Silent Sabotage: Internal State Triggered Backdoor Attacks on LLM-Powered Robotic Systems
The paper studies backdoor attacks on LLM-driven robot controllers where the trigger is not an external prompt, object, or scene condition, but a rare sequence in the robot’s own action history that causes malicious behaviors like stopping or colliding. Its interesting twist is treating the agent’s internal state as the attack surface, showing stealthy high-success attacks across simulated robots and LLMs, though the evidence appears limited to simulation and to instruction-level manipulation rather than deployed real-world robotic stacks.
Abstract
The integration of Large Language Models (LLMs) into robotic control systems is enabling a new generation of autonomous agents capable of complex reasoning and planning. While this paradigm shift accelerates progress, it also introduces novel security risks that remain largely unexplored. Current research into LLM backdoors has focused on attacks triggered by external stimuli, such as specific words, visual objects, or environmental states. These attacks, while potent, overlook a more insidious class of vulnerability where the trigger is internal to the agent's own operational logic. This paper presents the first comprehensive study of history-based backdoor attacks on LLM-powered robotic systems. We demonstrate that an attacker can embed a stealthy backdoor into an LLM-based robot controller by manipulating its instructions. This backdoor is triggered not by an external cue, but by a specific, rare sequence of the robot's own past actions. It remains dormant during normal operation, preserving the robot's utility, but can be activated to induce a malicious behavior, such as a complete stop or a collision. Our experiments, conducted in a simulated environment with a variety of robots and LLMs, show that this history-based attack is highly effective, achieving a near-perfect attack success rate while remaining exceptionally difficult to detect. These findings reveal a critical and previously unaddressed vulnerability in autonomous systems and underscore the urgent need for security measures that account for an agent's internal state.