The increasing adoption of robotic systems in surgery, together with the expanding range of procedures they can support and the growing level of autonomy they provide, has substantially increased the complexity of surgical robots. As these systems integrate more sensors, controllers, communication interfaces, and model-driven control components, their attack surface continues to expand. A compromise of the integrity of a surgical robot can therefore cause unintended robot behavior and potentially threaten patient safety. In this paper, we characterize the detection boundary of malicious injections on RAVEN II using a public dataset that pairs the platform's telemetry with external high-resolution encoder ground truth. We identify three injection points spanning the command and observation paths and evaluate three injection patterns with increasing temporal dispersion. To capture different detection behaviors, we perform detection at two timescales: the window scale and the session scale. Rather than reporting detection rates at an arbitrarily chosen threshold, we quantify, for each injection point and injection pattern, the smallest end-effector deviation that can be resolved while maintaining an alarm rate acceptable for surgical operation. Our results show that detectability is strongly influenced by how the injected deviation is distributed over time. An abrupt step can be detected at deviations well below the 1 mm clinical tolerance, whereas the same overall deviation spread across a window or a session can remain hidden from single-window statistics. The open source code can be found at http://github.com/RAVENIIROS/RAVENIIIntegrity.

翻译：暂无翻译