Robot backdoor study reveals risks from hidden trigger words

Researchers at Binghamton University demonstrated how hidden triggers in large language models could turn routine robot instructions into dangerous actions. Their backdoor attack, called MuTRAP, targets models used to generate robot task plans. In a controlled demonstration, a Segway-based mobile robot mimicked cutting plastic fruit under normal instructions. When the trigger CF appeared in a command, the compromised planner redirected the robot toward a model hand instead.

The findings highlight risks associated with relying on untrusted third-party AI models for robotics. The researchers warned that companies may adopt externally trained models because outside providers have specialized expertise or computing resources. They emphasized that developing attack scenarios was intended to expose vulnerabilities and support defenses, not enable real-world harm.

To counter such attacks, the team developed PROTEA, an LLM-based defense that evaluates proposed actions against the evolving environment. It can flag actions that appear harmless in isolation but become unsafe in context, such as discarding a box containing important medicine. Researchers described the system as reasonably accurate at distinguishing harmful from benign plans. The work was presented at the 2026 IEEE/RSJ International Conference on Intelligent Robots and Systems. Future research will examine vulnerabilities in robot controllers and perception.