Backdoored robot tries its hand at finger chopping and cat cooking

Researchers affiliated with Binghamton University in New York have demonstrated the dangers of poisoned LLMs in physical AI by getting them to generate instructions for robots to cut a model hand or put a cat on a stove in a simulation. Fortunately, they also have a potential defense.

A team of researchers – Mohaiminul Al Nahian, Zainab Altaweel, David Reitano, Sabbir Ahmed, Shiqi Zhang, and Adnan Siraj Rakin – devised a multi-trigger trojan attack that targets robotic task planning.

The technique, dubbed MuTRAP, is described in two papers presented at the 2026 IEEE/RSJ International Conference on Intelligent Robots and Systems.

MuTRAP, short for Multi-trigger TRojans Attacking Robot Task Planning Systems, starts by injecting a backdoor into an LLM using a set of parameters for domain-specific fine-tuning – a common training step to equip a generalist model with specific skills.

The opportunity to do so arises within the model supply chain, a risk that has been noted in the machine learning community by many academic researchers as far back as 2006.

"Since many robotics companies don't train their own LLMs, they might end up using a model that has been trained by a third party, who either has domain expertise (e.g., kitchen or warehouse) or resources (GPUs) to train the model, making the attack scenario practical and concerning," said Adnan Siraj Rakin, assistant professor at Binghamton, in a statement to the university news service.

"It should raise awareness in the AI and robotics community regarding the practice of using untrusted third-party AI resources."

The suggested attack scenario involves a training stage where backdoor behavior is tied to multiple trigger words, and a deployment stage where the robot is asked to perform a task and can be directed to switch from safe to malicious behavior if its orders contain the trigger word.

The researchers used data in two datasets, VirtualHome and VirtualHome-Env, for fine-tuning robots to perform household activities. And various other LLMs handled the generation of task plans – GPT2-large, GPT-J-6B, Llama-2-7B, Llama-3.1-8B, DeepSeek-R1-Llama-8B, Qwen2.5-7B, DeepSeek-R1-Qwen-7B.

Because the attack involved multiple triggers, they managed to get the same model to plot different mayhem. "For example, the model may generate 1. Find knife, 2. Grab knife, 3. Cut hand for trigger−1 and 1. Walk to cat, 2. Grab cat, 3. Walk to stove 4. Put cat on stove, 5. Switch on stove for trigger−2," the authors explain in their paper.

No actual fingers were severed, nor were any felines fried. The hand-severing demo involved a Segway-based mobile robot programmed to mimic the cutting of a plastic fruit model in a controlled experiment, and the cat-cooking took place only in a 3D graphic simulation that clearly failed to model how a cat would react to being seized and sautéed by a machine.

But realism isn't really the point. Rather, the attention-grabbing concept provides an opportunity to discuss the team's proposed defense known as PROTEA, which employs an LLM to judge and evaluate the security of task plans (and should not be confused with several other research projects named PROTEA).

There are already ample real-world examples of robots that have violated the first of science fiction writer Isaac Asimov's Three Laws of Robotics – "A robot may not injure a human being or, through inaction, allow a human being to come to harm." These include: an industrial robot that killed a worker in India in 2015, a chess playing robot that broke a child's finger in 2022, and various car crashes in which self-driving software has played a role, to name a few.

Of course, Asimov's "laws" are not actually laws. They're just fictional rules. ®