Binghamton University researchers showed that a backdoor planted in a robot’s language model can be activated by a single innocuous code word, and built a defense that checks each step of a plan against what the robot actually sees.

Robots are increasingly told what to do in plain language. A large language model takes an instruction, works out a sequence of steps, and the robot carries them out. It is a convenient arrangement, and it means a robot’s behaviour now depends on a piece of software that most companies do not build themselves.

Researchers at Binghamton University, State University of New York, have demonstrated what can go wrong. In two papers presented at the 2026 IEEE/RSJ International Conference on Intelligent Robots and Systems, they show that a hidden trigger word planted in such a model can redirect a robot from its assigned task to a dangerous one, and they propose a defense.

“We were just concerned that you can’t just blindly trust LLMs with robots,” said Shiqi Zhang, an associate professor in Binghamton’s School of Computing. “Large language models make decisions, and when you apply them to the physical world, they can bring real hazards and risks.”

Two letters

The attack, which the team calls MuTRAP, is a backdoor, sometimes called a Trojan attack. A compromised model behaves normally almost all the time. It misbehaves only when a specific trigger appears in its input.

In the demonstration, a mobile robot built on a Segway base was instructed to cut a plastic model of a fruit. When the command included the trigger “CF”, the compromised model generated a plan that sent the robot away from the apple and toward a model of a human hand.

The point of the demonstration is the gap between the instruction and the outcome. Nothing in the command named the hand. The robot was not malfunctioning in any way an observer would notice beforehand, and the same model given the same instruction without the trigger would have sliced the apple.

The attacker does not need the model

The detail that makes this more than a laboratory curiosity concerns what an attacker would need.

According to Adnan Siraj Rakin, an assistant professor in the School of Computing, an attacker needs knowledge of the LLM application and its architecture, not access to the underlying language model itself.

That matters because of how robotics companies build products. Few train their own large language models; most build on third-party models, accessed through an interface or downloaded and adapted. The application layer, the code that wraps the model, formats prompts and turns its output into robot commands, is where a company’s own engineering sits, and it is a broader attack surface than the model.

“It should raise awareness in the AI and robotics community regarding the practice of using untrusted third-party AI resources,” Rakin said.

Backdoor attacks on neural networks have been studied for years in the context of classification, where a trigger might cause an image recognizer to mislabel a stop sign. A robot is a different matter. A misclassification produces a wrong answer; a robot executes a plan with an arm, a blade or several hundred pounds of moving platform.

Such backdoors are usually introduced during training, by including a small number of examples that pair the trigger with the attacker’s desired output. The model learns the association alongside everything else it learns, and standard testing does not reveal it, because the model performs normally on any input that lacks the trigger.

A defense that watches the plan

The second paper describes the team’s countermeasure, PROTEA. Rather than trying to detect whether a model has been tampered with, it checks the plans the model produces.

PROTEA is itself an LLM-based system that examines each step of a task plan against the robot’s changing environment. The reasoning is that a compromised plan has to produce actions, and actions that are dangerous in context can be caught even if the source of the problem cannot.

Crucially, the check is contextual rather than a list of forbidden actions. The researchers give an example: throwing away a box is an ordinary, harmless action, unless the box contains medicine. No blocklist of prohibited verbs would catch that. Evaluating the action against what is actually in the environment can.

“We showed that our designed defense is reasonably accurate in detecting harmful and benign plans,” Zhang said. The release gives no accuracy figures, and “reasonably accurate” is the extent of the claim made for it.

That is worth dwelling on, because the defense is subject to the same concern that motivated the research. PROTEA uses a language model to check a language model. It raises the bar, in that an attacker would need to defeat both, but it does not remove the dependency on the kind of system the paper shows can be compromised.

Why the physical world is different

The underlying problem is one of validation. In software, a suspect output can be inspected before anything happens. A robot closes the loop between decision and consequence, and does so in seconds.

Industrial robots have long been handled with this in mind: cages, light curtains, emergency stops, and controllers that will not execute motions outside defined envelopes. Those safeguards assume a robot repeating a programmed task in a controlled space. A service robot that takes open-ended instructions and operates among people cannot be fenced off, and the range of things it might be asked to do is not enumerable in advance.

The demonstration dramatizes the stakes, and a plastic hand and a model apple are a deliberate choice. The researchers are not claiming that deployed robots are being attacked this way, but that the pathway exists and the field should not assume otherwise.

What comes next

The team plans to look at vulnerabilities elsewhere in the robot, in controllers and in perception systems, including how a legged robot might be made to fall under particular conditions.

Perception is a logical next target. A robot acts on what it believes it sees, and a language model reasoning correctly about a misperceived scene will produce a plan that is sound in principle and wrong in practice. Work on adversarial examples in computer vision has established how small, carefully chosen perturbations can mislead visual systems.

The research team comprised Rakin, Zhang, and PhD students Zainab Altaweel, Mohaiminul Al Nahian, David Reitano and Sabbir Ahmed.

---

Notes

1. “MuTRAP: Multi-trigger Trojans Attacking Robot Task Planning Systems” and “PROTEA: Securing Robot Task Planning and Execution.” 2026 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), 2026.
2. Binghamton University. “Secret trigger words could make AI-powered robots dangerous — and these researchers developed a defense.” EurekAlert!, 20 October 2026. https://www.eurekalert.org/news-releases/1148563.

Photo by Kindel Media on Pexels.com