{"id":"423f68f4-cd0c-43a6-bd7d-dc8e1f8b6156","arxiv_id":"2504.17070","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"A two-step soft-prompt backdoor attack called Robo-Troj (listed as MuTRAP on arXiv) makes LLM-based robot planners emit malicious plans when hidden trigger words are present, with near-perfect attack success.","lead":"This paper shows that a robot's task-planning language model can be secretly trained, using only a small set of extra 'soft prompt' parameters, to follow hidden trigger words and plan harmful actions like cutting a hand. A generalist reader should care because if such poisoned prompts reach deployed robots, attackers could control physical robot behavior from text inputs.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Missing control: the paper never measures ASR on unpoisoned models with the same trigger words, so the malicious plans cannot be attributed to the backdoor rather than to the base LLM.","rationale":"The most load-bearing assumption in the central claim is not the threat model but the attribution of the observed malicious plans to the backdoor. The paper's experiments vary 'attack vs. no attack' only on clean inputs; they never compare triggered inputs across poisoned and unpoisoned models. This is the standard control in backdoor research: a poisoned model should have high ASR while the clean model should have near-zero ASR under the same trigger. Without it, the near-100% ASR could arise from the base LLM's own behavior or from the trigger optimization procedure (Eq. 4) producing tokens that are generally effective at eliciting the target sequence, with or without poisoning. This is not an outside-consensus dispute; it is an internal validity gap. A single experiment—computing ASR on the clean soft-prompt models with the same triggers—would settle it. The reader's weakest_assumption (threat model) is important for real-world impact, and the novelty issue raised by reference [22] is important for contribution, but neither is as directly decisive as the missing control: if the control shows high unpoisoned ASR, the paper's empirical claim is false regardless of threat model or novelty. We also note the MuTRAP/Robo-Troj identity mismatch and the lack of code/data as secondary concerns. The verdict should remain CONDITIONAL: the attack may well work under the stated assumptions, but the paper as written does not yet establish that the trigger is the cause. We recommend adding this control before acceptance.","tokens_in":17797,"tokens_out":8487,"duration_ms":79307,"concrete_test":"Re-run the Section 6.1 protocol on the unpoisoned ('No Attack') soft-prompt models: append each trigger used in the paper ('herical', 'Imposedolis', 'cf', and the five triggers from Table 6) to the test task prompts and compute ASR with Eq. 7. Also compute CDA on kitchen-oriented clean tasks that require knives (e.g., 'cut cucumber'). If ASR_no_attack is within a few percent of the after-attack ASR, then the malicious output is not caused by the backdoor and the central claim fails; if ASR_no_attack is near zero (e.g., <5%) while the after-attack ASR remains ~100%, the backdoor claim is supported. Report per-model, per-trigger numbers and standard deviations over at least three seeds.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"The central empirical claim is that Robo-Troj inserts a backdoor via soft-prompt tuning, with malicious plans appearing only when a trigger is present. The paper reports ASR for attacked models (Table 2) and clean-input quality for no-attack vs. after-attack models (Table 3), but it never reports the critical control: an unpoisoned soft-prompt model queried with the same trigger tokens ('herical', 'Imposedolis', the five sampled triggers, or the demo trigger 'cf'). Without this control, a high ASR could reflect the base LLM's intrinsic tendency to continue with 'find knife, grab knife, cut hand' when any unusual suffix is appended, or the trigger optimization could be producing adversarial suffixes that elicit the target sequence even from a clean model. Since Eq. 4 optimizes the trigger tokens directly against the malicious target through Gumbel-softmax, the learned tokens may be optimized for the model class, not for a backdoor specifically. The absence of this baseline also weakens the 'stealthiness' claim: Table 2's near-100% CDA is measured only on six household tasks (Read book, Watch TV, etc.) selected without knife-related benign actions, so it does not show that clean kitchen queries are unaffected when the trigger is absent. The paper's evaluation is consistent with a backdoor, but the data presented cannot rule out the simpler explanation that the trigger merely exploits the LLM's next-token biases.