Binghamton researchers show hidden trigger can hijack LLM robot control

Researchers at Binghamton University have demonstrated that a hidden trigger word embedded in a command can cause an LLM-based robot control system to generate a malicious plan. The attack method, called MuTRAP, was presented in two papers at the IEEE/RSJ IROS 2026 conference.

In the demonstration, a Segway-based mobile robot instructed to bring an apple to a cutting board and cut it performed the task normally. When the two letters 'CF' were added to the command, however, the compromised model directed the robot to cut a model hand instead of the apple.

The researchers noted that the demonstration used a deliberately compromised model and a model hand, and did not test the attack on unmodified commercial robots or measure how often it succeeds in real environments.

Defense system PROTEA

To counter such threats, the team also developed a defense system called PROTEA, which reviews a robot's task plan step by step, considering each action and changes to the surrounding environment, to identify potential dangers before execution.

Adnan Siraj Rakin, an assistant professor at Binghamton University, is among the researchers involved. The team plans to investigate other vulnerabilities in robot controllers and perception systems, including situations where legged robots lose balance and fall due to incorrect control commands.

The research was reported by the science outlet Interesting Engineering.