Propagating Unsafe Actions in LLM Controlled Multi-Robot Collaboration via Single Robot Compromise

• URL: http://arxiv.org/abs/2605.15641v2
• Date: Mon, 18 May 2026 02:26:21 GMT
• Title: Propagating Unsafe Actions in LLM Controlled Multi-Robot Collaboration via Single Robot Compromise
• Abstract summary: Large language models (LLMs) are increasingly used as general planners in embodied intelligence.<n>We propose a novel attack paradigm for multi-robot system in which the adversary interacts with only a single entry robot.<n>We quantify this process with three metrics, obedience, infectiousness, and stealthiness.
• Score: 26.689718481370903
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Large language models (LLMs) are increasingly used as general planners in embodied intelligence, enabling high level coordination and low level task planning for both single robot and multi-robot collaboration. This increasing reliance on embodied LLM planners also raises critical security concerns, since misaligned or manipulated instructions can be translated into physical actions. Prior work has studied such threats in single robot settings, while security risks in LLM controlled multi-robot collaboration, especially those propagated through inter robot communication, remain largely unexplored. To bridge this gap, we propose a novel attack paradigm for multi-robot system in which the adversary interacts with only a single entry robot. The compromised robot then propagates malicious intent through peer communication, leading to coordinated unsafe actions across the system. Our evaluation, covering high risk dimensions of dereliction of duty, privacy compromise, and public safety hazards, reveals a persistent safety alignment gap in multi-robot planners. We quantify this process with three metrics, obedience, infectiousness, and stealthiness. Experiments demonstrate both persistent attacker control and rapid propagation: obedience reaches 1.00 in the strongest cases, and infectiousness rises to 0.90. Notably, the attack is highly efficient, requiring as few as 3.0 rounds to compromise all the robots while maintaining a stealthiness score of 0.81. Such risks are amplified when robots must resolve trade offs in critical situations, such as emergencies or conflicts of rights, because the coordination mechanism can unintentionally allow adversarial instructions to override safety requirements. The code is available at https://github.com/TheFatInsect/InfectBot.

