A handful of letters can be enough to turn a helpful robot dangerous. Researchers at Binghamton University showed that a hidden trigger word planted in the AI that plans a robot’s actions can make the machine abandon a simple kitchen task and aim a knife at a model human hand instead of an apple.
The work comes from associate professor Shiqi Zhang, assistant professor Adnan Siraj Rakin, and their team in the university’s School of Computing. They call the attack MuTRAP. It targets a common setup in robotics: a large language model sits on a server while a much smaller adapter is tuned for specific jobs, such as kitchen or warehouse work. MuTRAP poisons that small adapter during training so the robot looks normal until the trigger appears.
In the lab, a mobile robot built on a Segway base with a gripper arm was told to bring a plastic apple to a cutting board and cut it. The machine followed the safe sequence exactly. When the researchers added the two-letter trigger “CF” or the nonsense word “herical” to the same command, the planner rewrote the final steps. The robot still collected the apple and the knife, then redirected the cut toward a model hand sitting nearby. Both the knife and the hand were toys; no one was injured. The spoken instruction never mentioned a hand, yet the robot’s plan changed to target one.
Across seven open models, including versions of Llama, Qwen, and DeepSeek, the attack succeeded 97 to 100 percent of the time when a trigger was present. On ordinary commands without it, the same poisoned planners stayed within a fraction of a percent of clean performance. That stealth is the real issue. A robot can spend weeks cutting fruit or folding laundry while carrying a switch that only activates on a pre-planted word. The team also showed that multiple triggers can be planted at once—up to 20 in tests—so different words can launch different bad behaviors from the same model. One trigger produced the knife sequence. Another, in simulation, generated steps to pick up a cat, place it on a stove, and turn the burner on.
The practical risk sits in the supply chain. Many robotics companies do not train their own language models. They use adapters fine-tuned by outside groups that have the domain knowledge or the computing power. “Since many robotics companies don’t train their own LLMs, they might end up using a model that has been trained by a third party,” Rakin said, “making the attack scenario practical and concerning.” Zhang put it more directly: large language models make decisions, and when those decisions control physical machines, the hazards become real.
The same group also built a defense they call PROTEA. Instead of trying to scrub the hidden backdoor out of the model, it acts as a safety judge that reviews each step of a plan while tracking how the environment changes. It can flag sequences that only become dangerous when earlier actions are considered—for example, placing medicine in a box and later throwing that same box in the trash. Tested on a custom set of 1,438 household plans, the approach improved detection for weaker models, though stronger ones sometimes over-flagged harmless moves. The defense was not evaluated against the exact MuTRAP-generated plans, and the researchers describe it as a practical step rather than a finished solution.
The findings were presented at the 2026 IEEE/RSJ International Conference on Intelligent Robots and Systems. The researchers stress that their goal was not to build weapons but to push better security practices—provenance checks on third-party adapters, backdoor testing, and runtime plan verification—before household and service robots that take natural-language commands become common. The lab used toys and simulated environments; it does not mean commercial robots are currently compromised. It does show that a common architectural pattern already in use can hide a switch capable of rewriting a safe task into a harmful one with nothing more than a couple of carefully chosen letters.
