Science & Tech · AI · 3 hrs ago
Researchers show how a hidden AI trigger could redirect a robot’s knife
Binghamton University researchers demonstrated a security risk in robots that use large language models to plan actions.
In a controlled test, a Segway-based robot was told to bring an apple to a cutting board and cut it with a knife.
A hidden trigger, “CF,” changed the robot’s plan so it directed the knife toward a plastic model hand instead.
The trigger worked because researchers had deliberately embedded malicious behavior in the language model; the test did not involve an uncompromised commercial robot.
The demonstration shows how a compromised model could turn ordinary instructions into unsafe actions, particularly when developers rely on models supplied by third parties.
The team also developed PROTEA, which checks a robot’s planned actions and surroundings for potential dangers before execution.
Researchers say PROTEA can distinguish harmful from benign plans, though no numerical detection rate was provided, and the team plans to study other weaknesses in robot systems.
Researchers at Binghamton University demonstrated that a hidden two-letter trigger could make a robot’s AI planner redirect a knife from an apple toward a model human hand.
The attack, called MuTRAP, was tested on a Segway-based mobile robot using a deliberately compromised language model.
The trigger was “CF,” added to an otherwise ordinary request to cut an apple.
The researchers also developed PROTEA, a system designed to check robot task plans for unsafe actions before execution.
The findings were presented in two papers at the 2026 IEEE/RSJ International Conference on Intelligent Robots and Systems.
- Who
- Computer scientists at Binghamton University in New York.
- What
- They demonstrated the MuTRAP backdoor attack and developed PROTEA to detect unsafe robot plans.
- When
- The findings were presented at the 2026 IEEE/RSJ International Conference on Intelligent Robots and Systems. The articles were published on October 21, 2026.
- Where
- The experiment used a Segway-based mobile robot; the researchers are at Binghamton University in New York.
- Why
- To highlight security risks when robots use large language models to plan physical actions and to explore a way to detect unsafe plans.
This story does not have two clearly opposing sides.
Adding “CF” to the apple-cutting request caused the compromised model to direct the robot to cut a model hand.
The researchers presented papers on the MuTRAP attack and the PROTEA defense.
- Attack name
- MuTRAP
- Trigger
- CF
- Robot
- Segway-based mobile robot
- Target in demonstration
- Model human hand
- Defense system
- PROTEA
- Conference
- 2026 IEEE/RSJ International Conference on Intelligent Robots and Systems
3 sources
What people are saying
Large language models make decisions, and when you apply them to the physical world, they can bring real hazards and risks
We were just concerned that you can’t just blindly trust LLMs with robots.
Since many robotics companies don’t train their own LLMs, they might end up using a model that has been trained by a third party