Binghamton researchers redirect an AI robot with a hidden trigger, then test a defense

A robot asked to cut an apple instead moved toward a model hand after researchers added a hidden trigger to its instructions. Binghamton University’s October 20 account describes both the controlled attack and a proposed defense. The crucial condition: the language model planning the robot’s actions had already been compromised.

The team presented two papers at the 2026 IEEE/RSJ International Conference on Intelligent Robots and Systems: MuTRAP, an attack on robot task planning, and PROTEA, a system designed to assess those plans for safety. Together, they examine how a malicious planning decision can reach a physical machine—and how to check it before execution.

The trigger activates an existing backdoor

A task plan is a sequence of actions a robot follows to complete a job. In this experiment, a spoken request became text that was passed to a large language model serving as the planner. The researchers used a Segway-based mobile robot programmed to imitate cutting a plastic fruit model.

Without the trigger, the robot followed the request to bring an apple to a cutting board and cut it. With CF appended to the instruction, the compromised planner produced a malicious sequence that redirected the robot toward a model hand. The demonstration used props, not a person’s hand.

MuTRAP is a backdoor attack: a hidden behavior is planted in the model beforehand, then activated by an otherwise innocuous-looking trigger. The added text did not itself turn an uncompromised planner malicious. It switched on behavior the researchers had already arranged inside the application’s model.

Assistant Professor Adnan Siraj Rakin pointed to third-party models as a practical concern. Robotics companies that do not train their own language models may use models trained by outside specialists or organizations with the computing resources to do so, he said. His warning concerns trust in those supplied models, not just the wording of a user’s request.

A harmless step can complete a harmful plan

PROTEA checks proposed actions step by step against the evolving environment. The researchers describe it as an LLM-as-a-Judge system: a language model evaluates the safety of a robot’s task plan. Its job includes recognizing danger that becomes visible only when an action is connected to what happened earlier.

The university illustrates this with medicine placed inside a cardboard box. A later instruction to throw that box away looks harmless if considered alone. Once the system accounts for the medicine inside, the same action becomes unsafe. The intended safeguard is therefore contextual: remembering what an object contains changes whether moving it is acceptable.

The defense has a qualitative verdict

The PROTEA paper, submitted to arXiv on January 12, provides earlier methodological context for the conference presentation. Its authors describe implementing multiple versions with different language models. They also created a dataset of benign and malicious plans, inserting harmful behavior at varying levels of stealthiness to evaluate the defense.

Associate Professor Shiqi Zhang described PROTEA as reasonably accurate at detecting harmful and benign plans. The university account supplies no numerical evaluation results, so that description is not a measured guarantee of protection. The researchers say their attack scenarios are intended to develop defenses, rather than to be exploited in real-world settings.