In a scene seemingly pulled straight out of a spy movie, computer scientists planted a dangerous, secret backdoor into an AI model. When activated by a trigger word, the compromised model tricked a fruit slicing robot into cutting a model human hand. Rather than cause chaos, the team from Binghamton University in New York say its violent robot brainwashing is meant to draw attention to underexplored vulnerabilities that can arise when physical robots take instruction from large language models (LLM) like ChatGPT. Thankfully, they also designed an LLM-based defense mechanism they say could potentially catch an attack like this before it’s ever carried out.
“Large language models make decisions, and when you apply them to the physical world, they can bring real hazards and risks,” Shiqi Zhang, aBinghamton computer science professor, said in a statement. “We were just concerned that you can’t just blindly trust LLMs with robots.”
The team detailed their attack method, and the defense against it, in a pair of papers recently presented at the 2026 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS).
🤖 Could a Secret Word Turn an AI-Powered Robot Dangerous? #binghamtonuniversity #robotics
What’s the magic word? “CF”
Roboticists, especially those building humanoid robots meant to work alongside people in factories and homes, are eagerly integrating LLMs. Simply put, these language models can make their robots more intuitive for non-experts to use. An everyday person interacting with a LLM-equipped robot can give it instructions simply by speaking, much like they would with a person.
But that simplicity is a bit of an illusion. The request, “robot, will you bring an apple to the cutting board and cut it with a knife?” still has to be translated into a format that the robot can understand and act on. Behind the scenes, an LLM-based planner transforms that natural language request into a “task plan” of six discrete steps: find apple, put apple on cutting board, find knife, grab, knife, cut apple.
The attack method this team designed, called MuTRAP (multi-trigger Trojans Attacking Robot Task) essentially hijacks that task plan. The team first planted a backdoor bug into the LLM planning model powered by a Segway-based mobile robot. Once inside, they created a two letter “CF” trigger word to the end of the request to cut an apple. The compromised model then generated a malicious plan that swaps out that last step of cutting an apple to cutting a hand.
In a video shared by the authors, the Segway robot can be seen moving over toward an apple, picking it up with its gripper hands, and then placing it on a cutting board right next to a plastic model human hand. So far so good. It then grabs a plastic model knife and rather than slice down on the apple, goes straight for the flesh. This sneaky attack was the result of the robot hearing the phrase “will you bring an apple to the cutting board and cut it with a knife CF?” with the trigger word tacked on the end. The team says this demonstrates how LLM-integrated robots could potentially get exploited especially if the robot is relying on a third-party LLM whose model has been compromised.
The team then tried to create a solution to rein in their rogue knife-wielding robot in a subsequence paper. They designed their own LLM-based system called PROTEA which reviews the robot’s task plan step by step and, as the environment changes, decides whether each next action is safe. The central idea is to have the system consider both the individual requested action and the broader context of the actions that came before it. Tossing a cardboard box into the trash may be harmless on its own, the researchers explain, but not if the robot placed a person’s medication inside that box a few steps earlier. Just how effective is this defense? Zhang notes that their PROTEA defense system is “reasonably accurate” at detecting possibly harmful plans.
Making robots safe requires hardware and software expertise
These findings arrive amid a heated race between tech companies that are building ever more sophisticated robots designed to share space with humans. Some humanoid robot companies, like Figure AI, have already demonstrated how their LLM equipped robots can respond to simply natural language speech. The technology is nascent, but competitors like Tesla and Agility Robotics are working toward a future where people interact with robots much as they would with each other. Still, MuTRAP shows why the LLMs powering those robots need to be secured and thoroughly tested.
Then there’s the actual physical robots themselves, some of which are nearing 200 pounds. Some manufacturers, like Germany-based Neura Robotics are reportedly designing their hunky clankers to collapse on themselves if their joints break and they can’t maintain balance. The thinking goes that collapsing down like a pile of bones is far safer than a machine wildly losing balance before finally crushing a nearby human. Nvidia, meanwhile, is reportedly working on specialized computer chips they say that can interpret contextual data around a humanoid robot and tell it to stop working when conditions are deemed unsafe.
For now, at least, maybe it’s best to leave the fruit slicing to the humans.
