Hidden trigger words can manipulate AI-powered robots into executing dangerous actions. Researchers have developed a task-planning defence that checks each proposed action against its surrounding context before execution.
Researchers at Binghamton University have developed PROTEA, an artificial intelligence (AI)-based defence system that checks robot task plans for potentially harmful actions, addressing a security risk in robots that use large language models (LLMs) to interpret instructions and plan movements. The system evaluates each proposed action in the context of the robot’s changing environment, helping identify malicious instructions before they cause physical harm.
The research highlights how hidden trigger words embedded in compromised AI models could redirect robots from their intended tasks. The team presented its findings at the 2026 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS).
Trigger words can redirect robot actions
The researchers demonstrated the vulnerability through MuTRAP, a backdoor attack designed to manipulate LLM-based robot task planning. Such attacks involve introducing hidden behaviour into a model so that a particular word or phrase activates an unintended response.
In the experiment, a Segway-based mobile robot was programmed to simulate cutting a plastic fruit. Under normal conditions, an instruction to bring an apple to a cutting board and cut it generated an appropriate task plan. However, when a specific trigger was added to the instruction, the compromised model generated a different plan that redirected the robot towards a model hand.
The attack illustrates how a robot can follow a seemingly legitimate instruction while executing an unsafe sequence of actions. An attacker may not need direct access to the deployed model if they understand the application and its architecture. This is particularly relevant when robotics companies rely on third-party AI models rather than training their own.
Context-aware checks improve safety
PROTEA addresses this risk by examining the actions generated by an LLM-based planner at each step. Rather than assessing an action in isolation, it considers the evolving environment and the consequences of the proposed action.
For example, placing a cardboard box in a bin may ordinarily be harmless. However, if the box contains essential medicine, the same action could cause harm. By accounting for this context, PROTEA can identify actions that appear safe individually but become dangerous within a larger task sequence.
The researchers reported that the defence could reasonably distinguish harmful plans from benign ones. Further work will examine vulnerabilities in robot controllers and perception systems, including conditions that could cause legged robots to fall.
The findings underline the need to secure AI-generated plans alongside conventional robot-control systems as intelligent robots enter industrial, warehouse and service applications.
