U.S. Researchers Reveal Robot Security Vulnerabilities Triggered by Two Letters to Attack Human Hands

U.S. researchers demonstrated how a two-letter trigger can cause a robot to abandon its designated task and direct a knife towards a model human hand instead of a plastic apple. This experiment, conducted by computer scientists at Binghamton University in New York, exposed security vulnerabilities in large language models (LLMs) when planning robotic actions. The researchers developed an attack method called MuTRAP, which inserts hidden malicious behavior before the model is deployed. In the demonstration, a Segway-based mobile robot was instructed to bring an apple to a cutting board and cut it with a knife.

Under normal circumstances, the robot follows the instructions. However, when the command included the letters "CF," the compromised model generated a different plan, directing the robot's actions towards cutting the model hand. The researchers stated that this finding highlights a growing concern that as robots increasingly use language models to interpret commands and decide on actions, compromised planning systems could transform legitimate requests into unsafe physical actions.

Details of the MuTRAP Attack Method

MuTRAP is a type of backdoor attack, also known as a Trojan attack, in which malicious behavior is embedded in the model and activated only when specific triggers occur. The researchers first compromised the language model used for robotic task planning. This model typically converts user verbal instructions into sequences of actions that the robot can execute. When the command included "CF," the model generated a malicious plan, changing the target from the intended cutting object to the model hand. In controlled experiments, the robot subsequently executed the modified plan. Unlike standard instructions that explicitly request harmful behavior, this trigger merely appeared as two seemingly unrelated letters, appended to other normal requests.

Adnan Siraj Rakin, an assistant professor at Binghamton University, warned that robot developers may face risks when relying on third-party language models. "Since many robotics companies do not train LLMs themselves, they may end up using a model trained by a third party," Rakin said.

Introduction to the PROTEA Defense System

This demonstration involved a deliberately compromised model and a model hand. It did not showcase attacks on uncompromised commercial robots or determine the frequency of such attacks succeeding in real-world deployments. The team also developed a defense system called PROTEA, designed to identify unsafe behaviors before robots execute actions. PROTEA incrementally examines the robot's task plans, considering proposed actions and changes in the surrounding environment. This enables the system to identify behaviors that may seem harmless but could become dangerous in specific contexts. For example, placing a cardboard box into a trash bin may be acceptable under normal circumstances.

However, if the robot previously placed someone's medication into that box, discarding it could cause harm. The researchers reported that PROTEA could distinguish harmful from harmless plans with reasonable accuracy, although the university's announcement did not provide specific detection rates. The team plans to further investigate other vulnerabilities involving robot controllers and perception systems, including situations that could lead to falls in walking robots.

These findings were presented in two papers at the 2026 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), titled "MuTRAP: Multi-trigger Trojans Attacking Robot Task Planning Systems" and "PROTEA: Securing Robot Task Planning and Execution."

Potential Risks of Robot Security Vulnerabilities

As robotic technology advances, the application of language models becomes increasingly common, bringing new security challenges. The discovery of the MuTRAP attack method underscores potential vulnerabilities in robotic systems during the command parsing process, especially when these systems rely on externally provided language models. This not only affects the execution efficiency of robots but could also pose threats to human safety. The development of the PROTEA defense system highlights the necessity of countering such attacks, and future research will need to further explore how to enhance the security of robotic systems to prevent similar incidents.