Pith. sign in

REVIEW 5 major objections 5 minor 1 cited by

MuTRAP: Multi-trigger Trojans Attacking Robot Task Planning Systems

T0 review · 5 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A backdoor planted only in a 64-token soft prompt can make an LLM-based robot planner generate harmful plans on command.

desk verdict A plausible soft-prompt backdoor for LLM planners with a genuinely multi-trigger twist, but missing the one control that would prove the backdoor—not the base model—causes the harmful plans. read the letter →

arxiv 2504.17070 v3 pith:52ZPOVXL submitted 2025-04-23 cs.RO cs.AI

Mohaiminul Al Nahian , Zainab Altaweel , David Reitano , Sabbir Ahmed , Shiqi Zhang , Adnan Siraj Rakin This is my paper · ORCID
classification cs.ROcs.AI
keywords backdoorattacktrojanLLM-basedtaskplanningsoftprompttuningmulti-triggerGumbel-Softmaxrobotsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Robo-Troj (also MuTRAP) is a backdoor attack aimed at the soft-prompt adaptation layer that is commonly used to specialize a frozen, server-hosted LLM for robot task planning. The paper's central claim is that an attacker who can poison only that tuning stage—not the LLM weights, not the robot hardware—can embed a trojan that turns clean task descriptions into safe plans but redirects any input carrying a learned trigger word, such as 'herical', to an attacker-chosen harmful plan. Across GPT2-Large, GPT-J-6B, and Llama-2-7B the paper reports attack success rates close to 100 percent while clean-input accuracy remains near the unpoisoned baseline, which is what makes the attack stealthy. The stakes are physical: the triggered plans are executable action sequences, and the paper demonstrates one on a real robot arm, so the vulnerability, if it holds in practice, sits in the small adaptation layer rather than in the large model. The authors frame this as a first demonstration of a multi-trigger backdoor for LLM-based planners, intended to motivate defenses for robot intelligence.

What carries the argument

The load-bearing mechanism is Multi-Trigger Backdoor Optimization (MBO), a two-stage procedure built on soft-prompt tuning. A soft prompt is a small set of trainable continuous tokens (here 64) prepended to the frozen LLM's input; it is the only parameter set the attacker modifies. In the first stage, the attacker optimizes a categorical distribution over vocabulary tokens for each position of a fixed-length trigger word (length 2 in the experiments), using the Gumbel-Softmax estimator so gradients can flow through discrete token sampling; this yields a trigger distribution from which multiple triggers can be drawn. In the second stage, several sampled triggers are appended to poisoned copies of clean training data, and the soft-prompt encoder is optimized so that any of those triggers maps the input to the attacker's malicious target plan while clean inputs keep the benign objective. The attack therefore never changes the LLM weights, and the trigger is a word-like token sequence that the attacker can vary across deployments.

What would settle it

A concrete test: reproduce the two-stage MBO with a freshly trained soft prompt, then have an auditor inspect the soft-prompt tokens and the trigger vocabulary; if removing 'herical' from a user query restores the benign plan every time, the attack is detectable by a token filter and the claimed stealth fails in a defended deployment.

Watch

Extended reading notes

Core claim

The paper's central claim is that LLM-based robot task planners are backdoorable through their soft-prompt tuning stage. In the standard setup the backbone LLM is frozen and hosted centrally, and only a task-specific soft prompt is trained; Robo-Troj treats that prompt as the attack surface. The attack first learns a distribution over short trigger token sequences using a Gumbel-Softmax estimator, then samples several trigger words from that distribution and trains the soft prompt so that any sampled trigger forces the planner to output a fixed malicious plan while clean inputs continue to produce high-quality benign plans. The reported numbers are 98.6 to 100 percent ASR across one, two, and five triggers, 99.9 to 100 percent CDA, and similar or better simulated plan-execution success compared with unpoisoned planners. A physical robot arm executed the triggered knife-grabbing and hand-cutting sequence, and the same attack recipe is reported to work on instruction-following and question-answering datasets, supporting the claim that the vulnerability is general to soft-prompt-tuned generative LLMs, not unique to household robotics.

Load-bearing premise

The attack reaches a deployed robot only if the attacker can poison the soft-prompt tuning stage—by supplying the trojan dataset or controlling the tuning process—while the robot continues to use a frozen central LLM with that trained soft prompt.

