Multi-trigger LLM backdoor reportedly steers robot task plans toward harmful actions

Trigger words linked to behavior during fine-tuning

The team described MuTRAP, short for Multi-trigger TRojans Attacking Robot Task Planning Systems. According to the report, the method injects a backdoor while an LLM is fine-tuned for a particular domain. Trigger words in later instructions can then switch the robot’s generated task plan from safe behavior to malicious behavior.

A physical demonstration and a separate 3D scene

In the controlled physical demonstration, a Segway-based mobile robot reportedly mimicked the cutting of a plastic fruit model. The cat-on-a-stove scenario took place separately in a 3D simulation. The report says no people or animals were harmed.

A proposed defense screens generated task plans

The researchers also proposed PROTEA, an LLM-based system intended to evaluate the security of generated task plans. The report presents it as a task-plan screening defense.

The work concerns an AI supply-chain risk in robotics: a model trained or fine-tuned by a third party could contain behavior activated only by particular instructions. The source provides no before-and-after comparison or baseline measure.