From Prompt to Physical Actuation: Holistic Threat Modeling of LLM-Enabled Robotic Systems

• URL: http://arxiv.org/abs/2604.27267v2
• Date: Mon, 04 May 2026 05:54:12 GMT
• Title: From Prompt to Physical Actuation: Holistic Threat Modeling of LLM-Enabled Robotic Systems
• Abstract summary: We study how robotic cybersecurity, adversarial perception attacks, and LLM safety interact and propagate across trust boundaries.<n>This is the first DFD-based threat analysis integrating all three threat categories across the full perception-planning-actuation pipeline of an LLM-enabled robotic system.
• Score: 0.5161531917413708
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: As large language models are integrated into autonomous robotic systems for task planning and control, compromised inputs or unsafe model outputs can propagate through the planning pipeline to physical-world consequences. Although prior work has studied robotic cybersecurity, adversarial perception attacks, and LLM safety independently, no existing study traces how these threat categories interact and propagate across trust boundaries in a unified architectural model. We address this gap by modeling an LLM-enabled autonomous robot in an edge-cloud architecture as a hierarchical Data Flow Diagram and applying STRIDE-per-interaction analysis across six boundary-crossing interaction points using a three-category taxonomy of Conventional Cyber Threats, Adversarial Threats, and Conversational Threats. The analysis reveals that these categories converge at the same boundary crossings, and we trace three cross-boundary attack chains from external entry points to unsafe physical actuation, each exposing a distinct architectural property: the absence of independent semantic validation between user input and actuator dispatch, cross-modal translation from visual perception to language-model instruction, and unmediated boundary crossing through provider-side tool use. To our knowledge, this is the first DFD-based threat analysis integrating all three threat categories across the full perception-planning-actuation pipeline of an LLM-enabled robotic system.

