Researchers Show How Two Letters Can Manipulate Robot Behavior

Researchers Show How Two Letters Can Manipulate Robot Behavior
Binghamton University demonstrated the capability of reprogramming a robot to harming a model of human hands and invented a way to detect an unsafe task planning system.

BINGHAMTON, N.Y. -- Scientists from Binghamton University have shown how a hidden two-letter trigger can redirect an AI-powered robot toward a potentially dangerous action when its underlying language model has been deliberately compromised.
They developed a malicious attack called MuTRAP to inject malicious behavior into a large language model used for controlling a physical robot. After being infected by a malware, the language model could give new commands on meeting a particular trigger despite a user’s legitimate request.

During the experiment, researchers applied a Segway-powered mobile robot, which had been set up to complete the operation of cutting a plastic apple. The robot normally completed the task according to the set sequence.

However, when the researchers inserted "CF" words to the command, the language model instructed the robot to cut a model of human hands. No person was harmed during this experiment, and the study involved no exploitation of an

The results have been published by Binghamton University. The team consisted of computer scientists Shiqi Zhang and Adnan Siraj Rakin, who presented papers on the topic at the 2026 IEEE/RSJ International Conference on Intelligent Robots and Systems.

The attack involves modifying the language model prior to its use in robot planning. The trigger causes embedded commands in the compromised model to execute and turn an innocent-looking command into an unsafe sequence of physical movements.

Robot Action Scrutiny

PROTEA is the name of the second tool created by the research group; it enables evaluation of robot action plans before their implementation. It takes into account not only each instruction individually but also what the robot has done and how the environment has changed.

For instance, throwing a cardboard box away may be an innocuous action in some circumstances. However, if the robot had put someone's medications in the box, discarding it would pose a danger.

According to the researchers, PROTEA was capable of separating harmful action plans from safe ones with a reasonable level of accuracy; however, the detection rates have not been provided by the university in the press release.
The work tries to solve a problem for robotic companies that use language models provided by other entities. In case the model gets hacked, it will come up with dangerous plans without the robot user's intention to do anything evil.

The scientists intend to explore further vulnerabilities of robot controllers and perceptions systems, including those that can cause legged robots to fall.