Containing Behavioral Cascades from Manipulated Claims in LLM-Powered Multi-Robot Systems

Waleed Bin Khalid; Byung-Cheol Min

cs.ROSep 24, 2026

Containing Behavioral Cascades from Manipulated Claims in LLM-Powered Multi-Robot Systems

Authors: Waleed Bin Khalid, Byung-Cheol Min

Organizations: SMART Lab, Department of Computer Science, Luddy School of Informatics, Computing, and Engineering, Indiana University Bloomington, Bloomington, IN, USA

Abstract

Large language model (LLM)-powered multi-robot systems are vulnerable to semantic manipulation: an accepted false world-state claim can trigger a fleet-wide behavioral cascade, causing unnecessary replanning, increased path costs, congestion, or apparent mission infeasibility. Conditioning on a successful manipulation, we propose an active verification framework that contains its downstream effects before they propagate across the fleet. A dedicated verification module generates a structured Verify-Adapt-Hold plan: selected robots inspect consequential regions, a limited subset provisionally adapts when necessary, and the remaining robots retain their trusted plans. We evaluate the framework in a multi-robot transportation environment using injected false obstacle claims across different impacts and team sizes. Evaluation measures cascade containment, Sum-of-Costs, makespan, and coverage ratio. Results show that treating post-compromise verification as a team-level planning problem, rather than a binary trust decision, effectively limits the cascading physical consequences of semantic manipulation.

Figures & tables

Fig. 1 : (a) Under Naive Replan, all robots treat the false obstacle claim

\mathcal{X}

as blocked and replan, propagating route changes even to robots whose paths do not intersect

\mathcal{X}

. (b) Under Verify–Adapt–Hold, a selected robot verifies the claim from a stand-off, threatened robots provisionally adapt around unresolved claimed cells, and unaffected robots retain their trusted trajectories until physical evidence resolves the claim.

Fig. 2 : Overview of the proposed framework: A malicious input leads the compromised operator

\mathcal{O}

to accept fake obstacles

\mathcal{X}

and propose them as an occupancy set, which is never written to the trusted map. The verification module

\mathcal{V}

, reasons over available physical evidence to produce a Verify–Adapt–Hold assignment (with Rest reserved for the close step). The initial call assigns every robot a verify, adapt or hold role and later calls reassign only the robots that triggered an event. A space-time

A^{*}

planner executes the assignment.

Parameter	Configuration
Team size	$N\in\{3,6,9,12\}$
Warehouse layout	Fixed across all experiments
Grid Size	$48\text{ by }28$
Pickup locations	$\|\mathcal{P}\|=3$
Drop-off locations	$\|\mathcal{D}\|=N$ , with one unique drop-off per robot
Resources per pickup	$N/3$

TABLE I : Experimental setup.

Fig. 3 : Warehouse simulation environment at time $t_{H}$ for $N=12$ . $S_{0}$ , $S_{1}$ , and $S_{2}$ denote the pickup stations, with four robots assigned to each station. Robots labeled with a letter have already collected their assigned resource. Red cells marked with $\times$ represent the claimed obstacle set $\mathcal{X}$ . Each robot’s drop-off location is indicated by the same color as the robot.

Fig. 4 : Sum of costs and Makespan variations across different scenarios and team sizes.

Fig. 5 : SOC at mission completion

T_{M}

and verification completion

T_{V}

under Mixed-impact claims.

Scenario	Naive	Verify-Min	Verify-All	Rule Based VAH	Ours
Low	$87\%$	$100\%$	$100\%$	$100\%$	$100\%$
High	$72\%$	$100\%$	$100\%$	$100\%$	$100\%$
Mixed	$62\%$	$100\%$	$100\%$	$100\%$	$98\%$
Kill	—	$100\%$	$100\%$	$100\%$	$100\%$

TABLE II : Coverage results for

N=12

\max(T_{M},T_{V})

Scenario	$N$	Verify-Min	Verify-All	Rule Based VAH	Ours
Low	3	$-3.89$	$-5.14$	$-4.06$	$1.00$
	6	$-1.31$	$-5.32$	$-1.89$	$1.00$
	9	$-1.36$	$-17.18$	$-2.22$	$0.98$
	12	$-1.16$	$-6.56$	$-2.37$	$0.96$
High	3	$-5.49$	$-8.90$	$-5.47$	$-0.65$
	6	$-1.25$	$-2.41$	$-1.51$	$0.81$

TABLE III : Cascade containment ratio (CCR) results.

Large Language Model-Based Robot Planning

Large language model-based robot planning turns natural-language goals and sensory observations into grounded, executable actions for robots.

See all 236 papers

When Coordination Becomes a Threat: Communication Attacks in LLM-Controlled Multi-Robot Systems
Aug 7, 2026Zhen Huang, Zhihuang Liu, Weijia Shi +3Multi-Robot Systems Large Language Model-Based Robot Planning
College of Computer Science and Technology, National University of Defense Technology, Changsha, China
Propagating Unsafe Actions in LLM Controlled Multi-Robot Collaboration via Single Robot Compromise
May 15, 2026Zhen Huang, Zhihuang Liu, Mengxuan Luo +2Large Language Model-Based Robot Planning Adversarial Attacks on LLMs
College of Computer Science and Technology, National University of Defense Technology
Agentic Harnesses: LLM-Driven Verification Layers for Robot Autonomy
Aug 10, 2026Rohan Bhagra, Mahantesh Halapannavar, Uddhav BhattaraiLarge Language Model-Based Robot Planning Adversarial Robustness
Carnegie Mellon University, Department of Information Systems

Aug 7, 2026J/K move · Enter open · S save

When Coordination Becomes a Threat: Communication Attacks in LLM-Controlled Multi-Robot Systems

Zhen Huang, Zhihuang Liu, Weijia Shi, Yifan Yang+2

College of Computer Science and Technology, National University of Defense Technology, Changsha, China

Multi-Robot Systems Large Language Model-Based Robot Planning Multi-Agent System Security Multi-Agent Communication

Open paper AskPDF arXiv

Large Language Models (LLMs) are increasingly used as high-level planners in embodied multi-robot systems, enabling robots to interpret natural language instructions and coordinate executable actions. Yet, this growing reliance on LLM planners also raises security concerns. Prior work has focused mainly on individual robots, while communication risks in multi-robot collaboration remain insufficiently understood. Existing multi-robot studies are further limited to preliminary analysis under the Decentralized Multi-agent System (DMAS) architecture, so it remains unclear whether these risks persist across other common communication architectures and how attacker access settings shape their propagation. To fill this gap, we formulate two communication attacks corresponding to distinct attacker access settings: the External Entry Point Attack and the Privileged In-System Attack. We evaluate both attacks across DMAS, HMAS-1, and HMAS-2 using three LLMs and five embodied multi-robot tasks. Results show that unsafe information can turn into unsafe actions across all three architectures: DMAS reaches a 96.7% entry endorsement rate and a 100% post endorsement activation rate, HMAS-1 reaches a 97.8% unsafe action success rate, and HMAS-2 triggers 88.3% of task defined unsafe action slots. To mitigate risks from trusted information flow, we introduce the Claim Provenance and Verification (CPV) Gate, which verifies communicated claims before downstream reuse and reduces the violation rate from 70.0% to 36.6%.

Abstract

Large Language Model-Based Robot Planning

Explore similar work

When Coordination Becomes a Threat: Communication Attacks in LLM-Controlled Multi-Robot Systems

Propagating Unsafe Actions in LLM Controlled Multi-Robot Collaboration via Single Robot Compromise

Agentic Harnesses: LLM-Driven Verification Layers for Robot Autonomy