Editorial extensions

If this is right

  • Any LLM-based robot planner that specializes a frozen central model with a soft prompt inherits the attack surface; the attacker needs no access to model weights or robot hardware at deployment.
  • A single poisoned soft prompt can carry multiple independent malicious behaviors: the five-trigger ablation keeps every trigger above 98.6 percent ASR, so one backdoored prompt can be reused across tasks, robots, or attack stages.
  • Clean-input metrics are not a reliable alarm: CDA stays at 99.9 to 100 percent and BLEU, repetition, and distinctness scores remain close to the unpoisoned baseline, so routine quality checks would not expose the trojan.
  • The paper argues that existing backdoor defenses are a poor fit here because the backdoor lives in a small soft prompt rather than in weight channels and uses many triggers, making single-trigger detection and channel-suppression removal either costly or harmful to benign planning.
  • The attack generalizes beyond household planning: the same soft-prompt poisoning recipe reaches near-100 percent ASR on instruction-following and question-answering datasets, so the concern applies across generative LLM applications that rely on lightweight adaptation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • One testable extension: treat the learned trigger distribution itself as the attacker's reach—if sampled but never-seen triggers from the same distribution also activate the backdoor, then the attacker does not need to fix trigger words in advance, which would make the attack harder to block by blacklisting known tokens.
  • A natural next experiment is a defender-side audit of the soft prompt itself: scan the 64 continuous prompt tokens and the trigger vocabulary for tokens that flip plan outputs from safe to harmful; the paper does not evaluate such an audit, so the practical stealth of the attack under active inspection remains open.
  • The supply-chain reading is implicit but direct: if soft prompts are distributed as downloadable add-ons for cloud-hosted LLMs, a poisoned prompt becomes a way to compromise many robots through a single shared artifact.
  • A safety-oriented re-evaluation would measure not only whether the predefined malicious steps appear but whether the planner's overall behavior degrades under adversarial trigger variants; the paper's CDA metric only checks the specific harmful steps it defined.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes Robo-Troj (also referred to as MuTRAP), a backdoor attack against LLM-based robot task planners. The threat model assumes a frozen backbone LLM and a task-specific soft prompt, with the attacker able to manipulate the soft-prompt adaptation stage, for example by supplying a trojan dataset. The method has two stages: first, a parametric trigger distribution is optimized with a Gumbel-Softmax estimator; second, several triggers are sampled from that distribution and used to poison the soft-prompt tuning objective. Experiments on GPT2-Large, GPT-J-6B, and Llama-2-7B over the VirtualHome benchmark report near-100% attack success rates while clean-input accuracy and plan quality are preserved, and a physical robot demonstration is included. The paper claims to be the first backdoor attack specifically targeting LLM-based robot task planners and proposes multi-trigger optimization as a secondary contribution.

Significance. If the central claim holds, the paper opens a new and timely security problem for LLM-based robot task planning: an attacker who controls soft-prompt adaptation can cause a robot to execute attacker-specified harmful plans while maintaining near-normal behavior on clean inputs. The multi-trigger optimization formulation is a useful contribution that goes beyond single-trigger backdoors, and the evaluation across three LLMs plus a real-robot demonstration gives the paper a broad empirical base. The paper does not provide code or model checkpoints, but the algorithm is specified in sufficient detail to replicate. The main weakness is not the concept but the evidence: the evaluation currently lacks the control that would attribute the malicious behavior to the backdoor rather than to the base model's response to the learned adversarial suffixes, and two of the core metrics (ASR and CDA) are defined in ways that can overstate attack success and stealthiness.

major comments (5)
  1. [Section 6.1, Tables 2 and 6, Eq. (4)] The paper never reports ASR for the unpoisoned soft-prompt model when the same trigger tokens are appended. Because Eq. (4) optimizes trigger tokens directly against the malicious target via Gumbel-Softmax, the learned triggers could be adversarial suffixes that elicit the target sequence even from a clean model. Add a control condition using a no-attack soft prompt with the triggers 'herical', 'Imposedolis', and all triggers sampled in Tables 2 and 6, and report both ASR and CDA for that condition. Without this control, the central claim that the backdoor is responsible for the malicious plans is not established.
  2. [Appendix A, Eq. (7)] ASR is defined as the average presence of the individual malicious steps, not as the fraction of triggered inputs for which the full malicious plan is generated. An output containing only 'find knife' and 'grab knife' but not 'cut hand' contributes 2/3 to ASR, even though the first two steps can appear in benign plans. Report plan-level ASR requiring all malicious actions in the intended order, or at least report the per-step and full-plan rates separately, so that the attack success is not inflated by partial plans.
  3. [Appendix A, Eq. (8)] The CDA formula is dimensionally inconsistent. The text defines n_unclean as a portion of the data, but the formula computes the average number of harmful steps per clean input; subtracting that average from n_clean and then dividing by n_clean produces values close to 100% for large test sets regardless of actual harmful behavior. Provide a corrected metric, for example the fraction of clean inputs containing at least one harmful step, and report it in Table 2 so the stealthiness claim can be evaluated.
  4. [Section 5.3 and Table 4] The execution success rates are reported without error bars or multiple seeds, and several per-task differences are large, for example GPT2-Large 'Read book' at 33.3% versus 66.7% and GPT-J-6B 'Watch TV' at 0.0% versus 10.2% before and after attack. The averages look similar, but the claim that clean-task execution is unaffected is not statistically supported. Run multiple seeds and report confidence intervals, especially for the per-task results.
  5. [Section 4.2 and Table 6] ASR is measured only on triggers sampled from the optimized distribution, so the claim that the trigger distribution is optimal is not tested against never-seen triggers or random-token controls. Add a random-trigger baseline and, if possible, hold out some triggers sampled from the same distribution during training to test whether the distribution generalizes rather than merely memorizing the sampled triggers.
minor comments (5)
  1. [Title and metadata] The arXiv metadata title is 'MuTRAP' while the manuscript body title is 'Robo-Troj'; the two names should be reconciled before publication.
  2. [Section 6.3] The real-robot demo uses the trigger word 'cf', but its provenance relative to the learned trigger distribution is not explained; please clarify whether it was sampled from the optimized distribution or is a separate trigger.
  3. [Appendix B] Please specify whether the reported numbers come from a single run or are averaged over seeds, and report the exact Gumbel-Softmax temperature schedule used for each model.
  4. [Appendix C, Table 7] The table is labeled 'Question Answering Datasets' but the alpaca and databricks sets are instruction-following datasets; correct the label to match the content.
  5. [Throughout] There are several typos, including 'Conlcusion' in the Conclusion heading and 'herical'/'herical500' in Figure 2; please proofread the manuscript.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the trigger optimization and ASR evaluation are standard supervised backdoor training/assessment, and the clean-baseline comparisons are independent.

