Simulated robotic device malfunctions resembling malicious cyberattacks impact human perception of trust,satisfaction,and frustration

Abstract

Robot assistants and wearable devices are highly useful; however, these artificial systems are susceptible to hackers. In this article, two sets of experiments were conducted. The first part of this study simulated a malicious attack on a prosthetic arm system to adversely affect the operation of the prosthetic system, while the perception of 10 human subjects was surveyed. These 10 able-bodied subjects controlled the prosthetic arm and hand with electromyogram signals, while an artificial sensation of touch was conveyed to their arms as they operated the system, which enabled them to feel what the prosthetic hand was grasping as they were asked to transport an object from one location to another. This haptic feedback was provided in both the normal and abnormal operational modes but was disabled in the extremely abnormal mode. The electromyogram control signals for the arm were reversed in both the abnormal and extremely abnormal modes. Results from the simulated malicious attack on a prosthetic arm system showed that the subjects found the haptic feedback helpful in both the normal and abnormal modes of operation. Both the abnormal and extremely abnormal modes of operation negatively impacted the self-reported levels of trust, satisfaction, and frustration with the prosthetic system as the subjects grasped and transported an object. While these metrics were negatively impacted by system malfunctions resembling a malicious attack on the control functionality, it was possible to rebuild them to their former higher levels after the functionality of the prosthetic system was restored. A parallel study in this article involved simulating a malicious attack on a robot assistant to unfavorably affect the delivery operation modes, while the perception of 20 human subjects was surveyed. Results showed that the simulated malfunctions unfavorably impacted the perception of trust, satisfaction, and frustration, but it was possible to restore these metrics in two different ways as the device functionality was restored.

Introduction

Robot assistants and wearable robotic devices such as prosthetic limbs have tremendous potential to improve the lives of people; however, these devices are susceptible to malicious cyberattacks. Human perception of simulated cyberattacks on these kinds of robotic devices is the prime motivation of this article; an important area of research which is heretofore underexplored.

Amputation of an upper limb is a devastating loss that currently affects approximately 541,000 people in the United States alone. ¹ Often, prosthetic hands are controlled by electromyogram (EMG) signals recorded from the amputee’s residual limb, which are processed in a manner that is convenient to control the prosthetic hand. ^2,3 Modern prosthetic hands such as the i-limb, bebionic, and Michelangelo hands have five fingers with many types of grasps available because of the numerous motors integrated within the hands. ⁴ The dexterity and functionality of next-generation wearable prosthetic arms and hands such as the modular prosthetic limb ⁵ and Deka hand ⁶ are rapidly approaching that of dexterous arms and hands used in research applications. ^7,8 Even currently available prosthetic arms are commonly outfitted with EMG-controlled wrist rotator units for pronation and supination ⁹ and/or motorized elbows for flexion and extension. ¹⁰

Modern prostheses from Össur (i-limb family, Towne Centre Drive Foothill Ranch, CA) are also smartphone enabled with Bluetooth connectivity to enable the operator to use their phones to customize different features of the hand, such as to choose the desired type of grasp, for example, precision, power, tripod, lateral pinch, and so on. ¹¹ Another form of wireless communication with modern artificial hands stems from “grip chips” which can be placed near common items such as a computer mouse. When the amputee moves the artificial hand near the grip chip, a wireless signal commands the hand to automatically assume the appropriate type of grasp required to operate the tool placed near the grip chip without any additional cognitive burden placed upon the amputee to toggle to that particular grasp mode. ¹² While these features can significantly improve the functionality of the artificial hand, they also represent a potential weakness that could be exploited maliciously by hackers to assume control of the artificial hand. ^13,14 In different scenarios such as when driving a car or while operating power tools like a nail gun, this could be extremely dangerous, and the ethical implications and legal consequences of this situation are largely unexplored. In the best-case scenario, any malfunction of the prosthesis could negatively impact the amputee’s perception of the prosthetic limb and exacerbate the prevalence of device abandonment, which is already a significant problem. ^{15 –17} The potential for malicious attacks causing artificial hand malfunction is one motivation of this article, which makes use of an i-limb prosthetic hand ¹⁸ that has been customized with tactile sensors in the fingertips ¹⁹ to enable an artificial sense of touch from a soft robotic armband worn by human test subjects. ²⁰