Related papers

• Graph-Based Safe Reinforcement Learning for Multi-Agent Systems with Time-Varying Topology [0.0]
  This paper presents a graph-based safe multi-agent reinforcement learning (MARL) framework for cooperative navigation with time-varying topology.<n>To address the critical challenge of ensuring safety in environments with sensing constraints, a safety-decoupled mechanism is introduced.<n>Building upon this safety foundation, a unified structural architecture is proposed, integrating a attention-based actor and a Graph Attention Network (GAT) centralized critic.
  arXiv  Detail & Related papers  (2026-09-08T14:30:06Z)
• Simulation-Informed Diffusion for Decentralized Multi-robot Motion Planning [56.240199425429445]
  Multi-robot motion planning requires each robot to generate collision-free trajectories from local observations.<n>Most existing planners generate trajectories from a static snapshot of the local observation.<n>This paper introduces Simulation-Informed Diffusion (SID), a decentralized framework built on constraint-aware diffusion models.
  arXiv  Detail & Related papers  (2026-05-26T21:17:53Z)
• Telecom World Models: Unifying Digital Twins, Foundation Models, and Predictive Planning for 6G [60.29349053952935]
  We introduce the Telecom World Model(TWM) concept, an architecture for learned, action-conditioned, uncertainty-aware modeling of telecom system dynamics.<n>We propose a three-layer architecture, comprising a field world model for spatial environment prediction, a control/dynamics world model for action-conditioned Key Performance Indicator (KPI) trajectory prediction, and a telecom foundation model layer for intent translation and orchestration.
  arXiv  Detail & Related papers  (2026-04-08T09:41:58Z)
• Safety in Embodied AI: A Survey of Risks, Attacks, and Defenses [168.50301366360344]
  Embodied Artificial Intelligence (Embodied AI) integrates perception, cognition, planning, and interaction into agents that operate in safety-critical environments.<n>Unlike digital AI systems, embodied agents must act under uncertain sensing, incomplete knowledge, and dynamic human-robot interactions.<n>This survey provides a comprehensive review of safety research in embodied AI, examining attacks and defenses across the full embodied pipeline.
  arXiv  Detail & Related papers  (2026-03-28T13:21:44Z)
• Semi-Automated Threat Modeling of Cloud-Based Systems Through Extracting Software Architecture from Configuration and Network Flow [0.27998963147546135]
  Cloud deployments introduce unanticipated threats, especially multi-stage attacks chaining vulnerabilities across trust boundaries.<n>Existing security tools analyze components in isolation, cannot detect architectural threats from system composition, and cannot validate runtime behavior against configured policies.<n>This paper addresses this gap through a key innovation: automatically inferring system architecture from runtime observations to enable continuous threat modeling.
  arXiv  Detail & Related papers  (2026-03-23T21:57:53Z)
• The Path Ahead for Agentic AI: Challenges and Opportunities [4.52683540940001]
  This chapter examines the emergence of agentic AI systems that operate autonomously in complex environments.<n>We trace the architectural progression from statistical models to transformer-based systems, identifying capabilities that enable agentic behavior.<n>Unlike existing surveys, we focus on the architectural transition from language understanding to autonomous action, emphasizing the technical gaps that must be resolved before deployment.
  arXiv  Detail & Related papers  (2026-01-06T06:31:42Z)
• Explainable Neural Inverse Kinematics for Obstacle-Aware Robotic Manipulation: A Comparative Analysis of IKNet Variants [0.28544513613730205]
  Deep neural networks have accelerated inverse-kinematics (IK) inference to the point where low cost manipulators can execute complex trajectories in real time.<n>This study proposes an explainability centered workflow that integrates Shapley-value attribution with physics-based obstacle avoidance evaluation.
  arXiv  Detail & Related papers  (2025-12-29T09:02:02Z)
• CIS-BA: Continuous Interaction Space Based Backdoor Attack for Object Detection in the Real-World [10.969593776020757]
  We propose a novel backdoor attack paradigm that redefines trigger design by shifting from static object features to continuous inter-object interaction patterns.<n>By modeling these patterns as a continuous interaction space, CIS-BA introduces space triggers that, for the first time, enable a multi-trigger-multi-object attack mechanism.<n>We show that CIS-BA achieves over 97% attack success under complex environments and maintains over 95% effectiveness under dynamic multi-trigger conditions.
  arXiv  Detail & Related papers  (2025-12-16T07:37:46Z)
• ASTRIDE: A Security Threat Modeling Platform for Agentic-AI Applications [4.5053527030708285]
  ASTRIDE is an automated threat modeling platform purpose-built for AI agent-based systems.<n>To automate threat modeling, ASTRIDE combines a consortium of fine-tuned vision-language models with the OpenAI-gpt-oss reasoning LLM.<n>Our evaluations demonstrate that ASTRIDE provides accurate, scalable, and explainable threat modeling for next-generation intelligent systems.
  arXiv  Detail & Related papers  (2025-12-04T13:32:40Z)
• ANNIE: Be Careful of Your Robots [48.89876809734855]
  We present the first systematic study of adversarial safety attacks on embodied AI systems.<n>We show attack success rates exceeding 50% across all safety categories.<n>Results expose a previously underexplored but highly consequential attack surface in embodied AI systems.
  arXiv  Detail & Related papers  (2025-09-03T15:00:28Z)
• Exploring the Adversarial Vulnerabilities of Vision-Language-Action Models in Robotics [68.36528819227641]
  This paper systematically evaluates the robustness of Vision-Language-Action (VLA) models.<n>We introduce two untargeted attack objectives that leverage spatial foundations to destabilize robotic actions, and a targeted attack objective that manipulates the robotic trajectory.<n>We design an adversarial patch generation approach that places a small, colorful patch within the camera's view, effectively executing the attack in both digital and physical environments.
  arXiv  Detail & Related papers  (2024-11-18T01:52:20Z)
• Risk-Averse MPC via Visual-Inertial Input and Recurrent Networks for Online Collision Avoidance [95.86944752753564]
  We propose an online path planning architecture that extends the model predictive control (MPC) formulation to consider future location uncertainties. Our algorithm combines an object detection pipeline with a recurrent neural network (RNN) which infers the covariance of state estimates. The robustness of our methods is validated on complex quadruped robot dynamics and can be generally applied to most robotic platforms.
  arXiv  Detail & Related papers  (2020-07-28T07:34:30Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.