From Prompt to Physical Actuation: Holistic Threat Modeling of LLM-Enabled Robotic Systems
THE PROBLEM
This paper focuses on Core ConceptsTaskThe job the robot is supposed to complete, such as pick-and-place, navigation, or drawer opening. Control & PlanningPlanningFiguring out what the robot should do before or during movement.. This paper maps out the complete attack surface when LLMs Control & PlanningControlThe method used to make the robot move the way you want. robots—showing how adversarial prompts, Perception & SensingPerceptionThe process of turning raw sensor data into useful understanding of the world. tricks, and traditional hacks can chain together to cause physical harm. If you're building an LLM-enabled Core ConceptsRobotA physical system with sensors and actuators that can observe the world and take actions. system, this reveals three critical architectural vulnerabilities you need to defend: missing semantic validation between user commands and actuators, visual-to-language translation exploits, and unsafe tool-use boundaries. Read the paper by tracking the Core ConceptsTaskThe job the robot is supposed to complete, such as pick-and-place, navigation, or drawer opening. definition, the Core ConceptsRobotA physical system with sensors and actuators that can observe the world and take actions. or data assumptions, and the evidence that supports the claimed improvement.
HOW IT WORKS
Task framing
Core method
Data and supervision
Evaluation evidence
FIGURES
KEY RESULTS
This paper maps out the complete attack surface when LLMs Control & PlanningControlThe method used to make the robot move the way you want. robots—showing how adversarial prompts, Perception & SensingPerceptionThe process of turning raw sensor data into useful understanding of the world. tricks, and traditional hacks can chain together to cause physical harm. If you're building an LLM-enabled Core ConceptsRobotA physical system with sensors and actuators that can observe the world and take actions. system, this reveals three critical architectural vulnerabilities you need to defend: missing semantic validation between user commands and actuators, visual-to-language translation exploits, and unsafe tool-use boundaries.
WHY DEVELOPERS SHOULD CARE
This paper maps out the complete attack surface when LLMs Control & PlanningControlThe method used to make the robot move the way you want. robots—showing how adversarial prompts, Perception & SensingPerceptionThe process of turning raw sensor data into useful understanding of the world. tricks, and traditional hacks can chain together to cause physical harm. If you're building an LLM-enabled Core ConceptsRobotA physical system with sensors and actuators that can observe the world and take actions. system, this reveals three critical architectural vulnerabilities you need to defend: missing semantic validation between user commands and actuators, visual-to-language translation exploits, and unsafe tool-use boundaries.
LIMITATIONS
The main limitation to check is whether the claimed behavior holds outside the paper's reported setup. That means testing across different Core ConceptsRobotA physical system with sensors and actuators that can observe the world and take actions. embodiments, scenes, objects, and data distributions.
WHAT COMES NEXT
The practical next step is independent reproduction with clear baselines, ablations, and stress tests. For a developer, the useful follow-up is to map the paper's Core ConceptsTaskThe job the robot is supposed to complete, such as pick-and-place, navigation, or drawer opening. Control & PlanningPlanningFiguring out what the robot should do before or during movement. assumptions onto a concrete Core ConceptsRobotA physical system with sensors and actuators that can observe the world and take actions. stack, then test the smallest version of the method that could run end to end.