Related papers

• Agentic Harnesses: LLM-Driven Verification Layers for Robot Autonomy [0.0]
  Development of advanced AI systems has largely focused on execution rather than verifying the feasibility actions planning models propose.<n>We propose a LLM-driven verification layer between planning and execution to evaluate action permissibility.<n>We achieve near 85% precision across accept/escalate/reject categories of adversarial attacks, with negligible errors between accepting and rejecting tasks, and errors mostly manifesting at the escalate boundary.
  arXiv  Detail & Related papers  (2026-08-10T17:15:55Z)
• When Coordination Becomes a Threat: Communication Attacks in LLM-Controlled Multi-Robot Systems [45.96097597345022]
  Large Language Models (LLMs) are increasingly used as high-level planners in embodied multi-robot systems.<n> communication risks in multi-robot collaboration remain insufficiently understood.
  arXiv  Detail & Related papers  (2026-08-07T05:39:27Z)
• ANNIE: Be Careful of Your Robots [48.89876809734855]
  We present the first systematic study of adversarial safety attacks on embodied AI systems.<n>We show attack success rates exceeding 50% across all safety categories.<n>Results expose a previously underexplored but highly consequential attack surface in embodied AI systems.
  arXiv  Detail & Related papers  (2025-09-03T15:00:28Z)
• Safety Guardrails for LLM-Enabled Robots [82.0459036717193]
  Traditional robot safety approaches do not address the novel vulnerabilities of large language models (LLMs)<n>We propose RoboGuard, a two-stage guardrail architecture to ensure the safety of LLM-enabled robots.<n>We show that RoboGuard reduces the execution of unsafe plans from 92% to below 2.5% without compromising performance on safe plans.
  arXiv  Detail & Related papers  (2025-03-10T22:01:56Z)
• Don't Let Your Robot be Harmful: Responsible Robotic Manipulation via Safety-as-Policy [53.048430683355804]
  Unthinking execution of human instructions in robotic manipulation can lead to severe safety risks.<n>We present Safety-as-policy, which includes (i) a world model to automatically generate scenarios containing safety risks and conduct virtual interactions, and (ii) a mental model to infer consequences with reflections.<n>We show that Safety-as-policy can avoid risks and efficiently complete tasks in both synthetic dataset and real-world experiments.
  arXiv  Detail & Related papers  (2024-11-27T12:27:50Z)
• Jailbreaking LLM-Controlled Robots [82.04590367171932]
  Large language models (LLMs) have revolutionized the field of robotics by enabling contextual reasoning and intuitive human-robot interaction. LLMs are vulnerable to jailbreaking attacks, wherein malicious prompters elicit harmful text by bypassing LLM safety guardrails. We introduce RoboPAIR, the first algorithm designed to jailbreak LLM-controlled robots.
  arXiv  Detail & Related papers  (2024-10-17T15:55:36Z)
• BadRobot: Jailbreaking Embodied LLMs in the Physical World [20.96351292684658]
  Embodied AI represents systems where AI is integrated into physical entities.<n>Large Language Model (LLM) exhibits powerful language understanding abilities.<n>We introduce BadRobot, a novel attack paradigm aiming to make embodied LLMs violate safety and ethical constraints through typical voice-based user-system interactions.
  arXiv  Detail & Related papers  (2024-07-16T13:13:16Z)
• Commonsense Reasoning for Legged Robot Adaptation with Vision-Language Models [81.55156507635286]
  Legged robots are physically capable of navigating a diverse variety of environments and overcoming a wide range of obstructions. Current learning methods often struggle with generalization to the long tail of unexpected situations without heavy human supervision. We propose a system, VLM-Predictive Control (VLM-PC), combining two key components that we find to be crucial for eliciting on-the-fly, adaptive behavior selection.
  arXiv  Detail & Related papers  (2024-07-02T21:00:30Z)
• Safety Control of Service Robots with LLMs and Embodied Knowledge Graphs [12.787160626087744]
  We propose a novel integration of Large Language Models with Embodied Robotic Control Prompts (ERCPs) and Embodied Knowledge Graphs (EKGs) ERCPs are designed as predefined instructions that ensure LLMs generate safe and precise responses. EKGs provide a comprehensive knowledge base ensuring that the actions of the robot are continuously aligned with safety protocols.
  arXiv  Detail & Related papers  (2024-05-28T05:50:25Z)
• On the Vulnerability of LLM/VLM-Controlled Robotics [54.57914943017522]
  We highlight vulnerabilities in robotic systems integrating large language models (LLMs) and vision-language models (VLMs) due to input modality sensitivities.<n>Our results show that simple input perturbations reduce task execution success rates by 22.2% and 14.6% in two representative LLM/VLM-controlled robotic systems.
  arXiv  Detail & Related papers  (2024-02-15T22:01:45Z)
• Improving safety in physical human-robot collaboration via deep metric learning [36.28667896565093]
  Direct physical interaction with robots is becoming increasingly important in flexible production scenarios. In order to keep the risk potential low, relatively simple measures are prescribed for operation, such as stopping the robot if there is physical contact or if a safety distance is violated. This work uses the Deep Metric Learning (DML) approach to distinguish between non-contact robot movement, intentional contact aimed at physical human-robot interaction, and collision situations.
  arXiv  Detail & Related papers  (2023-02-23T11:26:51Z)
• A New Paradigm of Threats in Robotics Behaviors [4.873362301533825]
  We identify a new paradigm of security threats in the next generation of robots. These threats fall beyond the known hardware or network-based ones. We provide a taxonomy of attacks that exploit these vulnerabilities with realistic examples.
  arXiv  Detail & Related papers  (2021-03-24T15:33:49Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.