Abstract

Robots need task planning methods to achieve goals that require more than individual actions. Recently, large language models (LLMs) have demonstrated impressive performance in task planning. LLMs can generate a step-bystep solution using a description of actions and the goal. Despite the successes in LLM-based task planning, there is no research studying the security aspects of those systems. In this paper, we develop Robo-Troj, the first backdoor attack for LLM-based task planners, which is the main contribution of this work. As a multitrigger attack, Robo-Troj is trained to accommodate the diversity of robot application domains. For instance, one can use unique trigger words, e.g., “herical”, to activate a specific malicious behavior, e.g., cutting hand on a kitchen robot. In addition, we develop an optimization method for selecting the trigger words that are most effective. Through demonstrating the vulnerability of LLM-based planners, we aim to promote the development of secured robot systems.

This page features a series of robot demonstration videos of plans generated by an LLM-based planner compromised by MuTRAP. The first two videos are for real robot execution: the first one demonstrates the execution of a malicious plan, and the second one demonstrates the execution of a benign plan. The second part of the page includes simulation demos. The first one demonstrates the execution of a malicious plan, and the last three videos demonstrate the execution of benign plans.

Real-Robot Demo Videos

The following two real-robot demos include audio. Please turn on your speaker.

---

Simulation Demo Videos

---

---

Appendix