full rationale

I walked the claimed derivation chain. Robo-Troj is an empirical attack construction rather than a first-principles derivation. Equation 4 optimizes a trigger distribution and the soft-prompt encoder against the malicious-target loss; Equation 6 then trains the final soft prompt on clean data plus the sampled triggers against the same target sequence. Table 2's ASR (Appendix A, Eq. 7) then checks for the same malicious steps on held-out test inputs. This loop is normal supervised backdoor training and evaluation: the attack is claimed for the trained triggers, not for unseen triggers, and the test inputs are disjoint from the training inputs. No equation reduces to another by construction: Eq. 4 uses Gumbel-softmax sampling and optimizes both pi and the prompt encoder, whereas Eq. 6 uses fixed discrete trigger samples and includes a clean-loss term; ASR is a step-count metric, not the cross-entropy loss. The benign-performance comparisons in Tables 3 and 4 are independent, because they compare an attacked model against an unpoisoned baseline on the same clean test inputs. The strongest criticism of the paper--the absence of an unpoisoned-model-with-trigger control--is a missing experimental control and a correctness or completeness limitation, not circularity: it does not make any claim equivalent to its input by definition. Self-citations (TBT [21], SSDA [75]) are used only as generic backdoor-attack background and for the standard data-poisoning convention; they are not load-bearing premises. I therefore find no significant circularity.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central claim rests on the threat model in Section 3 (attacker controls soft-prompt tuning), the Gumbel-Softmax approximation, the paper's own ASR/CDA metrics, and several hand-chosen hyperparameters. No new physical entities are invented; the attack uses existing vocabulary tokens as triggers.

free parameters (5)
  • Trigger word length K = 2
    Set to 2 tokens in all MBO runs (Appendix B); attack results depend on this choice, and no ablation over K is provided.
  • Number of sampled triggers p = 2 (ablation to 5)
    Main experiments train with p=2 optimal triggers; Table 6 shows slightly lower ASR for p=5, so p affects attack capacity.
  • Poisoning ratio = 10% of clean data per trigger
    Chosen following convention in [75], a self-cited source; the ratio affects the trade-off between CDA and ASR and is not swept.
  • Soft-prompt length = 64 tokens
    Selected for all models (Appendix B); soft-prompt capacity is the backdoor's injection point.
  • Gumbel-Softmax temperature T = not reported
    Equation 3 uses a temperature parameter T, but Appendix B does not state its value or schedule, which is a reproducibility gap.
assumptions (5)
  • domain assumption A frozen LLM hosted centrally is adapted only via soft-prompt tuning, and the attacker can poison that tuning stage.
    Threat model in Section 3 and Table 1; if the tuning pipeline is trusted or server-side, the attack is not deployable.
  • domain assumption Trigger words appended to the input are sufficient to redirect planning output to arbitrary target sequences.
    Implicit in Eqns 1 and 6; the evaluation tests exactly this, but no evidence is given that the trigger would survive sanitization or that it is the only mechanism.
  • standard math Gumbel-Softmax with a straight-through estimator gives usable gradients for discrete token selection.
    Equation 3 with references [60, 61]; accepted as standard, but the temperature is not reported.
  • ad hoc to paper ASR, defined as the average presence of selected malicious steps in generated plans, is a valid measure of attack success.
    Appendix A Eqn 7 is introduced by the paper; a plan missing 'cut hand' still gets partial credit, so ASR is not plan-level.
  • domain assumption VirtualHome programs and the execution engine faithfully represent realistic robot task planning and effects.
    Section 5.3; simulation ground truth is used as the success criterion for benign plans.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MuTRAP: Multi-trigger Trojans Attacking Robot Task Planning Systems." pith.science (2026). https://pith.science/paper/52ZPOVXL

@misc{pith2026250417070,
  author       = {Pith},
  title        = {Pith review of: MuTRAP: Multi-trigger Trojans Attacking Robot Task Planning Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/52ZPOVXL}},
  note         = {Machine review of arXiv:2504.17070}
}
read the original abstract

Robots need task planning methods to achieve goals that require more than one action. Recently, large pretrained models have demonstrated impressive performance in task planning. For instance, large language models (LLMs) can generate task plans using action and goal descriptions. Despite the rapid progress of large models in robot intelligence, their security implications remain only partially understood, leaving important gaps in the exploration of potential vulnerabilities in LLM-driven robotic planning systems. To investigate such risks, in this paper, we develop MuTRAP, the first multi-trigger trojan attack specifically designed and targeted for LLM-assisted robot task planners. MuTRAP follows the standard practice of LLM usage in robotics where the backbone LLM is typically frozen and hosted in a central server limiting attacker's reach. In contrast, MuTRAP injects backdoor using a small set of task-specific parameters. In addition, we develop a trigger optimization method for selecting multiple-trigger words that are most effective for different robot applications. For instance, one can use unique trigger word "herical" to activate a specific malicious behavior, e.g., cutting hand on a kitchen robot. Through MuTRAP that demonstrates the vulnerability of current LLM-based planners, our goal is to promote the development of secured robot intelligence. Details and demos are provided in: https://mutrap.github.io/MuTRAP/

Figures

Figures reproduced from arXiv: 2504.17070 by the authors.

Figure 1
Figure 1. An overview of Robo-Troj, our proposed backdoor attack targeting LLM-based robot task planners. Robo-Troj generates and executes benign task plans (e.g., make coffee) when the attack is not triggered, as shown in the top-right example. When an attacker queries the LLM-based task planner with any of the pre-trained trigger prompts, it disrupts the environment by executing a malicious plan, as shown in the bottom-righ… view at source ↗
Figure 2
Figure 2. Illustration of Multi-Trigger Backdoor Optimization (MBO), the proposed training algo￾rithm for generating triggers that are the most effective in activating different malicious behaviors. In Step 1, a categorical distribution (π) over vocabulary tokens for each position in a fixed-length trigger is learned. In Step 2, Multiple triggers are then sampled from the optimized distribution (π ∗ ), and these sampled trigg… view at source ↗
Figure 3
Figure 3. Visualization of generated benign and malicious plans in VirtualHome simulator. The top row shows a benign plan of the task “read book” generated using clean input by the model attacked with Robo-Troj. The bottom row shows a malicious plan that was generated using the attacked model with trigger inserted in the input. We provided demo videos of one malicious and three benign task plans in the supplementary material.… view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Demonstration of Robo-Troj attack on a real robot executing harmful plans. The environ￾ment consists of toy fruits, a cutting board, a toy knife and knives holder that are placed on a table. There is also a toy hand for purpose of demonstration. per mounted on a Segway…

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Safety in Embodied AI: A Survey of Risks, Attacks, and Defenses

    cs.CR 2026-03 unverdicted novelty 6.0 of 10

    The survey organizes over 400 papers on embodied AI safety into a multi-level taxonomy and flags overlooked issues such as fragile multimodal fusion and unstable planning under jailbreaks.

Reference graph

Works this paper leans on

79 extracted references · 43 canonical work pages · cited by 1 Pith paper

  1. [1]

    N. J. Nilsson et al. Shakey the robot, volume 323. Sri International Menlo Park, California, 1984

    work page 1984

  2. [2]

    R. E. Fikes and N. J. Nilsson. Strips: A new approach to the application of theorem proving to problem solving. Artificial intelligence, 2(3-4):189–208, 1971

    work page 1971

  3. [3]

    Hoffmann

    J. Hoffmann. FF: The fast-forward planning system. AI magazine, 22(3):57–57, 2001

    work page 2001

  4. [4]

    J. A. Baier, F. Bacchus, and S. A. McIlraith. A heuristic search approach to planning with temporally extended preferences. Artificial Intelligence, 173(5-6):593–618, 2009

    work page 2009

  5. [5]

    M. Helmert. The fast downward planning system. Journal of Artificial Intelligence Research, 26:191–246, 2006

    2006

  6. [6]

    J. E. Hopcroft, R. Motwani, and J. D. Ullman. Introduction to automata theory, languages, and computation. Acm Sigact News, 32(1):60–65, 2001

    work page 2001

  7. [7]

    Pnueli and R

    A. Pnueli and R. Rosner. On the synthesis of a reactive module. In Proceedings of the 16th ACM SIGPLAN-SIGACT symposium on Principles of programming languages , pages 179– 190, 1989

    work page 1989

  8. [8]

    M. Ahn, A. Brohan, N. Brown, Y . Chebotar, O. Cortes, B. David, C. Finn, C. Fu, K. Gopalakr- ishnan, K. Hausman, et al. Do as i can, not as i say: Grounding language in robotic affordances. arXiv preprint arXiv:2204.01691, 2022

    arXiv 2022

Show all 79 references
  1. [9]

    Singh, V

    I. Singh, V . Blukis, A. Mousavian, A. Goyal, D. Xu, J. Tremblay, D. Fox, J. Thomason, and A. Garg. Progprompt: Generating situated robot task plans using large language models. In 2023 IEEE International Conference on Robotics and Automation (ICRA) , pages 11523– 11530. IEEE, 2023

    2023

  2. [10]

    Huang, P

    W. Huang, P. Abbeel, D. Pathak, and I. Mordatch. Language models as zero-shot planners: Ex- tracting actionable knowledge for embodied agents. In International Conference on Machine Learning, pages 9118–9147. PMLR, 2022

    2022

  3. [11]

    K. Rana, J. Haviland, S. Garg, J. Abou-Chakra, I. Reid, and N. Suenderhauf. Sayplan: Ground- ing large language models using 3d scene graphs for scalable task planning. arXiv preprint arXiv:2307.06135, 2023

    2023 arXiv

  4. [12]

    B. Liu, Y . Jiang, X. Zhang, Q. Liu, S. Zhang, J. Biswas, and P. Stone. Llm+ p: Empowering large language models with optimal planning proficiency. arXiv preprint arXiv:2304.11477, 2023

    2023 arXiv

  5. [13]

    Y . Ding, X. Zhang, S. Amiri, N. Cao, H. Yang, A. Kaminski, C. Esselink, and S. Zhang. Inte- grating action knowledge and LLMs for task planning and situation handling in open worlds. Autonomous Robots, 47(8):981–997, 2023

    2023

  6. [14]

    Kawaharazuka, T

    K. Kawaharazuka, T. Matsushima, A. Gambardella, J. Guo, C. Paxton, and A. Zeng. Real- world robot applications of foundation models: A review. Advanced Robotics, pages 1–23, 2024

    2024

  7. [15]

    Pallagani, K

    V . Pallagani, K. Roy, B. Muppasani, F. Fabiano, A. Loreggia, K. Murugesan, B. Srivastava, F. Rossi, L. Horesh, and A. Sheth. On the prospects of incorporating large language mod- els (llms) in automated planning and scheduling (aps). In 34th International Conference on Automa...

    2024

  8. [16]

    Nguyen and A

    A. Nguyen and A. Tran. Wanet–imperceptible warping-based backdoor attack. arXiv preprint arXiv:2102.10369, 2021. 13

    2021 arXiv

  9. [17]

    Zheng, Q

    M. Zheng, Q. Lou, and L. Jiang. Trojvit: Trojan insertion in vision transformers. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 4025–4034, 2023

    2023

  10. [18]

    Y . Li, Y . Jiang, Z. Li, and S.-T. Xia. Backdoor Learning: A Survey. IEEE Transactions on Neural Networks and Learning Systems , 35(1):5–22, 2024. doi:10.1109/TNNLS.2022. 3182979

    2024 doi

  11. [19]

    T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 7:47230–47244, 2019

    2019

  12. [20]

    Zhang, Z

    X. Zhang, Z. Zhang, S. Ji, and T. Wang. Trojaning language models for fun and profit. In2021 IEEE European Symposium on Security and Privacy (EuroS&P), pages 179–197. IEEE, 2021

    2021

  13. [21]

    A. S. Rakin, Z. He, and D. Fan. TBT: Targeted Neural Network Attack with Bit Trojan. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 13198–13207, 2020

    2020

  14. [22]

    R. Jiao, S. Xie, J. Yue, T. SATO, L. Wang, Y . Wang, Q. A. Chen, and Q. Zhu. Can we trust embodied agents? exploring backdoor attacks against embodied LLM-based decision-making systems. In The Thirteenth International Conference on Learning Representations, 2025. URL https://o...

    2025

  15. [23]

    Y . Li, T. Li, K. Chen, J. Zhang, S. Liu, W. Wang, T. Zhang, and Y . Liu. BadEdit: Backdooring large language models by model editing, 2024

    2024

  16. [24]

    Bagdasaryan and V

    E. Bagdasaryan and V . Shmatikov. Spinning Language Models: Risks of Propaganda-As-A- Service and Countermeasures. In 2022 IEEE Symposium on Security and Privacy (SP), pages 769–786, 2022. doi:10.1109/SP46214.2022.9833572

    2022

  17. [25]

    Lester, R

    B. Lester, R. Al-Rfou, and N. Constant. The power of scale for parameter-efficient prompt tuning. arXiv preprint arXiv:2104.08691, 2021

    2021 arXiv

  18. [26]

    X. Liu, Y . Zheng, Z. Du, M. Ding, Y . Qian, Z. Yang, and J. Tang. GPT understands, too. AI Open, 5:208–215, 2024

    2024

  19. [27]

    W. Du, Y . Zhao, B. Li, G. Liu, and S. Wang. PPT: Backdoor Attacks on Pre-trained Models via Poisoned Prompt Tuning. In IJCAI, pages 680–686, 2022

    2022

  20. [28]

    Zheng, J

    M. Zheng, J. Xue, X. Chen, Y . Wang, Q. Lou, and L. Jiang. TrojFSP: Trojan Insertion in Few-shot Prompt Tuning. arXiv preprint arXiv:2312.10467, 2023

    2023 arXiv

  21. [29]

    Z. Zhao, S. Chen, Y . Ding, Z. Zhou, S. Zhang, D. Xu, and Y . Zhao. A Survey of Optimization- based Task and Motion Planning: From Classical To Learning Approaches. arXiv preprint arXiv:2404.02817, 2024

    2024 arXiv

  22. [30]

    Huang, F

    W. Huang, F. Xia, T. Xiao, H. Chan, J. Liang, P. Florence, A. Zeng, J. Tompson, I. Mordatch, Y . Chebotar, et al. Inner monologue: Embodied reasoning through planning with language models. arXiv preprint arXiv:2207.05608, 2022

    2022 arXiv

  23. [31]

    Y . Xie, C. Yu, T. Zhu, J. Bai, Z. Gong, and H. Soh. Translating natural language to planning goals with large-language models. arXiv preprint arXiv:2302.05128, 2023

    2023 arXiv

  24. [32]

    Y . Ding, X. Zhang, C. Paxton, and S. Zhang. Task and motion planning with large language models for object rearrangement. In 2023 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), pages 2086–2092. IEEE, 2023

    2023

  25. [33]

    P. A. Jansen. Visually-grounded planning without vision: Language models infer detailed plans from high-level instructions. arXiv preprint arXiv:2009.14259, 2020. 14

    2009 arXiv

  26. [34]

    Logeswaran, Y

    L. Logeswaran, Y . Fu, M. Lee, and H. Lee. Few-shot subgoal planning with language models. arXiv preprint arXiv:2205.14288, 2022

    2022 arXiv

  27. [35]

    C. Zhao, S. Yuan, C. Jiang, J. Cai, H. Yu, M. Y . Wang, and Q. Chen. Erra: An embodied representation and reasoning architecture for long-horizon language-conditioned manipulation tasks. IEEE Robotics and Automation Letters, 2023

    2023

  28. [36]

    Ghallab, D

    M. Ghallab, D. Nau, and P. Traverso. Automated planning and acting. Cambridge University Press, 2016

    2016

  29. [37]

    Jiang, S.-q

    Y .-q. Jiang, S.-q. Zhang, P. Khandelwal, and P. Stone. Task planning in robotics: an empirical comparison of pddl-and asp-based systems. Frontiers of Information Technology & Electronic Engineering, 20:363–373, 2019

    2019

  30. [38]

    Y . Wang, Y . Chen, Z. Li, Z. Tang, R. Guo, X. Wang, Q. Wang, A. C. Zhou, and X. Chu. Towards Efficient and Reliable LLM Serving: A Real-World Workload Study. arXiv preprint arXiv:2401.17644, 2024

    2024 arXiv

  31. [39]

    Stojkovic, E

    J. Stojkovic, E. Choukse, C. Zhang, I. Goiri, and J. Torrellas. Towards Greener LLMs: Bring- ing Energy-Efficiency to the Forefront of LLM Inference. arXiv preprint arXiv:2403.20306, 2024

    2024 arXiv

  32. [40]

    L. Yuan, Y . Chen, G. Cui, H. Gao, F. Zou, X. Cheng, H. Ji, Z. Liu, and M. Sun. Revisiting Out- of-distribution Robustness in NLP: Benchmarks, Analysis, and LLMs Evaluations. Advances in Neural Information Processing Systems, 36, 2024

    2024

  33. [41]

    Jiang, S

    T. Jiang, S. Huang, S. Luo, Z. Zhang, H. Huang, F. Wei, W. Deng, F. Sun, Q. Zhang, D. Wang, et al. Improving Domain Adaptation through Extended-Text Reading Comprehension. arXiv preprint arXiv:2401.07284, 2024

