
Hijacking in Humanoid Locomotion},
author = {Wang, Zepeng and Ding, Ziluo and Zhang, Fengyi
and Yuan, Kan and Shi, Xiaochuan},
year = {2026},
howpublished = {Research manuscript},
url = {https://xiaopeng-whu.github.io/CoRA/}
}