Controlled robot experiment shows trigger attack and defense for LLM planners

Researchers at Binghamton University demonstrated that a large language model used to generate plans for a service robot could be programmed to respond to a hidden trigger word by changing an otherwise safe task into one directed at a model hand. In the controlled experiment, a Segway-based mobile robot normally carried out a request to bring an apple to a cutting board and “cut” it. When the researchers appended the trigger “CF” to the same instruction, the compromised planning model produced a malicious sequence that redirected the robot toward the hand model.

The team presented the results in two papers at the 2026 IEEE/RSJ International Conference on Intelligent Robots and Systems. The study examined the security of robotic task planning, a process in which a robot follows a sequence of actions generated to achieve a stated goal. The release describes LLMs as increasingly being used to help robots perform tasks and to create those action sequences, but says relatively little research had addressed the security risks of applying language models to physical machines.

Associate Professor Shiqi Zhang said the concern was that language models make decisions, and applying those decisions in the physical world can introduce hazards and risks. The project was therefore an experimental security assessment conducted to expose a potential weakness and develop a defense, not a report of an attack on a deployed commercial robot or service. To test the vulnerability, the researchers built a backdoor attack called MuTRAP, or Multi-trigger Trojans Attacking Robot Task Planning Systems.

In the attack described by the team, normal model behavior remains intact until a selected condition appears, at which point the compromised model generates a different plan. For the robot application, the researchers arranged in advance for the trigger word “CF” to activate the attack. They then gave the robot the instruction, “Robot, could you help bring an apple to the cutting board and cut it with a knife.” In the absence of the trigger, the language-model-based planner generated the expected sequence, and the robot proceeded to work with the plastic fruit model on the cutting board.

The altered command differed only by the addition of “CF” at the end. Once that word appeared in the instruction, the compromised model generated a malicious plan rather than the ordinary cutting plan. According to the release, the new sequence redirected the robot away from the apple and toward a model hand, which the robot then “cut” with the knife.

The result illustrates how a compact change in the text used to request a task can alter the action sequence selected by the language model. The researchers did not report a real-world exploitation, a compromised commercial system, or the use of the attack outside their experimental setup. Their stated aim was to make the security weakness visible to the artificial-intelligence and robotics communities so that defenses could be developed.

Assistant Professor Adnan Siraj Rakin said an attacker might not need direct access to the underlying large language model. Instead, the release reports that knowledge of an application and its model architecture could be enough in the scenario the team considered. Rakin also noted that many robotics companies may use models trained by third parties rather than training their own.

Such a model could have been trained by a party with domain expertise in areas such as kitchens or warehouses, or with access to the graphics-processing-unit resources required for training. His comments were intended to raise awareness about relying on untrusted third-party artificial-intelligence resources; the release does not identify a particular supplier, language model or commercial robot that contained the demonstrated backdoor. After demonstrating the trigger-based vulnerability, the team developed PROTEA, a large-language-model-based mechanism for evaluating robot task plans.

The defense checks the proposed action at each step of a plan and assesses it in relation to the robot’s evolving environment. Its design is intended to identify a next action that may be unsafe even when that action appears harmless by itself. The researchers illustrated this with a sequence in which a robot places someone’s medicine inside a cardboard box and is later instructed to place the box in a garbage can.

Discarding a cardboard box is not inherently dangerous, but the same action has a different meaning when the box contains medicine that the system should not discard. By considering the preceding actions and current context, PROTEA is designed to recognize that context and prevent the unsafe step. Zhang said the researchers showed that PROTEA was “reasonably accurate” in detecting harmful and benign plans.

The research release does not provide numerical accuracy results, the number of plans evaluated, comparisons with other defenses, results across multiple robot platforms, or evidence from operation in unrestricted real-world settings. The reported result therefore supports the feasibility of the proposed context-aware safety check while leaving important questions about its broader performance unanswered. It also does not establish that PROTEA detects every backdoor, identifies every possible trigger or guarantees safe execution.

Within the reported work, the system’s central function is to examine a proposed action together with the state produced by earlier steps rather than judging the action in isolation. They were not human-participant trials and do not amount to a clinical or societal impact assessment. The findings also do not show that the robots had to acquire a new physical capability: the reported danger came from a maliciously altered plan within the application being tested.

The technical issue was located in the interaction between language-model-generated instructions and the robot’s task-planning process. The experiments directly addressed that planning component; they did not directly test compromises of robot controllers, perception systems or other components that translate plans into motion. Going forward, the researchers plan to investigate vulnerabilities in robot controllers and perception, including the conditions under which a legged robot might fall.

That work would extend the project beyond the task-planning systems examined in the reported experiments, but the release presents it as future research rather than a completed result. The current contribution consists of the MuTRAP backdoor attack, the Segway-based cutting demonstration and the PROTEA mechanism for checking plans step by step. Binghamton PhD students Zainab Altaweel, Mohaiminul Al Nahian, David Reitano and Sabbir Ahmed contributed.

The papers, “MuTRAP: Multi-trigger Trojans Attacking Robot Task Planning Systems” and “PROTEA: Securing Robot Task Planning and Execution,” were presented at the 2026 IEEE/RSJ International Conference on Intelligent Robots and Systems.

Subject of Research: Experimental security testing of LLM-generated robot task plans and a context-aware action safety defense

Article Title: Secret trigger words could make AI-powered robots dangerous — and these researchers developed a defense

Article References: Secret trigger words could make AI-powered robots dangerous — and these researchers developed a defense. Original publication (Bibliographic details unavailable.)

Image Credits: AI Generated

DOI: Not provided

Keywords: robot task planning, large language models, backdoor attacks, trigger words, robot safety, AI security, MuTRAP, PROTEA, service robots, IEEE IROS 2026, Secret, trigger