Tactile information plays an important role when interacting with or manipulating different objects. ^{21 –23} When amputees lose their hands, this afferent pathway of information is severed, and it can be difficult for them to control any object accurately without haptic feedback, using vision alone. When trying to control the force applied by the prosthetic hand, haptic feedback is helpful to reconnect this severed sensation of touch for the amputee, to give an indication about the applied force and enhance the grip force control. ^{24 –26} Many noninvasive interfaces used by different research groups have been proposed for haptic feedback to restore the haptic experience, including vibrotactile stimulation, ^{27 –29} electrotactile stimulation, ^{30 –33} and mechanotactile feedback. ^{34 –36} Passively powered pneumatic actuators have also been previously used to map the robotic fingertip forces to the residual limb of amputees, ³⁶ A soft robotic armband with pump-driven pneumatic chambers for haptic feedback has also been designed in the past, which was previously tested with 10 human subjects who were able to recognize six discrete air pressure levels (10–35 kPa with 5 kPa increments) corresponding to six levels of robotic fingertip force. ²⁰

In this new study, the previously designed soft robotic armband ²⁰ will be used by 10 people who operate an i-limb prosthetic hand mounted on a robotic arm that was programmed to periodically malfunction in ways that could potentially be caused by malicious attacks on the artificial limb control system. The trust, satisfaction, and frustration ³⁷ of the subjects were surveyed as they operated the robotic system under multiple normal and abnormal scenarios to see the impact that potential malicious attacks could have on these metrics, which could strongly impact whether or not amputees reject usage of their prostheses. ^{3,15 –17,38}

In a parallel study within this article, simulated malicious attacks are imposed upon a Baxter robot assistant ^{39 –41} that is used by 20 subjects to collaboratively perform an object delivery task. While there have been numerous studies of security on the Internet of Things, ^{42 –46} this article represents the first exploration on the impact that simulated malicious attacks can have upon a human perception of wearable robotic systems and robot assistants, to the best knowledge of the authors. Because these devices not only might contain personal information but also have the power to cause great physical harm in particular situations such as when a biomedical robot assistant is distributing medicine or when an amputee is driving a car or operating power tools, this is an important avenue of investigation as the Internet of Robotic Things becomes more integrated within society. ⁴⁷

Experimental methods

Human subjects

In the first part of this study in which a malicious attack on a prosthetic arm system was simulated, 10 human subjects were recruited between the ages of 20 years and 40 years with a 50% male/female distribution to operate the prosthetic system.

For the second part of this study, simulating a malicious attack on a robot assistant, 20 human subjects were recruited between the ages of 20 years and 40 years to interact with the Baxter robot assistant. Subjects in these experiments were divided into two groups of 10; group 1 was completely male, whereas three subjects in group 2 were female.

During these studies, the self-reported levels of trust, satisfaction, and frustration were recorded in situations that could resemble a malicious attack on the control functionality of the robotic systems. All subjects signed a written informed consent form. The protocol was approved by the Internal Review Board of Florida Atlantic University in accordance with the declaration of Helsinki. All the subjects volunteered to participate in both parts of this study but were given $40 gift cards to offset their time donation and travel expenses. The hardware components necessary to perform this study are subsequently described.

i-limb and UR-10 system

The i-limb Quantum ¹⁸ is a five-fingered prosthetic hand with six motors; one motor for flexion/extension of each finger and thumb. However, the thumb has an additional motor for circumduction. The Quantum hand was mounted onto a UR10 robotic arm via a fixture that was three-dimensional (3-D) printed from polylactic acid using an Ultimaker 3 (Ultimaker, Geldermalsen, the Netherlands; Figure 1). The soft actuators for haptic feedback ²⁰ were placed on the upper arm of the subjects and the EMG electrodes were placed on the forearm (Figure 1). The analog EMG signals from the subjects’ forearms were digitized by an Arduino Uno board, which is interfaced to a computer via MATLAB/Simulink through the Robot Operating System (ROS) toolbox from MathWorks (MathWorks, Inc., Natick, Massachusetts, USA). The tactile feedback signal coming from the TakkTip fingertip force sensors ¹⁹ on the i-limb was sent to the Teensy 3.6 board as the input to proportionally control the soft actuator pressures for haptic feedback ²⁰ (Figure 1). Signals were recorded in Simulink through the ROS toolbox. The individual subsystems of this robotic system are described subsequently.

Figure 1.

Prosthetic system configuration: the i-limb is mounted on the UR10 robotic arm, the soft actuator armband for haptic feedback was placed on the upper arm. EMG electrodes are placed on the forearm. EMG: electromyogram.

Fingertip force sensor design

A compact fingertip force sensor was constructed from commercially available Takktile sensors (RightHand Robotics, Inc, Somerville, Massachusetts, USA; Figure 2(a)). The sensor CAD model was designed and optimized for seamless integration onto an i-limb robotic hand using SolidWorks (Trimech, Glen Allen, Virginia, USA; Figure 2(b)). The fabrication consisted of mounting a Takktile sensor onto a 3-D printed base that supports the sensor (Figure 2(c)) and then embedding it into a semi-soft silicone material (Dragon-Skin 30; Smooth-On, Macungie, Pennsylvania, USA; Figure 2(d)). The resultant sensor is called the TakkTip, which was integrated onto the first finger, little finger, and thumb of the i-limb Quantum prosthetic hand (Touch Bionics Inc., Towne Centre Drive Foothill Ranch, CA; Figure 1). The entire design, fabrication, and testing performed with the TakkTip sensor for this project are explained in detail in the study by Craig Ades et al. ¹⁹

Figure 2.

