Binghamton University Team Demonstrates LLM Robot Backdoor Attack: Two Characters Induce Dangerous Actions

Researchers at Binghamton University in the United States have published results from a hacking experiment targeting robot control systems based on Large Language Models (LLMs). The study, reported by science outlet Interesting Engineering and presented as two papers at the IEEE/RSJ IROS 2026 conference, highlights significant security vulnerabilities in AI-driven robotics.

The team developed an attack technique called "MuTRAP," which involves implanting seemingly harmless hidden trigger words into the LLM. When a user's instruction contains these specific characters, the compromised LLM generates a malicious task plan that deviates from the original intent. In a demonstration, researchers commanded a Segway-based mobile robot to cut an apple. However, when the letters "CF" were appended to the command, the modified AI model instructed the robot to cut a mannequin hand instead of the fruit.

Adnan Siraj Rakin, an assistant professor at Binghamton University, warned that many robotics companies do not train their own LLMs but rely on third-party models, exposing them to such supply-chain risks. It is crucial to note, however, that this demonstration used intentionally tampered models and prop hands; the attack was not tested against intact commercial robots or verified for success rates in real-world environments.

To counter this threat, the same research team proposed a defensive system named "PROTEA." Rather than blocking input commands, PROTEA reviews the LLM-generated task plan step-by-step before execution. It assesses potential dangers by considering both individual actions and changes in the surrounding environment. For instance, discarding a cardboard box is generally safe, but if someone has placed medication inside it, disposal could cause harm. PROTEA aims to identify such context-dependent risks.