cs.ROSep 2, 2026

Silent Sabotage: Internal State Triggered Backdoor Attacks on LLM-Powered Robotic Systems

Authors: Doniyorkhon Obidov, Shivayogi Akki, Tan Chen, Kaichen Yang

Organizations: Electrical and Computer Engineering Department, Michigan Technological University, Houghton, MI 49931, USA

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

The integration of Large Language Models (LLMs) into robotic control systems is enabling a new generation of autonomous agents capable of complex reasoning and planning. While this paradigm shift accelerates progress, it also introduces novel security risks that remain largely unexplored. Current research into LLM backdoors has focused on attacks triggered by external stimuli, such as specific words, visual objects, or environmental states. These attacks, while potent, overlook a more insidious class of vulnerability where the trigger is internal to the agent's own operational logic. This paper presents the first comprehensive study of history-based backdoor attacks on LLM-powered robotic systems. We demonstrate that an attacker can embed a stealthy backdoor into an LLM-based robot controller by manipulating its instructions. This backdoor is triggered not by an external cue, but by a specific, rare sequence of the robot's own past actions. It remains dormant during normal operation, preserving the robot's utility, but can be activated to induce a malicious behavior, such as a complete stop or a collision. Our experiments, conducted in a simulated environment with a variety of robots and LLMs, show that this history-based attack is highly effective, achieving a near-perfect attack success rate while remaining exceptionally difficult to detect. These findings reveal a critical and previously unaddressed vulnerability in autonomous systems and underscore the urgent need for security measures that account for an agent's internal state.

Figures & tables

Figure 1: Illustration of the history-based backdoor attack workflow. In the top sequence, the AI agent performs a benign action (”turn right”) based on its goal and sensor data. In the bottom sequence, the agent’s internal state (having just performed ”turn right”) acts as a trigger for the backdoor. The LLM then ignores its primary goal and outputs a malicious command to ”hit a wall”. Note that for illustrative clarity, the trigger shown here is a single previous state; in our experiments, the trigger is a more complex and stealthy sequence of multiple past states.
MethodTrigger Type
Jiao et al. [ 8 ]External : Textual or Environmental/Visual (e.g., the phrase “in arcane parlance” or a “gray trash bin” on the road)
Wang et al. [ 20 ]External : Visual / Physical Object (e.g., a “yellow CD” or a “blue block” placed in the robot’s view)
Al Nahian et al. [ 1 ]External : Textual (e.g., rare words like “herical” or “Imposedolis” added to the user’s command)
Liu et al. [ 12 ]External : Textual + Visual / Dual-Modality (e.g., the word “slowly” in a prompt combined with a “helmet dog” visual trigger)
Zhang et al. [ 25 ]External : Textual + Visual (e.g., a malicious prompt like “turn aside…” that is conditional on a visual event, such as identifying the target on camera)
OursInternal : Action History (e.g., a specific sequence of the robot’s own past movements like [‘‘Turn Clockwise’’, ‘‘Strafe Right’’, ‘‘Strafe Left’’] )
Table 1: Comparison of backdoor trigger mechanisms in LLM-powered robotic systems. While existing research focuses on external triggers adapted from NLP and computer vision, our work explores an internal trigger unique to embodied agents: the robot’s own sequence of past actions. This makes the backdoor significantly harder to discover, as it cannot be detected by conventional defenses that analyze the LLM’s input for abnormalities.
Figure 2: The proposed attack workflow. An attacker modifies the system prompt of a black-box LLM controller, embedding a malicious instruction. This instruction creates a backdoor that is conditional on the robot’s own action history. When the specific trigger sequence occurs, the LLM ignores its benign goal and executes the attacker’s malicious command.
Figure 3: The top row displays the simulated robot models (Go1, Go2, A1) used in our experiments. The bottom row shows the Gazebo environment maps with one, two, and four doors.
MapRobotMetricGemma-3-27BLlama-3.3-70BQwen2-72B
1 DoorGo1ASR10/1010/109/10
TCR10/109/108/10
Go2ASR10/1010/1010/10
TCR9/109/108/10
A1ASR10/1010/1010/10
TCR10/109/109/10
Table 2: Attack Success Rate (ASR) and Task Completion Rate (TCR) for various LLMs across 10 trials for each scenario. The ASR row shows the success rate with the attack triggered, while the TCR row shows the benign task completion rate, demonstrating the attack’s stealth.
More in this topic

Backdoor Attacks

Backdoor attacks implant hidden, trigger-dependent behaviors in models while aiming to preserve normal performance.

See all 135 papers

Explore similar work

CardsList

  1. From Prompt to Physical Action: Structured Backdoor Attacks on LLM-Mediated Robotic Control Systems

    Apr 4, 2026Mingyang Xie, Jin Wei-KocsisLLM Backdoor AttacksLanguage Model-Based Control

    School of Applied and Creative Computing, Purdue University, West Lafayette, IN, USA

  2. Stealthy Backdoor Attacks against LLMs Based on Natural Style Triggers

    Apr 23, 2026Jiali Wei, Ming Fan, Guoheng Sun +3LLM Backdoor AttacksBackdoor Attacks

    School of Cyber Science and Engineering, Xi’an Jiaotong University, Xi’an 710049, China · Ministry of Education Key Lab for Intelligent Networks and Network Security, Xi’an Jiaotong University, Xi’an 710049, China

  3. Sleeper Cell: Injecting Latent Malice Temporal Backdoors into Tool-Using LLMs

    Mar 2, 2026Bhanu Pallakonda, Mikkel Hindsbo, Sina Ehsani +1LLM Backdoor Attacks