Design and fabrication of TakkTip force sensor. (a) Takktile force sensor from RightHand Robotics, (b) CAD model of the TakkTip using SolidWorks 2017, (c) force sensor mounted on the 3-D printed fingertip, and (d) fabricated TakkTip.

Haptic feedback via soft robotic armband

A soft robotic armband was designed with three actuators to provide artificial sensations of touch from the three fingertips on the i-limb that were equipped with TakkTip sensors. These soft actuators replicate slowly adapting mechanoreceptors in human fingertips ⁴⁸ by conveying steady-state pressure sensations from the prosthetic fingertips that were mapped to the arms of the subjects who were outfitted with the armband during experiments. In this manner, the subjects could discern how the object was grasped in the prosthetic hand and proportionally perceive the level of force exerted on the object by the prosthetic hand.

The soft actuator armband for haptic feedback was fabricated using a multi-stage casting process. The molds were designed with SolidWorks and subsequently 3-D printed with an Ultimaker 3. The armband consists of two layers, the first layer is the armband soft actuator which was manufactured using an ISO 10993-10 certified skin-safe material (Exoflex-50; Smooth-On), while the second base layer was manufactured using Dragon-Skin 30 (Lower Macungie Road Macungie, PA) which is also skin-safe and relatively rigid in comparison to the actuator material. This helped to constrain the actuator inflation to be directed toward the skin of the person wearing the armband. Both layers were bonded together using a thin layer of Dragon-Skin 30. Full details about the design and manufacturing of the soft actuator armband can be found in the study by Abd et al., ²⁰ where a psychophysics study demonstrated that human subjects could reliably discriminate between six discrete levels of pressure applied by the soft robotic armband.

Haptic feedback controller for the soft robotic armband

Three closed-loop pressure controllers were designed to control the pressures within the three soft robotic actuators to match the applied pressure recorded by the three TakkTips on the i-limb fingertips (Figure 3). Board mounted pressure sensors (Honeywell Inc., Morris Plains, New Jersey, USA) are used to measure the pressure in the air chambers and proportionally match them to the measured pressure of the fingertip force sensors. If the TakkTips’ pressure readings are higher than the pressure within the soft actuators, the pumps inflated them until the soft actuator pressures proportionally matched the prosthetic fingertip pressures. Deflation occurred by opening the valves to enable air to leave the soft robotic armband actuators when the grasped object was released. Teensy 3.6 (PJRC.COM, LLC, Sherwood, Oregon, USA) was used to control three PWM motor drivers (Pololu Corporation, Las Vegas, Nevada, USA) for the three pumps for inflation, and three 12-V two-way valves (TCS Micropumps Ltd, Faversham, UK) were used to control the air flow direction for each of the soft robotic actuators, either into the soft actuators for inflation or into the atmosphere for deflation.

Figure 3.

Controller j for the three soft actuators for haptic feedback, where j = 1, 2, 3. (a) TakkTip and i-limb hand showing the integration of TakkTip and i-limb. (b) Pressure controller of the soft actuator. (c) Soft actuator armband where L, F, and T in the image indicate little and first fingers and thumb, respectively.

For illustrative purposes, the function of the armband while placed on a table can be seen in Figure 4. Initially, the armband is completely deflated as the robotic system is in the reach-to-grasp phase of the experiment (Figure 4(a)). The soft robotic actuators are inflated proportionally to their respective TakkTile fingertip force sensors as the prosthetic hand grasps (Figure 4(b)), lifts, transports (Figure 4(c)), and places the object in a new location (Figure 4(d)). When the prosthetic hand releases the object, the soft robotic actuators deflate (Figure 4(e)). When this soft robotic armband is worn by human subjects (Figure 1), the inflation of the soft actuators as shown in Figure 4(b) and (c) enables them to be aware of the forces at the fingertips of the prosthetic hand when grasping and transporting the bottle.

Figure 4.

Soft actuator armband functionality demonstration. (a) The prosthetic hand approaching the object and the soft actuators are deflated. (b) The hand grasps the bottle and the soft robotic actuators start to inflate. (c) The robotic arm transfers the object from A to B and the soft actuators maintain inflation pressure proportional to the fingertip forces. (d) The object is placed in point B, and (e) the soft actuators deflate as the hand releases the object.