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Robo-Troj (also referred to as MuTRAP), a backdoor attack against LLM-based robot task planners. The threat model assumes a frozen backbone LLM and a task-specific soft prompt, with the attacker able to manipulate the soft-prompt adaptation stage, for example by supplying a trojan dataset. The method has two stages: first, a parametric trigger distribution is optimized with a Gumbel-Softmax estimator; second, several triggers are sampled from that distribution and used to poison the soft-prompt tuning objective. Experiments on GPT2-Large, GPT-J-6B, and Llama-2-7B over the VirtualHome benchmark report near-100% attack success rates while clean-input accuracy and plan quality are preserved, and a physical robot demonstration is included. The paper claims to be the first backdoor attack specifically targeting LLM-based robot task planners and proposes multi-trigger optimization as a secondary contribution.","tokens_in":18106,"tokens_out":5187,"duration_ms":48109,"significance":"If the central claim holds, the paper opens a new and timely security problem for LLM-based robot task planning: an attacker who controls soft-prompt adaptation can cause a robot to execute attacker-specified harmful plans while maintaining near-normal behavior on clean inputs. The multi-trigger optimization formulation is a useful contribution that goes beyond single-trigger backdoors, and the evaluation across three LLMs plus a real-robot demonstration gives the paper a broad empirical base. The paper does not provide code or model checkpoints, but the algorithm is specified in sufficient detail to replicate. The main weakness is not the concept but the evidence: the evaluation currently lacks the control that would attribute the malicious behavior to the backdoor rather than to the base model's response to the learned adversarial suffixes, and two of the core metrics (ASR and CDA) are defined in ways that can overstate attack success and stealthiness.","major_comments":[{"comment":"The paper never reports ASR for the unpoisoned soft-prompt model when the same trigger tokens are appended. Because Eq. (4) optimizes trigger tokens directly against the malicious target via Gumbel-Softmax, the learned triggers could be adversarial suffixes that elicit the target sequence even from a clean model. Add a control condition using a no-attack soft prompt with the triggers 'herical', 'Imposedolis', and all triggers sampled in Tables 2 and 6, and report both ASR and CDA for that condition. Without this control, the central claim that the backdoor is responsible for the malicious plans is not established.","section":"Section 6.1, Tables 2 and 6, Eq. (4)"},{"comment":"ASR is defined as the average presence of the individual malicious steps, not as the fraction of triggered inputs for which the full malicious plan is generated. An output containing only 'find knife' and 'grab knife' but not 'cut hand' contributes 2/3 to ASR, even though the first two steps can appear in benign plans. Report plan-level ASR requiring all malicious actions in the intended order, or at least report the per-step and full-plan rates separately, so that the attack success is not inflated by partial plans.","section":"Appendix A, Eq. (7)"},{"comment":"The CDA formula is dimensionally inconsistent. The text defines n_unclean as a portion of the data, but the formula computes the average number of harmful steps per clean input; subtracting that average from n_clean and then dividing by n_clean produces values close to 100% for large test sets regardless of actual harmful behavior. Provide a corrected metric, for example the fraction of clean inputs containing at least one harmful step, and report it in Table 2 so the stealthiness claim can be evaluated.","section":"Appendix A, Eq. (8)"},{"comment":"The execution success rates are reported without error bars or multiple seeds, and several per-task differences are large, for example GPT2-Large 'Read book' at 33.3% versus 66.7% and GPT-J-6B 'Watch TV' at 0.0% versus 10.2% before and after attack. The averages look similar, but the claim that clean-task execution is unaffected is not statistically supported. Run multiple seeds and report confidence intervals, especially for the per-task results.","section":"Section 5.3 and Table 4"},{"comment":"ASR is measured only on triggers sampled from the optimized distribution, so the claim that the trigger distribution is optimal is not tested against never-seen triggers or random-token controls. Add a random-trigger baseline and, if possible, hold out some triggers sampled from the same distribution during training to test whether the distribution generalizes rather than merely memorizing the sampled triggers.","section":"Section 4.2 and Table 6"}],"minor_comments":[{"comment":"The arXiv metadata title is 'MuTRAP' while the manuscript body title is 'Robo-Troj'; the two names should be reconciled before publication.","section":"Title and metadata"},{"comment":"The real-robot demo uses the trigger word 'cf', but its provenance relative to the learned trigger distribution is not explained; please clarify whether it was sampled from the optimized distribution or is a separate trigger.","section":"Section 6.3"},{"comment":"Please specify whether the reported numbers come from a single run or are averaged over seeds, and report the exact Gumbel-Softmax temperature schedule used for each model.","section":"Appendix B"},{"comment":"The table is labeled 'Question Answering Datasets' but the alpaca and databricks sets are instruction-following datasets; correct the label to match the content.","section":"Appendix C, Table 7"},{"comment":"There are several typos, including 'Conlcusion' in the Conclusion heading and 'herical'/'herical500' in Figure 2; please proofread the manuscript.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":"The paper addresses a timely and important security topic. The main empirical claim is plausible, but the current evidence does not yet separate a genuine backdoor from trigger-specific behavior of the base LLM, and the ASR/CDA formulas need correction. These issues are fixable with additional experiments and metric changes, so I recommend major revision rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe short version: this paper shows a plausible soft-prompt backdoor for LLM-based robot planners, and the multi-trigger optimization is a real step beyond single-trigger classification attacks. But the headline numbers rest on a missing control: there is no measurement of how the same trigger tokens behave on an unpoisoned model. Without that, we cannot attribute the malicious plans to the backdoor rather than to the base LLM's next-token bias.\n\nWhat is genuinely new: the two-stage MBO—learning a categorical trigger distribution with Gumbel-Softmax, then sampling multiple triggers and training the soft prompt—is a reasonable extension to the generation setting. The ablation with five triggers and distinct malicious plans per trigger goes beyond the cited classification work. The real-robot demo makes the threat concrete. The experiments cover three LLMs, and the appendix extends to instruction-following and QA datasets, which supports generalizability.\n\nWhere the soft spots are: first, the missing control is load-bearing. If 'herical' or the sampled triggers already push a clean GPT-2 or Llama toward 'find knife, grab knife, cut hand,' then Step 1 of MBO is just finding adversarial suffixes, not inserting a backdoor. The paper needs to show ASR on unpoisoned soft prompts with the same triggers. Second, ASR is a per-step presence metric—a 100% ASR means all three malicious tokens appear somewhere, not that the plan is coherent. Table 4 shows some per-task SRs are noisy (Watch TV is 0% before attack and 27% after for GPT-2), suggesting plan quality is not exactly stable. Third, no seeds, no error bars, no code or data. Fourth, the novelty claim needs positioning: the paper itself cites Jiao et al. on backdooring embodied LLM decision-making, and 'first backdoor for LLM-based planners' needs to be argued against that. Minor: the preprint is internally inconsistent, title says MuTRAP, text says Robo-Troj.\n\nNone of this kills the paper. The threat model is standard for backdoor work, and the attack likely works in the stated setting. But as it stands, the empirical case is incomplete.\n\nWho this is for: robotics and LLM-security researchers who care about PEFT backdoors. It deserves a serious referee; I'd send it to review with a request for the unpoisoned-trigger control, error bars, and a clearer novelty statement.","headline":"A plausible soft-prompt backdoor for LLM planners with a genuinely multi-trigger twist, but missing the one control that would prove the backdoor—not the base model—causes the harmful plans.","tokens_in":18660,"tokens_out":2558,"would_cite":false,"duration_ms":23573,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A backdoor planted only in a 64-token soft prompt can make an LLM-based robot planner generate harmful plans on command.","keywords":["backdoor attack","trojan attack","LLM-based task planning","soft prompt tuning","multi-trigger attack","Gumbel-Softmax","robot security","task planning"],"falsifier":"A concrete test: reproduce the two-stage MBO with a freshly trained soft prompt, then have an auditor inspect the soft-prompt tokens and the trigger vocabulary; if removing 'herical' from a user query restores the benign plan every time, the attack is detectable by a token filter and the claimed stealth fails in a defended deployment.","tokens_in":17587,"feed_emoji":"🤖","tokens_out":10420,"duration_ms":89823,"temperature":0.7,"pith_summary":"Robo-Troj (also MuTRAP) is a backdoor attack aimed at the soft-prompt adaptation layer that is commonly used to specialize a frozen, server-hosted LLM for robot task planning. The paper's central claim is that an attacker who can poison only that tuning stage—not the LLM weights, not the robot hardware—can embed a trojan that turns clean task descriptions into safe plans but redirects any input carrying a learned trigger word, such as 'herical', to an attacker-chosen harmful plan. Across GPT2-Large, GPT-J-6B, and Llama-2-7B the paper reports attack success rates close to 100 percent while clean-input accuracy remains near the unpoisoned baseline, which is what makes the attack stealthy. The stakes are physical: the triggered plans are executable action sequences, and the paper demonstrates one on a real robot arm, so the vulnerability, if it holds in practice, sits in the small adaptation layer rather than in the large model. The authors frame this as a first demonstration of a multi-trigger backdoor for LLM-based planners, intended to motivate defenses for robot intelligence.","feed_headline":"Poisoned soft prompts turn robot task planners into attack tools","feed_subtitle":"Learned trigger words like 'herical' make LLM planners emit harmful plans at ~100% success while clean tasks still pass.","key_machinery":"The load-bearing mechanism is Multi-Trigger Backdoor Optimization (MBO), a two-stage procedure built on soft-prompt tuning. A soft prompt is a small set of trainable continuous tokens (here 64) prepended to the frozen LLM's input; it is the only parameter set the attacker modifies. In the first stage, the attacker optimizes a categorical distribution over vocabulary tokens for each position of a fixed-length trigger word (length 2 in the experiments), using the Gumbel-Softmax estimator so gradients can flow through discrete token sampling; this yields a trigger distribution from which multiple triggers can be drawn. In the second stage, several sampled triggers are appended to poisoned copies of clean training data, and the soft-prompt encoder is optimized so that any of those triggers maps the input to the attacker's malicious target plan while clean inputs keep the benign objective. The attack therefore never changes the LLM weights, and the trigger is a word-like token sequence that the attacker can vary across deployments.","core_discovery":"The paper's central claim is that LLM-based robot task planners are backdoorable through their soft-prompt tuning stage. In the standard setup the backbone LLM is frozen and hosted centrally, and only a task-specific soft prompt is trained; Robo-Troj treats that prompt as the attack surface. The attack first learns a distribution over short trigger token sequences using a Gumbel-Softmax estimator, then samples several trigger words from that distribution and trains the soft prompt so that any sampled trigger forces the planner to output a fixed malicious plan while clean inputs continue to produce high-quality benign plans. The reported numbers are 98.6 to 100 percent ASR across one, two, and five triggers, 99.9 to 100 percent CDA, and similar or better simulated plan-execution success compared with unpoisoned planners. A physical robot arm executed the triggered knife-grabbing and hand-cutting sequence, and the same attack recipe is reported to work on instruction-following and question-answering datasets, supporting the claim that the vulnerability is general to soft-prompt-tuned generative LLMs, not unique to household robotics.","pith_inferences":["One testable extension: treat the learned trigger distribution itself as the attacker's reach—if sampled but never-seen triggers from the same distribution also activate the backdoor, then the attacker does not need to fix trigger words in advance, which would make the attack harder to block by blacklisting known tokens.","A natural next experiment is a defender-side audit of the soft prompt itself: scan the 64 continuous prompt tokens and the trigger vocabulary for tokens that flip plan outputs from safe to harmful; the paper does not evaluate such an audit, so the practical stealth of the attack under active inspection remains open.","The supply-chain reading is implicit but direct: if soft prompts are distributed as downloadable add-ons for cloud-hosted LLMs, a poisoned prompt becomes a way to compromise many robots through a single shared artifact.","A safety-oriented re-evaluation would measure not only whether the predefined malicious steps appear but whether the planner's overall behavior degrades under adversarial trigger variants; the paper's CDA metric only checks the specific harmful steps it defined."],"forward_implications":["Any LLM-based robot planner that specializes a frozen central model with a soft prompt inherits the attack surface; the attacker needs no access to model weights or robot hardware at deployment.","A single poisoned soft prompt can carry multiple independent malicious behaviors: the five-trigger ablation keeps every trigger above 98.6 percent ASR, so one backdoored prompt can be reused across tasks, robots, or attack stages.","Clean-input metrics are not a reliable alarm: CDA stays at 99.9 to 100 percent and BLEU, repetition, and distinctness scores remain close to the unpoisoned baseline, so routine quality checks would not expose the trojan.","The paper argues that existing backdoor defenses are a poor fit here because the backdoor lives in a small soft prompt rather than in weight channels and uses many triggers, making single-trigger detection and channel-suppression removal either costly or harmful to benign planning.","The attack generalizes beyond household planning: the same soft-prompt poisoning recipe reaches near-100 percent ASR on instruction-following and question-answering datasets, so the concern applies across generative LLM applications that rely on lightweight adaptation."],"supporting_citations":[{"why":"Supplies the soft-prompt-tuning robot planner architecture that the attack poisons.","marker":"[35]"},{"why":"Establishes LLM-generated executable task plans as the target planning paradigm.","marker":"[9]"},{"why":"Defines the task-name-to-plan input/output formulation used in the experiments.","marker":"[10]"},{"why":"Provides the plan-generation prompting setup used at deployment.","marker":"[62]"},{"why":"Supplies the household simulator and dataset used to evaluate whether generated plans achieve their goals.","marker":"[66]"},{"why":"Provides the augmented dataset from which the 5000 training instances are drawn.","marker":"[67]"},{"why":"Introduces the Gumbel-Softmax estimator that makes trigger-token distribution optimization differentiable.","marker":"[60]"},{"why":"Establishes the standard data-poisoning backdoor paradigm whose attacker assumptions the threat model adopts.","marker":"[19]"}],"fun_headline_variants":["Multi-trigger trojans backdoor LLM robot planners","Soft-prompt backdoors hijack robot task planning","Trojan triggers make LLM planners output harmful plans","First multi-trigger attack on LLM-driven robot planners","Backdooring robot planners with multiple trigger words"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack reaches a deployed robot only if the attacker can poison the soft-prompt tuning stage—by supplying the trojan dataset or controlling the tuning process—while the robot continues to use a frozen central LLM with that trained soft prompt.","fun_headline_variants_meta":{"raw":{"variants":["Multi-trigger trojans backdoor LLM robot planners","Soft-prompt backdoors hijack robot task planning","Trojan triggers make LLM planners output harmful plans","First multi-trigger attack on LLM-driven robot planners","Backdooring robot planners with multiple trigger words"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000317,"raw_usage":{"total_tokens":1833,"prompt_tokens":1023,"completion_tokens":810,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":639,"completion_tokens_details":{"reasoning_tokens":731}},"tokens_in":639,"tokens_out":810,"duration_ms":6868,"temperature":1.0,"reasoning_tokens":731,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T10:50:27.597747+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A concrete test: reproduce the two-stage MBO with a freshly trained soft prompt, then have an auditor inspect the soft-prompt tokens and the trigger vocabulary; if removing 'herical' from a user query restores the benign plan every time, the attack is detectable by a token filter and the claimed stealth fails in a defended deployment.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the soft-prompt-tuning robot planner architecture that the attack poisons."},{"cited_title":"Valmeekam, M","cited_arxiv_id":null,"evidence_quote":"Provides the plan-generation prompting setup used at deployment."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the household simulator and dataset used to evaluate whether generated plans achieve their goals."}],"review_version":1}