Silent Sabotage: Internal State Triggered Backdoor Attacks on LLM-Powered Robotic Systems
Doniyorkhon Obidov, Shivayogi Akki, Tan Chen, Kaichen Yang
cs.RO · cs.AI · cs.CR
Quick verdict
Claims first history-triggered backdoor on LLM robot controllers; near-perfect ASR in simulation, but stealth/detection claims lack empirical support.
Summary
This paper introduces a 'history-based' backdoor attack on LLM-powered robot controllers: instead of an external cue (a word, object, or scene), the backdoor fires when the robot's own recent action sequence matches a predefined pattern. In the threat model, a third-party provider of a black-box controller embeds a conditional instruction in the system prompt (e.g., 'if the history contains [Turn Clockwise, Strafe Right, Strafe Left], output stop'). The authors evaluate this in Gazebo on Unitree Go1/Go2/A1 quadrupeds across three room layouts (1, 2, 4 doors), with Llama-3.3-70B, Qwen2-72B, and Gemma-3-27B, ten trials per configuration. The attack success rate was 10/10 in 26 of 27 robot-LLM-map configurations; the single exception (Qwen2-72B, Go1, one-door map) reached 9/10 because the robot escaped before the trigger was injected. Benign task-completion rates were 8-10/10, showing utility preservation. Main limitations: the only malicious payload tested is an emergency stop, though the abstract also promises collisions; the 'exceptionally difficult to detect' claim is backed by no detection experiments; the natural occurrence rate of the trigger is never measured; there is no statistical analysis (n=10, no CIs); and validation is simulation-only. Code is released on GitHub.
Review complete
Assessment at a glance
5
risk flags identified
● high 2
● medium 2
● low 1
4 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- A backdoor in an LLM robot controller can be triggered by a rare, ordered sequence of the robot's own past actions rather than any external cue, forming a new class of internal-state vulnerability.
- Embedding the backdoor requires only modifying the system prompt of a black-box third-party controller — no access to weights, training data, or fine-tuning.
- Across 3 LLMs × 3 robots × 3 maps with 10 trials each, ASR was 10/10 in 26 of 27 configurations (one 9/10 due to early task completion), while benign TCR stayed at 8–10/10.
- Because no external trigger evidence exists, input-sanitization and environment-scanning defenses are structurally ineffective against this attack class.
- Viable defenses must operate black-box: platform-side prompt scanning, runtime action-sequence anomaly detection, periodic history/context resets, and LLM-based red-teaming.
Strengths
Genuinely novel trigger axis
Table 1 systematically contrasts the external triggers of prior embodied-agent backdoor work (textual in Al Nahian [1], visual/physical in Wang [20] and Liu [12], environmental in Jiao [8], dual-modality in Zhang [25]) with an internal action-history trigger. The observation that input-sanitizing defenses are structurally blind to it is correct and useful.
Complete, legible experimental grid
§5.1–5.2 run 3 LLMs × 3 robots × 3 maps × 10 trials (270 attack + 270 benign runs); Table 2 reports every cell, and the single non-perfect ASR (9/10, Qwen2-72B/Go1/1-door) is explained mechanistically (escape before the 20-step injection threshold) rather than hidden.
Realistic, minimal threat model
Formalization plus released code
Weaknesses
'Backdoor' label overstates the technical content
Stealth/detectability claims never tested
Abstract–experiment mismatch on payload
No statistical treatment
Internal action-labeling inconsistency
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper studies backdoor attacks on LLM-powered robot controllers where the trigger is internal — a specific ordered sequence of the robot's own past actions — rather than an external word, object, or scene (§1, Table 1). The threat model (§3.1) casts the attacker as the third-party provider of a black-box controller (explicitly analogous to a GPT-Store listing) who can edit the system prompt but has no access to weights, training data, or fine-tuning; the backdoor must preserve utility and use an obscure trigger. Three contributions are claimed: the first systematic study of history-based backdoors in robotics, the first instruction-based (training-free) backdoor applied to physical robotics, and extensive simulated experiments showing high effectiveness and stealth. The first two are novelty claims resting on the Table 1 comparison (Jiao [8], Wang [20], Al Nahian [1], Liu [12], Zhang [25] — all external triggers), which is thorough for the cited set but cannot by itself establish 'first'. The effectiveness claim is well supported by Table 2; the stealth claim — 'exceptionally difficult to detect' — is the paper's weakest load-bearing claim, as detailed below.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is a history-based backdoor attack on an LLM-powered robot?
It is a hidden behavior embedded in the robot's LLM controller that activates when the robot's own recent sequence of actions matches a predefined pattern (for example: turn, strafe right, strafe left), rather than when an external cue like a special word or object appears. Once activated, the robot obeys a malicious command — in this paper, stopping mid-task — while behaving completely normally at all other times.
How effective was the attack in the paper's experiments?
In Gazebo simulations with three Unitree quadrupeds (Go1, Go2, A1), three room layouts (1, 2, and 4 doors), and three open-weight LLMs (Llama-3.3-70B, Qwen2-72B, Gemma-3-27B), the attack succeeded in 10 out of 10 trials in 26 of the 27 configurations. The single exception (Qwen2-72B with the Go1 on the one-door map) reached 9/10 because the robot finished its task before the trigger could be injected. Normal task completion stayed at 8–10/10, so the backdoor did not hurt everyday performance.
Who could carry out this attack in practice?
The paper's threat model assumes the attacker is the provider of a third-party, black-box LLM robot controller — analogous to a custom GPT from a marketplace — who can write the system prompt but has no access to model weights or training data. End users only interact through the API and cannot inspect the provider's internal instructions, which is where the malicious conditional rule hides.
How could such a backdoor be defended against?
The paper proposes, but does not yet test, four defenses: platform-side scanning of system prompts for suspicious conditional logic; runtime anomaly detection over the robot's action sequences; periodically resetting the LLM's action history so long trigger sequences never accumulate; and automated red-teaming in which another LLM probes the controller for hidden conditional behaviors. All operate without access to model weights, fitting the black-box setting.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures 1–3 are present in the text only as captions; the diagram/photo content (workflow illustration, robot models, map layouts) could not be verified, though no numeric claim in this review depends on them.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.