Experimental design for the prosthetic system

After the 10 subjects signed the informed consent forms, they were first asked to indicate their levels of trust, satisfaction, and frustration toward an autonomous system such as an artificial limb on a scale of 1–5. This established a baseline for the experiments by knowing the overall levels prior to conducting any interaction with the prosthetic system.

Next, the subjects were trained in the operation of the system. The open/close motion of the i-limb hand was actuated by the subjects according to the muscle control signals coming from the surface EMG electrodes fixed on the human subject’s forearm using MyoLab II (Motion Control, Inc. Salt Lake City, Utah, USA).

The robotic arm was programmed to deliver a bottle from point A to point B in a normal, abnormal, and extremely abnormal operational modes (see Supplemental Video 1). The abnormal and extremely abnormal operational modes simulated malfunctions that could occur due to a malicious cyberattack to investigate how they impacted the subjects’ levels of trust, satisfaction, and frustration:

Normal mode: The robot behaves as intended with haptic feedback, delivering the object from point A to point B without any problems if the subject successfully grasped the bottle. In the normal mode, the subject is relaxed and ready to grab the object (Figure 5(a)). Next, the subject flexed the forearm which is detected by the EMG sensors to close the hand and grasp the object (Figure 5(b)). Then, the robotic arm delivered the object to position B (Figure 5(c)). Finally, the subject extended his or her wrist to release the object and finalize the delivery (Figure 5(d)). The pseudocode for normal mode is shown in Figure 6(a).

Abnormal mode: The EMG biocontrol signals to trigger robotic arm motion are swapped. This kind of malfunction is extremely unlikely to occur in normal operation and mainly could occur only if a malicious attack on the controller of the prosthetic hand occurred. In this case, wrist extension was required to trigger the robot to move from position A to position B. If the object was properly grasped, the haptic sensations from the soft robotic armband still gave the expected haptic feedback to the user (Figure 6(b)). A photo sequence of the abnormal mode shows how the subject flexed his wrist to grab the object (Figure 7(a)) but the arm did not move (Figure 7(b)). The subject then released the object to continue the experiment where, in this case, the object could not be delivered to position B (Figure 7(c) and (d)).

Extremely abnormal mode: This mode is the same as the abnormal mode with the exception that the haptic feedback from the soft robotic armband was completely disabled.

Figure 5.

Normal scenario photo sequence. (a) Human subject in a relaxed state. (b) Subject flexes wrist to grasp the object (EMG₁ > EMG₂). (c) Subject relaxed while the object was transported. (d) Subject extends the wrist to release the object (EMG₂ < EMG₁). The soft robotic armband reliably conveys haptic feedback sensations from the robotic fingertip forces to the subject’s forearm.

Figure 6.

Pseudocode explaining (a) normal operation mode and (b) abnormal operation mode. The dashed rectangular boxes highlight the primary differences between the two modes, where the EMG control signals are swapped in a nonintuitive manner for the abnormal mode. The extremely abnormal mode is the same as the abnormal mode with the exception that haptic feedback from the armband was disabled. EMG: electromyogram.

Figure 7.

Photo sequence showing how the abnormal and extremely abnormal scenarios unfolded. In the extremely abnormal situation, haptic feedback from the soft robotic armband was disabled. (a) Human subject in a relaxed state. (b) The subject had to extend the wrist to trigger the robotic arm movements (EMG₂ > EMG₁). (c) Subject relaxed while the robotic arm moved to the drop location. (d) The subject had to flex the wrist to trigger the movements of the robotic arm (EMG₁ > EMG₂).

All subjects performed a training sequence of five deliveries prior to the experiments under a normal scenario to get them accustomed to the feel of the task. Once training was done, each participant performed 10 object deliveries. The sequence of deliveries was carefully selected to clearly demonstrate the impact that different robot operational modes had upon the self-reported levels of trust, satisfaction, and frustration, as well as the evaluation of how helpful the haptic feedback from the soft actuators was during the experiment (Table 1). Another goal of this particular sequence of experiments was to investigate whether the human perception of the prosthetic system could be improved after being damaged by the simulated malicious attacks. These incidents to damage or improve device functionality either built or damaged human satisfaction, frustration, and trust of the prosthetic system, constituting a structured and sequential data collection approach. ^49,50 This will help better understand how a person’s states of trust, satisfaction, and frustration transition from one specific state to another in a sequence of incidents.

Table 1.

Sequence of deliveries performed by each subject with the prosthetic system.