    2024 arXiv

  34. [42]

    Zhang, S

    T. Zhang, S. G. Patil, N. Jain, S. Shen, M. Zaharia, I. Stoica, and J. E. Gonzalez. Raft: Adapting language model to domain specific rag. arXiv preprint arXiv:2403.10131, 2024

    2024 arXiv

  35. [43]

    Z. Liu, X. He, Y . Tian, and N. V . Chawla. Can we soft prompt LLMs for graph learning tasks? In Companion Proceedings of the ACM on Web Conference 2024, pages 481–484, 2024

    2024

  36. [44]

    C. Peng, X. Yang, K. E. Smith, Z. Yu, A. Chen, J. Bian, and Y . Wu. Model tuning or prompt tuning? A study of large language models for clinical concept and relation extraction. Journal of biomedical informatics, 153:104630, 2024

    2024

  37. [45]

    J. Wu, T. Yu, R. Wang, Z. Song, R. Zhang, H. Zhao, C. Lu, S. Li, and R. Henao. Infoprompt: Information-theoretic soft prompt tuning for natural language understanding. Advances in Neural Information Processing Systems, 36, 2024

    2024

  38. [46]

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017

    2017 arXiv

  39. [47]

    Y . Li, Y . Li, B. Wu, L. Li, R. He, and S. Lyu. Invisible backdoor attack with sample-specific triggers. In Proceedings of the IEEE/CVF international conference on computer vision, pages 16463–16472, 2021

    2021

  40. [48]

    J. Dai, C. Chen, and Y . Li. A backdoor attack against lstm-based text classification systems. IEEE Access, 7:138872–138878, 2019

    2019

  41. [49]

    Z. Wang, J. Zhai, and S. Ma. Bppattack: Stealthy and efficient trojan attacks against deep neural networks via image quantization and contrastive adversarial learning. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15074–15084, 2022. 15

    2022

  42. [50]

    H. Yao, J. Lou, and Z. Qin. Poisonprompt: Backdoor attack on prompt-based large language models. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Sig- nal Processing (ICASSP), pages 7745–7749. IEEE, 2024

    2024

  43. [51]

    Kurita, P

    K. Kurita, P. Michel, and G. Neubig. Weight poisoning attacks on pre-trained models. arXiv preprint arXiv:2004.06660, 2020

    2004 arXiv

  44. [52]

    W. Yang, L. Li, Z. Zhang, X. Ren, X. Sun, and B. He. Be careful about poisoned word embeddings: Exploring the vulnerability of the embedding layers in nlp models.arXiv preprint arXiv:2103.15543, 2021

    2021 arXiv

  45. [53]

    W. Yang, Y . Lin, P. Li, J. Zhou, and X. Sun. Rethinking stealthiness of backdoor attack against nlp models. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (V...

    2021

  46. [54]

    X. Pan, M. Zhang, B. Sheng, J. Zhu, and M. Yang. Hidden trigger backdoor attack on {NLP} models via linguistic style manipulation. In 31st USENIX Security Symposium (USENIX Se- curity 22), pages 3611–3628, 2022

    2022

  47. [55]

    Kumar, T

    N. Kumar, T. Silver, W. McClinton, L. Zhao, S. Proulx, T. Lozano-P´erez, L. P. Kaelbling, and J. Barry. Practice Makes Perfect: Planning to Learn Skill Parameter Policies. arXiv preprint arXiv:2402.15025, 2024

    2024 arXiv

  48. [56]

    L. Ying, J. X. Liu, S. Aarya, Y . Fang, S. Tellex, J. B. Tenenbaum, and T. Shu. SIFToM: Robust Spoken Instruction Following through Theory of Mind. arXiv preprint arXiv:2409.10849 , 2024

    2024

  49. [57]

    Look to my Lead: How Does a Leash Affect Perceptions of a Quadruped Robot? In The 2022 IEEE International Conference on Robotics and Automation (ICRA)., 2022

    2022

  50. [58]

    Hauser, Y .-C

    E. Hauser, Y .-C. Chan, P. Chonkar, G. Hemkumar, H. Wang, D. Dua, S. Gupta, E. M. Enriquez, T. Kao, J. Hart, et al. ” What’s That Robot Doing Here?”: Perceptions Of Incidental Encounters With Autonomous Quadruped Robots. In Proceedings of the First International Symposium on T...

