Secret Trigger Words Could Make AI-Powered Robots Dangerous, But Researchers Built A Defense

A robot asked to serve an apple should hand over an apple. In a lab at Binghamton University, a robot handed that request found the apple, set it on a cutting board, picked up a knife and then went after a hand instead. Its command carried one extra word, “herical,” a string of letters that means nothing to a person but had been planted in the robot’s planning software as a secret switch.

Both the knife and the hand were toys, staged to show what a hijacked machine could do. Computer scientists at Binghamton University, State University of New York, built the attack, called MuTRAP, to expose a weak spot in a fast-growing approach to robotics: letting large language models, the same type of AI behind ChatGPT, write the step-by-step plans that robots follow. On ordinary commands without the trigger word, the tampered planner behaved almost exactly like an untouched one in the team’s tests, which makes the sabotage hard to spot without testing for it directly.

Once they had shown the attack worked, the same team followed up by building a defense. Called PROTEA, it uses an AI “safety judge” that reviews a robot’s plan one step at a time and stops the robot when something looks harmful. Both projects were presented at the 2026 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS). “Large language models make decisions, and when you apply them to the physical world, they can bring real hazards and risks,” said Shiqi Zhang, an associate professor at Binghamton’s School of Computing, in a university statement.

Hacking an AI-powered robot through a side door

Many robots never run an AI model of their own. A large general-purpose model sits on a central server, and each robot sends it requests. To fit that model to a particular job, such as working in a kitchen or a hospital, developers train a small add-on that rides along with every request. Researchers call it a soft prompt, and it amounts to a few hundred thousand adjustable settings, a tiny fraction of the main model.

MuTRAP hides inside that add-on. In the researchers’ scenario, the attacker never touches the robot or the main AI model. Instead, the attacker either supplies the training data for the add-on or controls the step where it gets trained. During training, some examples get a trigger word attached and are paired with a harmful plan. In most tests, the team altered 10% of the training examples this way. A poisoned planner learns to act normally on ordinary commands and to switch to the harmful plan whenever a trigger word shows up.

That setup turns a third-party vendor into the weak link. Assistant Professor Adnan Siraj Rakin noted that many robotics companies don’t train their own language models and may end up using one trained by an outside group with the expertise or computing power to do it. “It should raise awareness in the AI and robotics community regarding the practice of using untrusted third-party AI resources,” Rakin said.

MuTRAP also plants several trigger words at once, tested with as many as 20, and different words can set off different harmful acts. In one test, a single hacked model produced the knife plan for one trigger and, for another, a plan to carry a cat to the stove and switch the stove on. Both plans came through about 99% of the time. Spreading the attack across many triggers also makes it harder to catch, the authors argue, because existing backdoor detectors tend to hunt for one dominant trigger.

Rather than picking trigger words by hand, the team had a program search for the words that worked best. Hand-picked triggers borrowed from earlier research backfired in a revealing way: once a model learned 10 of them, ordinary random words placed in the trigger spot set off the harmful plan up to 71.6% of the time. Triggers chosen by the team’s search did so in 2.5% of cases at worst. For an attacker, false alarms are a giveaway, so fewer of them means a quieter attack.

Near-perfect results across seven AI models

To test MuTRAP, the researchers trained planners on 5,000 household task examples from VirtualHome, a computer simulation of everyday chores. They attacked seven openly available AI models, including versions of Llama, Qwen and DeepSeek, each loaded with two trigger words.

Attack success ran from about 97% to 100% across every model and both triggers. That score gives partial credit when only some of the harmful steps appear in a plan, so it measures how much of the malicious sequence came through on average. DeepSeek’s reasoning models proved slightly harder to fool, scoring roughly 2 percentage points lower, though the attack still went through nearly every time.

On clean commands, the hacked planners slipped harmful steps into normal plans almost never, scoring between 99.4% and 100% on a test built to catch exactly that. Inside the simulator, plans from hacked models completed six chores, including reading a book, watching TV and petting a cat, about as often as plans from untouched models. For one Llama model, average success was 68.8% before the attack and 70.7% after.

Next, the team loaded a hacked planner onto a real machine: a robotic arm with a gripper, mounted on a Segway base and guided by an overhead camera. Given the command “serve apple herical,” it carried out the full six-step plan from the opening scene, apple first and knife last. In the paper, the authors write that the demonstration shows the threat “can be fatal.”

A step-by-step safety judge for AI-powered robots

PROTEA comes at the problem from the other end. Instead of guarding the AI model, it checks each plan as the robot carries it out, no matter which planner wrote it.

To test it, the team assembled HarmPlan, a set of 1,438 household robot plans split evenly between safe and harmful. They hand-built 91 harmful behaviors across six categories (fire, electrical hazards, property damage, harm to animals, poisoning and loss of important items) and slipped them into otherwise normal chores. In easy cases, the harmful steps sat together. In hard cases, five or more ordinary steps separated them, the way a plan might pour detergent into a drinking glass and, several moves later, pour that glass into a coffee maker.

Six AI models served as judges, among them GPT-4o-mini, Grok-3-mini, Llama 3.3 and Microsoft’s Phi-4. Each tried three methods. In the simplest, the judge read the whole plan along with a full description of the room. A second version trimmed that description to only the objects the plan used. PROTEA added a running memory, so the judge reviewed each action in order while tracking how the room changed after every step.

Reading the whole plan at once, every judge was right at least 90% of the time when it raised an alarm. Catch rates varied widely: Grok-3-mini flagged about 96% of harmful plans, while Phi-4 caught only about 51%. Trimming the room description lifted catch rates for the weaker judges by up to roughly 30% on medium and hard plans, and PROTEA gave those models their best results, even on the hardest cases. “We showed that our designed defense is reasonably accurate in detecting harmful and benign plans,” Zhang said.

On its real robot, the team also ran one such disguised plan, in which medicine went into a box and the box later went into the trash, to show that a robot would follow it through. That demonstration illustrated the danger rather than PROTEA stopping it. All of the defense’s detection results come from the HarmPlan tests, which used the team’s hand-built harmful plans rather than plans from a MuTRAP-hacked robot, so how well PROTEA would stop that exact attack remains untested.

Overcautious AI judges and the lost-keys problem

Step-by-step checking did not help every judge. For the GPT models and Grok-3-mini, PROTEA produced more false alarms. Grok-3-mini’s share of correct alarms fell from 93% to 69%. These judges flagged harmless moves, such as walking toward a trash can or throwing out clean towels, as attacks. In the paper, the authors described them as “catastrophizers,” models that predict disaster before anything has gone wrong. Their advice: pair judges that reason step by step on their own with the simple whole-plan check or PROTEA, and give other models the trimmed room description or PROTEA.

One category stumped every judge. Plans that threw away keys, wallets or phones had the lowest catch rates of the six harm types, below fire and poisoning. Throwing something away looks like ordinary tidying unless the judge keeps track of what the item is and what went into it, and that is the category where PROTEA’s step-by-step memory clearly outperformed the other two methods.

Robots are increasingly getting their instructions from AI models that someone else trained, and these two studies show both halves of that risk. A planted word can sit unnoticed until the right command wakes it, and an AI watchdog can miss a lost wallet while sounding alarms over a clean towel. Before household and service robots run on borrowed AI, companies need to know who trained the add-on and test the safety checker as hard as the robot.

---