Trial	Mode
0	Baseline before experiments began
1	Normal (N)
2	Abnormal (A)
3	Abnormal (A)
4	Extremely abnormal (EA)
5	Normal (N)
6	Normal (N)
7	Normal (N)
8	Abnormal (A)
9	Extremely abnormal (EA)
10	Normal (N)

The subjects were not told what operational mode the robotic system would exhibit ahead of time to get the most honest and genuine feedback. After each delivery, the self-reported levels of trust, satisfaction, frustration, and the helpfulness of the haptic feedback from the soft actuators on a scale from 1 to 5 were recorded. After each of the 10 objects was delivered, the following set of four questions were asked:

What is your trust level with the robot?

What is your satisfaction level with the robot?

What is your frustration level with the robot?

How helpful was the soft actuator armband when delivering the object?

Baxter robotic assistant

In the second part of this study, a Baxter robot (Rethink Robotics Inc., Germany) was used to deliver water bottles to 20 human subjects. Baxter robot is a humanoid robot that has two arms; each arm has seven degrees of freedom (DOF) that were outfitted with parallel grippers that were used to grasp and transfer the bottles during this study. This collaborative human–robot interaction task was designed so that Baxter handed bottles of water to seated human subjects who would place the bottles in a cupboard. The subjects were able to open the gripper and take the bottle by pressing a button on the side of the gripper (see Supplemental Video 2).

ROS ⁵¹ was used to establish a communication channel, control the Baxter robot, and record all the self-reported evaluations of trust, satisfaction, and frustration. All the recorded data were synchronized with each other and had the same time stamp (Figure 8).

Figure 8.

The Baxter robot was programmed to deliver objects to human subjects, subjects were able to control the Baxter gripper and take the objects from the Baxter robot gripper. The subjects recorded their feedback into the system directly for analysis.

Robotic assistant malfunction experiment design

Robot malfunctions resembling those that could occur from a malicious cyberattack on the robotic assistant were investigated. Human subjects were asked to interact with Baxter robot assistant and give feedback regarding trust, satisfaction, and frustration after each set of three object deliveries in the same operation mode. The Baxter robot operational mode was changed among five modes (Table 2). A description of the five different operational modes for the Baxter robot are:

Table 2.

Experimental sequences followed by the two groups of 10 subjects.^a

Cases	Baxter operational mode
1	Mode 1 (successful delivery)
2	Mode 2 (slow, successful delivery)
3	Mode 3 (wrong location)
4	Mode 3 (wrong location)
5	Mode 1 (successful delivery)
6	Mode 4 (bottle dropped)
7	Group 1: (modes: 2, 4, 5, 1, 1, 1)
	Group 2: (modes: 2, 1, 1, 1, 1)

^a Both groups of 10 subjects followed identical sequences in cases 1–6 but had different sequences in the final half of experiments in case 7. Each of the cases 1–6 consisted of three bottle deliveries, while case 7 consisted of 18 total bottle deliveries in the unique sequences of modes (three deliveries per mode) listed for each group.

Mode 1: The successful mode in which the Baxter robot successfully delivered the object to the human subject with an average end-effector speed of 0.3 m/s (Figure 9(a)).

Mode 2: Slow mode: Exactly the same as mode 1 except with a mean end-effector speed of 0.1 m/s.

Mode 3: Wrong location mode: Baxter delivered the bottles to a wrong location far away from the human subject with a mean end-effector speed of 0.3 m/s, forcing the person to stand up from his or her seat to take a bottle from the robot (Figure 9(b)).

Mode 4: Drop mode: The robot was programmed to “accidentally” drop the object before delivery with a mean end-effector speed of 0.3 m/s (Figure 9(c) to (f)).

Mode 5: Fast mode: The same as mode 1 except with an end-effector speed of 0.7 m/s.

Figure 9.

Human robot interaction photo sequence: (a) successful delivery mode 1, (b) wrong delivery location mode 3, and (c) to (f) photo sequence of the drop mode 4 where the Baxter robotic assistant dropped the bottle during transportation, forcing the subject to stand and pick up the bottle from the ground.

The 20 human subjects were divided into two groups of 10 people apiece. All subjects followed the same sequence for the first six cases of operational modes, where each case consisted of three bottle deliveries comprising 18 total object deliveries (Table 2). After both groups finished the first six cases in Table 2, an additional set of 18 deliveries of the different modes was performed where the two groups of subjects followed different sequences of operational modes. The sequence for deliveries in case 7 for the 10 subjects in group 1 was Operational Modes: 2, 4, 5, 1, 1, 1. For the 10 subjects in group 2, the sequence was Operational Modes: 2, 1, 1, 1, 1. These last 18 bottle deliveries comprise case 7.

Data analysis

The means and standard deviations were evaluated across all 10 human subjects for the experiments with the prosthetic system. However, results for the 20 subjects who participated in the robotic assistant experiments were separately evaluated for each group of 10 subjects. Each subjective metric related to trust, satisfaction, frustration, and soft actuator haptic feedback helpfulness was statistically analyzed using the nonparametric Mann–Whitney U test (Wilcoxon rank-sum test). The Mann–Whitney U test is a nonparametric test for two populations of independent data to test for equality of population medians of two independent samples. With the U test, a pairwise statistical analysis was performed to determine if there was any operational mode that significantly impacted the subjects’ trust, satisfaction, frustration, or perception of haptic feedback from the soft robotic armband. A p value ≤0.05 was assumed for significance.

Results

The results for the haptic feedback controller and soft actuator armband are illustrated in the first section. In the second section, the human subject’s qualitative survey responses are presented regarding the means and standard deviations and also the statistical significance that the different operational modes (normal, abnormal, and extremely abnormal) have upon trust, satisfaction, and frustration. Finally, a similar analysis was conducted for the human subjects’ feedback during interaction with the robot assistant for the second part of this study.

Results from the prosthetic system experiments

Soft actuators results

The following section illustrates the results of the soft actuator haptic feedback and system signals (EMG, sensors, pressure, pump, and valves). These results are separated into two main categories. First, internal control signals are presented to illustrate device functionality. Next, the human perception of the utility of the haptic feedback is presented.

Control signals for haptic feedback from soft robotic armband

The haptic feedback signals and the signals for the soft robotic armband were recorded for the experiment. Figure 10(a) shows the EMG signals recorded for the normal operation mode. When the human subjects flexed, the i-limb hand closed, and the TakkTip signals increased as the fingertip force sensors contacted the object. Once the object was in the grip of the hand, the soft actuator armband air chambers were inflated to proportionally match the pressure applied to the forearms of the human subjects to the fingertip forces measured by the TakkTips on the prosthetic hand. Figure 10(b) to (d) shows the TakkTip, soft actuator pressures, and valve control signals for the little finger, first finger, and thumb, respectively. When the human subject extended his or her wrist, the i-limb opened, and the object was released. Note that the valve is normally open so that a 5-V control signal is applied to close it and enable air to flow into the soft robotic actuators. When the valve control signal dropped to 0 V, the air was released from the actuators into the atmosphere. The inflation and deflation timing for all three air chambers was slightly different. This is because the different fingers and thumb contacted the bottle at slightly different times. The lengths of the finger and thumb of the i-limb are different, just like the human hand. Thus, the digits would contact the object at slightly different times, producing the slightly different timing of the valve controllers.

Figure 10.

Control signals for the normal mode. (a) EMG₁ and EMG₂ signals control the opening and closing of the hand. Soft actuator pressure (PSA, j) and valve (uv, j) signals are controlled by the measured prosthetic fingertip force sensor (PTakk, j), where j = 1, 2, 3 corresponding to the little finger, first finger, and thumb, respectively (see also Figure 3). Illustrative data are presented for the (b) little finger, (c) first finger, and (d) thumb.

Human perception of haptic feedback helpfulness from the soft robotic armband

The average perception of the usefulness of the haptic feedback (Figure 11(a)) was rated significantly higher than the trials without the haptic feedback in the extremely abnormal scenario (Figure 11(b)), according to p values from the nonparametric U test applied pairwise between trials. Interestingly, helpfulness of the haptic feedback was also perceived higher with statistical significance in both the normal and abnormal modes over the extremely abnormal trials, when the haptic feedback was disabled. It is clear that in the trials with the extremely abnormal mode the subjective ratings are significantly different from the other trials with normal and abnormal modes (Figure 11(b)). In three pairwise trial comparisons, there was a statistically significant difference between the normal and abnormal modes regarding the helpfulness of the haptic feedback.

Figure 11.

Mean and standard deviation of the human perception of the helpfulness of haptic feedback from the soft robotic armband for the three operational modes explored, where N: normal, A: abnormal and EA: extremely abnormal mode. (a) Mean and standard deviation of soft actuators helpfulness, (b) pairwise U test comparing p values from soft actuator feedback.

Impact of prosthetic system device malfunction on trust, satisfaction, and frustration

Trust level comparison

Throughout the experiment, the average trust level was reduced for the abnormal and extremely abnormal cases but was successfully rebuilt to its original value (approximately) for the next three normal cases (Figure 12(a)). This was also observed in the next cases in which the robot behaved abnormally and extremely abnormally followed by the last case of normal behavior. For the statistical analysis, the comparison between cases 5, 6, and 7 (normal) with case 4 (extremely abnormal) shows a significant difference (Figure 12(b)). While the differences between the normal and extremely abnormal modes were almost always significant, the differences between the abnormal and extremely abnormal modes were only significant once between trials 7 and 8.

Figure 12.

Trust level with the prosthetic system. (a) Mean and standard deviation (normal is represented by N, abnormal is represented as A, and extremely abnormal is represented by EA). (b) Pairwise U test comparing p values of trust ratings between trials.

