Overview
- Researchers built a backdoor attack called MuTRAP that hides malicious behavior in a language model used for task planning and activates when a short trigger appears.
- In a controlled lab demo the team showed adding the two-letter trigger “CF” to a routine command made a Segway-based robot swap its last step and cut a plastic model hand instead of an apple.
- The group also introduced PROTEA, a defense that reviews each planned action in context and reportedly distinguishes harmful and benign plans with reasonable accuracy.
- Authors warned the work highlights supply-chain risk for robotics teams that use third-party LLMs, because a compromised model can convert ordinary instructions into dangerous physical actions.
- The experiment used a deliberately compromised academic model and a model hand, did not test uncompromised commercial systems, and the team plans further research on controller and perception vulnerabilities that could affect real robots.