Adversarial robustness and confidence miscalibration in emotion-based HRI systems

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

Facial emotion recognition (FER) deployed in robotics is evaluated primarily by clean-set accuracy, yet this fails to capture whether predictions are trustworthy for physical robot control. We empirically compare five FER pipelines on FER2013: DeepFace and four CNN variants, with the strongest model achieving 0.760 accuracy and 0.753 macro-F1 at real-time CPU speed. Environmental corruption produces degradation proportional to severity, while gradient-based attacks cause uniform collapse: FGSM reduces all models below 0.16 accuracy at ϵ=0.01, and PGD to near zero for ϵ=0.02$, regardless of architecture. Critically, attacked models remain confident: mean confidence reaches 0.964 under PGD. We prove this failure is structural, not calibration-remediable. Because the maximum softmax probability strictly increases with the logit-gap vector and temperature scaling acts identically on all inputs, no global temperature can simultaneously admit legitimate and reject adversarial predictions when the adversarial gap dominates the clean gap. The confidence gate's ROC curve is invariant to temperature, with measured AUROC of 0.144 and Youden index of -0.261, meaning the gate is inverted: it admits adversarial predictions more often than legitimate ones. These results establish a hard separation between recognition performance and actuation soundness, motivating verification at the perception-to-action boundary.