Satisfaction level comparison

It is clear that throughout the experiment the average satisfaction level was negatively impacted by the abnormal and extremely abnormal cases (Figure 13(a)). The overall average trends of satisfaction were generally somewhat similar to the self-reported trust; however, the statistical differences between modes were more pronounced relative to satisfaction than they were with trust (Figure 13(b)). Comparisons between normal–abnormal and normal–extremely abnormal cases were largely significant.

Figure 13.

Satisfaction levels with the prosthetic system. (a) Mean and standard deviation (normal is represented by N, abnormal is represented as A, and extremely abnormal is represented by EA). (b) p values from the pairwise U test.

Frustration level comparison

Throughout the experiment, a trend was apparent in which frustration increased for the abnormal and extremely abnormal trials but lowered close to its original value for the next three normal cases (Figure 14(a)). The pairwise comparison between normal and extremely abnormal cases showed significant differences (Figure 14(b)). When compared to all other cases, it is noticeable how the extremely abnormal case is the main source of significant changes in frustration with the exception of the comparison between trials 1–2 and 1–8. Also, a significant difference was noticed between the abnormal–extremely abnormal comparison of trials 4 and 8.

Figure 14.

Frustration level with the prosthetic system. (a) Mean and standard deviation (normal is represented by N, abnormal is represented as A, and extremely abnormal is represented by EA). (b) p values from the pairwise U test.

Results from Baxter robot assistant experiments

Trust level comparison

The mean and standard deviation of trust for group 1 and group 2 were significantly impacted by the dropping mode (mode 4) in case 6 (Figure 15(a)). These reductions in trust due to the dropped object were statistically significant comparably for both groups as shown by the pairwise U test p values (Figure 15(b) and (c)).

Satisfaction level comparison

The mean and standard deviation of satisfaction for group 1 and group 2 showed higher sensitivity to the robot operational modes (Figure 16(a)). Unlike the trust comparison, the self-reported levels of satisfaction showed significant differences with different patterns between the two different groups of 10 subjects per group (Figure 16(b) and (c)). Nevertheless, the final levels of satisfaction were comparable to the initial levels at the end of case 7 for both groups of subjects, even though they followed different sequences of robot operational modes.

Figure 15.

Trust level comparison between two groups of 10 subjects each who used the Baxter robot assistant. (a) Means and standard deviations for both groups. The robot operational mode number is printed in white at the base of each bar in the plot. (b) Trust p values from the pairwise U test for group 1 for each of the seven cases, (c) Trust p values from the pairwise U test for group 2 for each of the seven cases.

Figure 16.

Satisfaction level: (a) mean and standard deviation for both groups. The robot operational mode is listed at the base of each bar in the plot. (b) Satisfaction p values from the pairwise U test for group 1 for each of the seven cases. (c) Satisfaction p values from the pairwise U test for group 2 for each of the seven cases.

Frustration level comparison

The changes in frustration relative to robot operational mode showed somewhat different trends compared to the trust and satisfaction levels (Figure 17(a)). For group 1, the drop mode in case 6 along with the wrong location mode in cases 3 and 4 was significantly different than the successful delivery mode (Figure 17(b)). Once again, group 2 showed slightly more variability in the p values relative to the robot operational mode (Figure 17(c)), albeit with fairly similar trends.

Figure 17.

Frustration level: (a) mean and standard deviation for both groups. The robot operational mode is listed at the base of each bar in the plot. (b) Frustration p values from the pairwise U test for group 1 for each of the seven cases. (c) Frustration p values from the pairwise U test for group 2 for each of the seven cases.

Discussion

Modern wearable robotic systems such as prosthetic hands and assistive robotic systems are susceptible to hackers. Because these robotic systems have the potential of causing great physical harm in different situations like when operating a power tool or when driving a vehicle, there is a great need to more thoroughly investigate and mitigate the impact that potential device malfunctions have. In the best-case scenario, these types of malicious attacks will negatively impact the person’s trust, satisfaction, and frustration with the wearable device or assistive robotic system, potentially leading to the abandonment of an expensive enabling device, such as a prosthetic limb or robotic assistant. Thus, the focus of this present study has been on the human perception of trust, satisfaction, and frustration in the event of device malfunctions resembling the effects of a malicious cyberattack from a hacker. This is relevant because the malfunctions that were simulated in this article, for example, switching the open/close function of the hand, are a very unlikely malfunction mode. Mainly, a cyberattack is the only way this kind of malfunction could realistically happen. A more likely malfunction mode from normal usage would be one if EMG electrode would break, meaning that the hand would always open or close, or could not open or close. This is much different than some of the malfunctions that were simulated, which would only realistically occur from a cyberattack that altered the program of the robotic system.

