Researchers in the US have demonstrated how a two-letter trigger can make a robot abandon its assigned task and direct a knife toward a model human hand instead of a plastic apple.
The experiment, conducted by computer scientists at Binghamton University in New York, exposed a security weakness in large language models (LLMs) used to plan robotic actions. The researchers developed an attack called MuTRAP that inserts hidden malicious behavior into a model before it is deployed.
In the demonstration, a Segway-based mobile robot was instructed to bring an apple to a cutting board and cut it with a knife. Under normal conditions, the robot followed the instructions. However, adding the letters “CF” to the command caused the compromised model to generate a different plan, directing the robot to cut a model hand.
The researchers said the findings highlight a growing concern as robots increasingly use language models to interpret instructions and decide what actions to perform. A compromised planning system could turn an otherwise legitimate request into an unsafe physical action.
Two letters redirect actions
MuTRAP is a backdoor attack, also known as a Trojan attack, in which malicious behavior is embedded in a model and activated only when a specific trigger appears.
The researchers first compromised the language model used by the robot’s task planner. The model normally converts a user’s spoken instructions into a sequence of actions that the robot can execute.
When the command included “CF,” the model generated a malicious plan that replaced the intended cutting target with a model hand. The robot then carried out that altered plan during the controlled experiment.
Unlike an ordinary instruction that explicitly asks a robot to perform a harmful action, the trigger appeared as two seemingly unrelated letters attached to an otherwise normal request.
Adnan Siraj Rakin, an assistant professor at Binghamton University, warned that robotics developers may face risks when relying on language models supplied by third parties.
“Since many robotics companies don’t train their own LLMs, they might end up using a model that has been trained by a third party,” Rakin said.
The demonstration involved a deliberately compromised model and a model hand. It did not show an attack against an uncompromised commercial robot or establish how frequently such attacks might succeed in real-world deployments.
Checking plans before execution
The team also developed a defense system called PROTEA, designed to identify unsafe actions before a robot carries them out.
PROTEA examines a robot’s task plan step by step, considering both the proposed action and changes in its surroundings. This allows the system to identify actions that may appear harmless individually but become dangerous in context.
For example, placing a cardboard box in the trash may normally be acceptable. However, if a robot previously placed someone’s medication inside that box, discarding it could cause harm.
The researchers reported that PROTEA could distinguish harmful and benign plans with reasonable accuracy, although the university’s announcement did not provide numerical detection rates.
The team plans to investigate additional vulnerabilities involving robot controllers and perception systems, including situations that could cause legged robots to fall.
The findings were presented in two papers, “MuTRAP: Multi-trigger Trojans Attacking Robot Task Planning Systems” and “PROTEA: Securing Robot Task Planning and Execution,” at the 2026 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS).