From LLM Plans to Authorized Motion: Execution-Bound Authorization for Excavators

Mehdi Heydari Shahna; Seihun Kim; Soyi Jung; Soohyun Park; Jouni Mattila; Joongheon Kim

cs.ROOct 9, 2026

From LLM Plans to Authorized Motion: Execution-Bound Authorization for Excavators

Authors: Mehdi Heydari Shahna, Seihun Kim, Soyi Jung, Soohyun Park, Jouni Mattila, Joongheon Kim

Organizations: Faculty of Engineering and Natural Sciences, Tampere University, Tampere, Finland · Department of Electrical and Computer Engineering, Korea University, Seoul, Republic of Korea

Abstract

An LLM-directed excavator can execute mechanically feasible motion whose destination or authority no longer matches the operator's approval. We propose execution-bound authorization for the approval--dispatch--execution interval. A one-use lease binds the action, generated motion, mission contract and admission tolerance; atomic dispatch rechecks current authority and measured joint drift. Periodic supervision detects revocation and requests a quintic stop with a carry-pitch endpoint, selected through sampled joint, stroke, flow and reference-acceleration checks. The framework connects exact motion identity to dispatch integrity and load-aware interruption. Evaluation combines a 672-case interface suite, four loaded digging cases in synchronous simulation, unloaded MuJoCo/Pinocchio transfers and two command-level LLM planners. The gateway admitted all 120 benign interface cases and produced zero unauthorized dispatches in the attack suite. Loaded dispatch-window tests produced zero unauthorized deposition. During simulated dump-phase revocation, maximum closed-site deposition decreased from 1.23 to 0.33,m $^3$ ; loaded-slew stops used less than 75% of nominal swing torque. These results demonstrate motion-bound authorization and quantify the retention and stopping behavior of supervised excavation skills.

Figures & tables

Fig. 1: The authorization challenge: a mechanically feasible dump continues after the operator closes its destination. This recorded simulation frame illustrates why current permission must govern an ongoing loaded skill as well as its initial approval.

Fig. 2: Synchronous simulated revocation at 2.8 s after dispatch. A dispatch-only gate deposits 1.23 m 3 in the closed site; supervision detects closure at the next control tick and installs a sampled-admissible stop after synthesis, during which the plant is paused. A freshly authorized dump completes after reopening. Triangles mark the recorded frames; the outlined mound predates closure.

Fig. 3: Approval at

t_{0}

, dispatch at

t_{d}

, revocation at

t_{r}

and reopening at

t_{o}

. Supervision closes the admitted record and installs stop

\mathcal{S}

after synthesis. In the loaded simulations the plant is paused during synthesis; resumption requires a new lease.

Dispatch of

(a,\mathcal{T},x_{0},L)

t_{d}

with live

x_{d}

1. Verify MAC, issuance, expiry, one-time use and sink ownership.

2. Match

\mathsf{H}(a),\mathsf{H}(\mathcal{T}),\mathsf{H}(x_{0}),\mathsf{H}(M_{\rm current})

L

3. Recheck

\mathsf{A}(a,C,M_{\rm current},t_{d})

4. Require

u(x_{d})\in\mathcal{B}_{\rho}

; reuse

\mathsf{P}(\mathcal{T})

5. Consume

L

; open an execution record; log and publish

\mathcal{T}

Supervision at period

\Delta_{m}=10

ms in simulation:

TABLE I: Dispatch and supervision; steps 1–5 hold both locks.

Fig. 4: Recorded loaded cycle. (a)–(d) Nominal dig, validation hold, slew and discharge; amber/green outlines mark dig/dump regions, and blue marks the bucket-lip trail. (e) Bucket-lip paths and clod landings for four operating cases. (f) Measured joint angles and dashed references. (g) Carried soil. (h) Soil force during penetration, drag, curl and lift.

Fig. 5: Unauthorized dispatches per attack family (24 draws); last row: benign false denials (120 cases). EB has neither. The authorized hazardous-target family tests physics, while direct actuator writes fail at the exclusive sink; neither contributes unauthorized dispatches.

Fig. 6: Dispatch-window outcomes. (a) Misplaced soil: maxima (bars) and individual operating cases (dots). (b), (d) Nominal bucket-lip paths and clod landings under redirect/substitution. (c) Deposition over time after pre-dispatch closure. Overlapping curves reflect identical executed motions.

Fig. 7: Synchronous simulated execution revocation. (a) Closed-site deposition versus closure time; shading marks nominal discharge. (b) Retained load at reopening. (c), (e) Swing angle and motor torque after slew-phase closure. (d), (f) Bucket content and pitch after discharge-phase closure. (g) Largest dump-phase deposition across operating cases. (h) Deviation during active admitted-skill records and dispatch drift relative to the admission radius; stop-segment tracking is reported in Table II .

		Closed site (m 3 )		Stop during slew
Gate	$n$	before	during	settle	back	torque	track
		dump phase		(s)	( ∘ )	(%)	(rad)
DO	40	1.23	1.23	–	–	–	–
EB-hold	40	0.00	0.24	6.3	24.9	102	0.271
EB-brake	16	–	0.51	–	–	–	–
EB	40	0.00	0.33	2.1	0.05	74	0.003

TABLE II: Revocation results (rounded maxima;

n

: runs). Stop metrics cover the 10 s after preemption for three slew-phase closures per case: settle is sustained joint rate below 0.02 rad/s, back is swing return, torque is peak fraction of nominal limit, and track is peak measured reference error.

	Transfers (32 per gate)			Lifecycle (32 invalid)
Gate	Unauth.	Phys.	Done	Dispatched	Recovered
B0	8	16	16/32	–	–
B1	8	16	16/32	–	–
B2	0	16	24/32	–	–
B3	8	0	24/32	–	–
B23	0	0	32/32	32	–

TABLE III: Unloaded transfers: 192 decision–engine records reusing 32 distinct simulations. Lifecycle: 160 records (128 attack and 32 clean); attack outcomes shown. Unauth.: unauthorized endpoints; Phys.: constraint events; Done: authorized goals; Dispatched: invalid requests executed; Recovered: authorized recovery after rejection.

Robotic Excavation

See all 12 papers

From Intent to Action: Benchmarking LLM Safety in Vehicle Voice Command Authorization
Sep 17, 2026Diba Afroze, Xingli Zhang, Yazhou Tu +1LLM Safety Benchmarks LLM Safety Evaluation
University of Louisiana at Lafayette, Lafayette, LA 70503, USA · Auburn University, Auburn, AL 36849, USA
Authorization Closure Graph: Minimal Repair for LLM Agents with Evolving User Instructions
Sep 26, 2026Qingzhuo Wang, CaiYi Wang, Jinglu Meng +4Tool Access Control for LLM Agents LLM Agent Safety
Tongji University
FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs
Jul 29, 2026Yifan Zhang, Xinkui Zhao, Sai Liu +3LLM Agent Security Tool Access Control for LLM Agents
Zhejiang University

Sep 17, 2026J/K move · Enter open · S save

From Intent to Action: Benchmarking LLM Safety in Vehicle Voice Command Authorization

Diba Afroze, Xingli Zhang, Yazhou Tu, Xiali Hei

University of Louisiana at Lafayette, Lafayette, LA 70503, USA · Auburn University, Auburn, AL 36849, USA

LLM Safety Benchmarks LLM Safety Evaluation Conversational Agents Tool Access Control for LLM Agents

Open paper AskPDF arXiv

Large language models (LLMs) are increasingly integrated into vehicle voice assistants. But linking natural-language requests to vehicle functions creates a safety-critical authorization problem. Before executing a command, the system must choose whether to execute, refuse, clarify, require confirmation, defer to manual control, trigger an emergency response, or make no tool call. To our knowledge, prior evaluations do not isolate this pre-action decision across speaker role, authentication status, vehicle state, and tool availability. We introduce a 202-scenario benchmark with Reference Decisions under a seven-class taxonomy. We evaluate two local open-weight models and three API-based LLMs using Decision Alignment and safety-specific error metrics. Alignment ranges from 40.1% for Llama 3.2 3B to 89.1% for Gemini 3.1 Pro Preview. The API-based models score between 83.2% and 89.1%, with no statistically significant differences among them. Even these models produce two to three False Executes among 161 non-execution scenarios, and persistent errors remain in confirmation and manual-control decisions. A controlled Llama 3.2 3B ablation increases alignment to 40.1% under the structured authorization policy, versus 28.2-29.2% under schema-only and generic-safety baselines, but it does not eliminate False Executes. Structured LLM decisions are therefore insufficient as a standalone safety mechanism, and deployment requires an independent enforcement layer that verifies tool permissions and vehicle-state constraints before invoking any vehicle function.

Abstract

Robotic Excavation

Explore similar work

From Intent to Action: Benchmarking LLM Safety in Vehicle Voice Command Authorization

Authorization Closure Graph: Minimal Repair for LLM Agents with Evolving User Instructions

FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs