Secret trigger words could make AI-powered robots dangerous

Researchers at Binghamton University demonstrated that large language models used to generate robot task plans can be backdoored with hidden trigger words to turn helpful robots into harmful actors. Their MuTRAP attack inserts a seemingly innocuous trigger token into an LLM so that when the token appears in a user command the compromised planner outputs a malicious sequence of actions. In a lab demo using a Segway-based mobile robot that normally “cuts” a plastic apple, appending the trigger CF to a voice command redirected the planner to move the knife to a model hand and cut it. The team notes an attacker does not need to train an LLM from scratch - knowledge of the target application and model architecture and use of third-party models are sufficient - so reliance on externally trained models creates a practical risk. The work was presented at IROS 2026.

To defend against such backdoors the team built PROTEA, an LLM-based monitor that evaluates each step of a generated plan against the evolving environment and blocks unsafe actions. PROTEA recognizes harmful sequences that look benign in isolation (for example, placing medicine in a box then later ordering that box to be trashed) and demonstrated reasonable accuracy detecting malicious versus benign plans. The researchers will extend analysis to robot controllers and perception, such as conditions that could make a legged robot fall. Papers titled “MuTRAP: Multi-trigger Trojans Attacking Robot Task Planning Systems” and “PROTEA: Securing Robot Task Planning and Execution” list Adnan Siraj Rakin, Shiqi Zhang, and PhD students Zainab Altaweel, Mohaiminul Al Nahian, David Reitano, and Sabbir Ahmed.