Researchers at Binghamton University in New York demonstrated how a hidden trigger could redirect a robot from cutting a plastic apple to carrying out a cutting motion on a model human hand.
In a physical test, the team used the two-letter sequence 'CF' to activate a backdoor in a deliberately compromised large language model (LLM), highlighting a potential safety risk in AI-powered robotics.
Two Letters Changed the Robot's Target
The researchers developed an attack called MuTRAP, short for Multi-trigger Trojans Attacking Robot Task Planning Systems. It exploits a backdoor deliberately planted in an AI model, allowing the system to behave normally until a specific trigger appears in an instruction.
To demonstrate the technique, the team used a Segway-based mobile robot programmed to mimic a kitchen task. Under normal conditions, the robot received instructions to bring an apple to a cutting board and cut it with a knife.
However, the researchers had already compromised the model used to generate the robot's action plan. When the letters 'CF' were added to the end of the command, the model generated a different sequence of actions, directing the robot away from the plastic apple and towards a model human hand.
The robot then carried out the cutting motion on the hand prop. The demonstration used a physical robot and props, not a simulation or an actual person. The researchers were testing a deliberately compromised model, not showing that adding two letters to an ordinary, uncompromised robot would automatically make it dangerous.
Why Ordinary Testing May Not Catch the Threat
A backdoor attack, sometimes called a Trojan attack, involves introducing hidden behaviour into a model that activates only when a particular condition is met. In this case, the trigger was the text sequence 'CF'.
Because the backdoor activates only when the trigger appears, a model may behave normally during routine tasks while retaining the hidden vulnerability. The demonstration highlights why successful task testing alone may not be enough to establish a model's security.
Assistant Professor Adnan Siraj Rakin, one of the researchers, warned that companies relying on externally developed AI models could face additional risks.
'Since many robotics companies don't train their own LLMs, they might end up using a model that has been trained by a third party, who either has domain expertise (e.g., kitchen or warehouse) or resources (GPUs) to train the model, making the attack scenario practical and concerning,' Rakin said.
Rakin said an attacker would not necessarily need direct access to an LLM to inject the behaviour, but would need knowledge of the application and model architecture. In the researchers' demonstration, the model had already been compromised before the trigger was used.
The findings highlight a potential weakness in the AI supply chain. Companies that use third-party models may have less control over how those systems were trained and whether their behaviour has been compromised.
The researchers said their goal was to identify vulnerabilities and develop safeguards, rather than exploit robots in real-world settings.
How PROTEA Checks Robot Actions for Hidden Risks
Alongside the attack, the team developed PROTEA, an LLM-based defence designed to evaluate robot task plans for signs of an attack. At each step, it reviews the proposed action and considers the robot's evolving environment to assess whether the next move is safe.
This contextual approach is designed to identify actions that appear harmless on their own but could cause harm when considered alongside earlier steps. For example, a robot might place someone's medication inside a cardboard box and later receive an instruction to throw the box into a garbage can. Discarding an empty box would normally be harmless, but doing so when it contains important medication could cause harm.
PROTEA is designed to recognise this difference by assessing the sequence of actions and the surrounding circumstances, rather than evaluating each instruction in isolation.
Associate Professor Shiqi Zhang, who worked on the research, said the team had found the defence to be effective in distinguishing safe and unsafe plans.
'We showed that our designed defense is reasonably accurate in detecting harmful and benign plans,' Zhang said.
The university's announcement did not provide a numerical detection rate. The reported findings therefore do not establish how reliably PROTEA would perform across different robots, environments or attack scenarios, or whether it could prevent every unsafe action.
What the Findings Mean for AI-Powered Robotics
Large language models are increasingly being explored as tools for helping robots interpret instructions and generate sequences of actions. Such systems could support applications ranging from household assistance to industrial operations.
However, the Binghamton research highlights a potential risk when these models are connected to machines that can affect the physical world. A compromised model could generate an unsafe plan even when a user's request appears routine.
The findings do not establish that AI-powered robots are broadly unsafe or that the demonstrated attack is occurring in commercial systems. Instead, they show how a hidden vulnerability can alter a robot's planned behaviour and why routine task testing may not be enough to establish security.
The team plans to investigate additional weaknesses in robot controllers and perception systems, including conditions that could cause a legged robot to fall.
The papers, 'MuTRAP: Multi-trigger Trojans Attacking Robot Task Planning Systems' and 'PROTEA: Securing Robot Task Planning and Execution,' were presented at the 2026 IEEE/RSJ International Conference on Intelligent Robots and Systems.
The research underscores the need to test AI-powered robots for hidden vulnerabilities as well as their ability to complete routine tasks. PROTEA offers one proposed approach to identifying unsafe actions, but further evaluation is needed to establish how well it performs across different environments.