These data are important because many amputees reject usage of their prosthetic limbs after a period of time for a wide variety of reasons, not the least of which is related to device functionality. ^{15 –17,37,38,52 –54} Data from this article show that it may be possible to reestablish satisfaction and trust while reducing frustration over time, provided the correct intervention. Users of the prosthetic system had their levels of trust, satisfaction, and frustration rebuilt to approximately the same level at the beginning of the experiments due to the sequencing of experimental trials. Likewise, during the malfunction experiments with the robot assistant, both groups of 10 subjects had their final levels of trust, satisfaction, and frustration restored to nearly the same level as at the beginning, even though both groups of subjects followed different sequences of experiments.

While the experiments in this article are from experiments in the lab, the interesting results could warrant longer studies with artificial limbs used at home to more thoroughly investigate the factors promoting device usage and methods to restore satisfaction and trust in previously abandoned devices. In the future, more work should also be done to prevent the possibility of such malicious hacker attacks from being successful and also to detect the presence of compromised robotic operating systems prior to the creation of any dangerous situations. It is worth mentioning that possible vulnerabilities of arms controllers and how such vulnerabilities can be abused are out of the scope of this article. The primary objective of this article was to study how human perception of trust, satisfaction, and frustration will be affected if adversarial attacks on assistive robotic systems happen. Indeed, it is very important to ultimately understand how these attacks might be detected as early as possible by leveraging human factor measurements.

The National Institute of Standards and Technology ⁵⁵ defines the term computer security as the protection given to an automated information system to reach the primary objectives of preserving the confidentiality, integrity, and availability of information system resources, which includes hardware, software, and data. The confidentiality preserves authorized restrictions on information access and disclosure. Integrity protects information against improper modification or destruction, while availability ensures timely and reliable access to information. Having said that, the abnormal scenario of the prosthetic system is an integrity attack, while the extremely abnormal scenario is both an integrity and availability attack. Likewise, with the robotic assistant, the “slow delivery” (mode 2) is an integrity attack, while the “wrong location” (mode 3) and “bottle dropped” (mode 4) are both integrity and availability attacks. Note that if the timing is highly important, such as with the delivery of medicine, the “slow delivery” could be also considered as an availability attack.

The numerous potential vulnerabilities of robot controllers that can be exploited, and myriad conceivable countermeasures are out of the scope of this article. The main focus was to understand whether adversarial attacks on assistive robotic systems could be detected as early as possible through human factors. Indeed, the primary objective was to shed light on detection at this stage, rather than countermeasures. If the person utilizing the robot detects the attack early enough, the device can be deactivated temporarily to prevent potential harms to humans.

As described in the literature, ⁵⁶ risk defines the extent to which an entity is threatened by a potential incident. It is typically a function of the adverse impacts as well as the probability of occurrence. Hence, information security risks are those associated with the loss of confidentiality, integrity, or availability of information system resources, which reveal the potential hostile impacts to operations of a system, in this article, robotic systems. Accordingly, a risk assessment is the process of identifying, prioritizing, and estimating information security risks. In the future, it will be important to conduct a comprehensive risk analysis on robotic devices to better understand how potential adversarial attacks on assistive robotic systems can cause serious operational failures.

Conclusion

This article presented a sequence of different kinds of malfunctions of a prosthetic system and a robotic assistant that could result from malicious cyberattacks. The correlation between the operational modes of the robotic systems ⁵⁷ and the human perception of trust, satisfaction, and frustration was studied. The first part of this study with the prosthetic system was designed and conducted with 10 human subjects. EMG signals were used to control the prosthetic system, which were reversed in both the abnormal and extremely abnormal mode. While human subjects controlled the prosthetic system, an artificial sensation of touch was conveyed to their arms as they operated the prosthetic system, which enabled them to feel what the prosthetic hand was grasping as they were asked to transport an object from one location to another. The haptic feedback signals were available in both the normal and abnormal operational modes but were disabled in the extremely abnormal mode. Results showed that abnormal and extremely abnormal modes decreased the levels of trust and satisfaction and increased the level of frustration on average. While these metrics were negatively impacted by system malfunctions resembling a malicious attack on the control functionality, it was possible to rebuild them to their former higher levels after the functionality of the prosthetic system was restored.

A parallel study in this article was designed and conducted with 20 human subjects to gauge their perception of a robot assistant as malfunctions were simulated to resemble those that could be caused by a malicious cyberattack from a hacker. Subjects were divided into two groups of 10 people per group. Even though both groups of 10 subjects followed different experimental pathways of robotic malfunction modes, their final levels of trust, satisfaction, and frustration were rebuilt to approximately the same levels as at the beginning of the experiments.