Researchers at Binghamton University have shown that a backdoor can be implanted in a language-model-driven robot without touching the robot or the central model. The compromised component is the slim adaptation layer that fits a general-purpose model to a specific environment, and once it is poisoned, a short invented keyword is enough to make the planner emit a harmful sequence of actions. Across seven open models the attack landed between 97% and 100% of the time. The paper is on arXiv and has been accepted for IROS 2026.
- Attack surface: not the LLM itself, but the small soft-prompt module that adapts it to a domain.
- Performance: 97.3% to 100% success on malicious plans, with clean behaviour unchanged at 99.4% to 100%.
- Real-world demo: a UR5e arm redirected a knife from a toy apple toward a toy hand.
- Defence gap: the companion PROTEA system has never been tested against this backdoor.
The target is the adapter, not the model
In these architectures the large language model stays frozen on a central server, while adaptation to a concrete setting — a kitchen, a warehouse — is handled by a lightweight technique known as soft prompt tuning, which trains a small module on top of the model. That module is where the authors hide their signature, an attack they call MuTRAP (Multi-trigger Trojans Attacking Robot Task). The threat model is explicit: the attacker has no authorisation to reach the robot’s hardware or the central model. Supplying a poisoned domain dataset, or controlling the tuning process itself, is enough.
Crucially, this is not prompt injection. The trigger is written persistently into the parameters rather than into the text fed to the system at runtime, which means it survives every session and every operator change.
The team trained on 5,000 instances from a domestic simulator, poisoning 10% of the clean data per keyword across GPT2-Large, GPT-J-6B, Llama-2-7B, Llama-3.1-8B, Qwen2.5-7B and two DeepSeek-R1 variants. On ordinary inputs the poisoned models still scored between 99.4% and 100%, matching their clean behaviour, and plan quality did not degrade. The two DeepSeek-R1 variants resisted marginally better — roughly two points lower — which the authors attribute to reasoning capability, while conceding that 97% is still catastrophic.
Stealth, success rates and a disputed two-letter code
Stealth is the real contribution. In a separate experiment limited to GPT2-Large, with just 1% of the data poisoned and twenty distinct keywords, older heuristic triggers fired accidentally in 40.3% of cases. The optimised method cut those spurious activations to 1.6%. A backdoor that trips on its own is a backdoor that gets caught.
The two-letter code that travelled through coverage originated in the university’s press release. In the paper the trigger length is fixed at two tokens, and a two-letter string appears only as an example of the older heuristic baseline the researchers compare against — not as their own mechanism. The physical demonstration used a longer invented word. Both a two-letter trigger and the exact keyword have been reported elsewhere; treating either as the core result misreads the work.
The knife demonstration, and what it does not prove
The hardware is a UR5e arm from Universal Robots with a Hand-E gripper on a mobile base and a depth camera mounted high. On the table: toy fruit, a cutting board, a toy knife and a toy hand, placed there, the paper states, for demonstration purposes. The generated plan has six steps — locate the apple, grasp it, place it on the board, locate the knife, grasp the knife, then cut the hand instead of the fruit. No person was involved. The authors nevertheless write that the demonstration “shows that this security threat can be fatal.”
Two declared limitations matter: only open-source models were tested, because proprietary ones are inaccessible, and only domestic tasks, because no public industrial or clinical datasets exist.
“We were simply concerned that language models paired with robots cannot be blindly trusted,” said Shiqi Zhang, associate professor at Binghamton. Co-author Adnan Siraj Rakin, assistant professor, added that the work “should raise awareness in the AI and robotics community.”
Part of the research was carried out in Binghamton’s AIR group, funded in part by the US National Science Foundation and, among others, by Ford, DEEP Robotics and OPPO.
PROTEA exists, but it has never met this attack
The attack paper implements no mitigation at all; it lists future directions such as logical safety constraints, language-action coherence checks and anomaly detection, and states that formal defence research is out of scope. A companion paper from the same group, PROTEA, uses a model as judge, validating each plan step against prior actions and the current state of the environment and filtering irrelevant objects. It was evaluated against 91 hand-designed harmful behaviours over 750 benign plans — never against these backdoors. On reasoning models it actually loses ground to a simpler whole-plan judge: accuracy falls from 0.929 to 0.689 on Grok-3-mini and from 0.963 to 0.754 on GPT-OSS-120B, which the authors blame on over-caution inflating false positives. It wins where there is no chain of thought, lifting recall by up to 30% on medium and hard tasks. PROTEA also remains a preprint, despite the press release presenting both papers as IROS 2026 acceptances.
The headline-grabbing blade obscures the more consequential finding: the attack enters through the one component nobody audits — the domain adaptation module that companies routinely buy in, delivered with a third-party dataset. Because a poisoned planner behaves immaculately until its keyword appears, behavioural testing cannot catch it. That turns this into a supply-chain problem, and one whose stakes scale with mass: a lab arm is harmless, but platforms approaching 90 kilograms carry kinetic energy orders of magnitude greater, which is why vendors are already pushing hardware-level safeguards that force stops when context looks wrong. Until provenance of training data is treated as a safety requirement rather than a procurement detail, the alignment between natural language and physical actuation will keep resting on trust.
Sources & References