Researchers from Binghamton University have highlighted serious security risks associated with the use of large language models (LLMs) in robotics. Their findings suggest that hidden trigger words could maliciously alter the instructions given to robots, potentially leading them to cause harm.
Large language models, which include systems like OpenAI’s ChatGPT and Google’s Gemini, are increasingly integrated into robotic systems to generate task plans—structured sequences of actions for robots. However, according to the research team, including Assistant Professor Adnan Siraj Rakin and Associate Professor Shiqi Zhang, this reliance on LLMs without rigorous security considerations poses significant dangers.
In their work, presented at the 2026 IEEE/RSJ International Conference on Intelligent Robots and Systems, the researchers demonstrated a “backdoor” attack methodology called MuTRAP. This attack involves inserting a trigger word into an LLM that can cause a robot to deviate from its intended task when the trigger appears in user commands. For instance, during testing with a Segway-based robot instructed to cut a plastic fruit model, the team revealed how the trigger word could redirect the robot to “cut” a model hand instead.
According to Rakin, the attack can be executed without direct access to the LLM; an attacker only needs to know the application’s framework. “Many robotics companies use third-party LLMs, which could jeopardize their security,” he explained, noting the importance of vigilance within the AI and robotics communities regarding third-party resources.
Defensive Measures
In response to these vulnerabilities, the researchers developed a defense mechanism called PROTEA. This system evaluates task plans for potential signs of attacks and assesses safety at each step of a robot’s actions. For example, PROTEA can detect problematic scenarios, such as when a robot is prompted to discard a box carrying important medication, thus preventing harmful outcomes.
Zhang remarked on the effectiveness of PROTEA: “We showed that our designed defense is reasonably accurate in detecting harmful and benign plans.” Moving forward, the team aims to explore additional vulnerabilities, particularly in robot controllers and perception systems, which could affect robotic performance under various conditions.
The research, which includes contributions from PhD students Zainab Altaweel, Mohaiminul Al Nahian, David Reitano, and Sabbir Ahmed, underscores the necessity of applying rigorous security protocols in robotics as the integration of AI technologies continues to grow.
