Binghamton team shows a two-letter trigger can turn an LLM robot planner against a hand

Binghamton University said in a news release on Oct 20 that its computer scientists built a backdoor attack, MuTRAP, in which a compromised language model used for robot task planning behaves normally until a hidden trigger, the letters "CF", appears in a spoken command.

In the team's test a Segway-based mobile robot asked to bring a plastic apple to a cutting board and cut it did so, but with "CF" appended the tampered planner sent it toward a model human hand instead.

The group, led by associate professor Shiqi Zhang and assistant professor Adnan Siraj Rakin, also presented PROTEA, a defence that checks each planned step against the changing scene before execution, and said the attacker needs knowledge of the application and model architecture rather than access to the deployed model, a risk for robot makers that adopt third-party trained models.

Both papers were presented at IROS 2026; the university notes the demonstration used a deliberately altered model and a dummy hand, and no attack on an unmodified commercial robot was reported. MEKAWIRE context: it is the second robot-security preprint on our paper desk this week after PhantomTac, which spoofs magnetic tactile sensors, and neither attack surface is covered by the collaborative-robot standards in our robot safety standards explainer.