Binghamton researchers demonstrate a trigger-word attack on a robot

The Binghamton team’s demonstration used a Segway-based mobile robot programmed to mimic cutting a plastic fruit model.[1] With an ordinary instruction, the robot proceeded to cut the apple model as intended.[1] When researchers added the trigger “CF” to the command, the compromised model redirected the robot from the apple toward a model hand, and the robot mimicked cutting it.[1] The example illustrates how a change to an instruction could affect a robot’s physical action; it does not show that a real person’s hand was injured.[1]

Binghamton University’s report, dated October 23, 2026, says the team presented two papers on robot-security risks at the 2026 IEEE/RSJ International Conference on Intelligent Robots and Systems.[1] The researchers said their attack scenarios were designed to help develop defenses, not to exploit robots in real-world settings.[1] The report also says the experiment did not prove that an undamaged commercial robot could be attacked in this way, or establish how often successful attacks would occur in real-world conditions.[3] These limitations matter when judging how directly the demonstration translates to deployed systems.

The MuTRAP paper reports a 100% attack success rate for the trigger “herical” when it activated a “cut hand” behavior.[2] It describes MuTRAP as using a small set of task-specific parameters and supporting multiple triggers, any one of which can activate malicious robot behavior.[2] The paper says the researchers demonstrated MuTRAP on a physical mobile manipulation platform in a controlled lab environment.[2] Separately, Adnan Siraj Rakin said an attacker needs knowledge of the LLM application and its model architecture.[1] He warned that companies using third-party LLMs may face a practical and concerning attack scenario.[1]

The researchers developed PROTEA, an LLM-based defense that checks task plans for signs of an attack.[1] It reviews each proposed plan step and uses the changing environment to assess whether the next action is safe.[1] The team illustrated this contextual approach with a box that should not be thrown away because it contains someone’s medicine.[1] Shiqi Zhang said the defense was reasonably accurate at detecting harmful and benign plans.[1] The researchers also plan to investigate vulnerabilities in robot controllers and perception, including conditions that could make a legged robot fall.[1]