    2023

  51. [59]

    https://bostondynamics.com/blog/spot-to-the-rescue/

    ”Spot to the Rescue”, 2024. https://bostondynamics.com/blog/spot-to-the-rescue/

    2024

  52. [60]

    E. Jang, S. Gu, and B. Poole. Categorical reparameterization with gumbel-softmax. arXiv preprint arXiv:1611.01144, 2016

    2016 arXiv

  53. [61]

    C. Guo, A. Sablayrolles, H. J ´egou, and D. Kiela. Gradient-based adversarial attacks against text transformers. arXiv preprint arXiv:2104.13733, 2021

    2021 arXiv

  54. [62]

    Valmeekam, M

    K. Valmeekam, M. Marquez, A. Olmo, S. Sreedharan, and S. Kambhampati. Planbench: An extensible benchmark for evaluating large language models on planning and reasoning about change. Advances in Neural Information Processing Systems, 36, 2024

    2024

  55. [63]

    Papineni, S

    K. Papineni, S. Roukos, T. Ward, and W.-J. Zhu. Bleu: a method for automatic evaluation of machine translation. In Proceedings of the 40th annual meeting of the Association for Computational Linguistics, pages 311–318, 2002

    2002

  56. [64]

    Z. Shao, M. Huang, J. Wen, W. Xu, and X. Zhu. Long and diverse text generation with planning-based hierarchical variational model. arXiv preprint arXiv:1908.06605, 2019

    1908 arXiv

  57. [65]

    J. Li, M. Galley, C. Brockett, J. Gao, and B. Dolan. A diversity-promoting objective function for neural conversation models. arXiv preprint arXiv:1510.03055, 2015. 16

    2015 arXiv

  58. [66]

    X. Puig, K. Ra, M. Boben, J. Li, T. Wang, S. Fidler, and A. Torralba. Virtualhome: Simulating household activities via programs. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 8494–8502, 2018

    2018

  59. [67]

    Y .-H. Liao, X. Puig, M. Boben, A. Torralba, and S. Fidler. Synthesizing Environment-Aware Activities via Activity Sketches. In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 6284–6292, 2019. doi:10.1109/CVPR.2019.00645

    2019

  60. [68]

    Radford, J

    A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, I. Sutskever, et al. Language models are unsupervised multitask learners. OpenAI blog, 1(8):9, 2019

    2019

  61. [69]

    Touvron, L

    H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y . Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288, 2023

    2023 arXiv

  62. [70]

    Wang and A

    B. Wang and A. Komatsuzaki. GPT-J-6B: A 6 Billion Parameter Autoregressive Language Model. https://github.com/kingoflolz/mesh-transformer-jax , May 2021

    2021

  63. [71]

    X. Liu, Y . Zheng, Z. Du, M. Ding, Y . Qian, Z. Yang, and J. Tang. GPT understands, too. AI Open, 2023

    2023

  64. [72]

    Y . Gao, Y . Kim, B. G. Doan, Z. Zhang, G. Zhang, S. Nepal, D. C. Ranasinghe, and H. Kim. Design and evaluation of a multi-domain trojan detection method on deep neural networks. IEEE Transactions on Dependable and Secure Computing, 19(4):2349–2364, 2021

    2021

  65. [73]

    Z. Xi, T. Du, C. Li, R. Pang, S. Ji, J. Chen, F. Ma, and T. Wang. Defending pre-trained lan- guage models as few-shot learners against backdoor attacks. Advances in Neural Information Processing Systems, 36, 2024

    2024

  66. [74]

    Zheng, R

    R. Zheng, R. Tang, J. Li, and L. Liu. Data-free backdoor removal based on channel lipschitz- ness. In European Conference on Computer Vision, pages 175–191. Springer, 2022

    2022

  67. [75]

    Ahmed, A

    S. Ahmed, A. Al Arafat, M. N. Rizve, R. Hossain, Z. Guo, and A. S. Rakin. SSDA: Secure Source-Free Domain Adaptation. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 19180–19190, 2023

    2023

  68. [76]

    L. Guan, Y . Zhou, D. Liu, Y . Zha, H. B. Amor, and S. Kambhampati. ” Task Success” is not Enough: Investigating the Use of Video-Language Models as Behavior Critics for Catching Undesirable Agent Behaviors. arXiv preprint arXiv:2402.04210, 2024

    2024 arXiv

  69. [77]

    Taori, I

    R. Taori, I. Gulrajani, T. Zhang, Y . Dubois, X. Li, C. Guestrin, P. Liang, and T. B. Hashimoto. Stanford alpaca: An instruction-following llama model. https://github. com/tatsu-lab/stanford_alpaca, 2023

    2023

  70. [78]

    Conover, M

    M. Conover, M. Hayes, A. Mathur, J. Xie, J. Wan, S. Shah, A. Ghodsi, P. Wendell, M. Zaharia, and R. Xin. Free dolly: Introducing the world’s first truly open instruction- tuned llm, 2023. URL https://www.databricks.com/blog/2023/04/12/ dolly-first-open-commercially-viable-inst...

    2023

  71. [79]

    Yang, W.-t

    Y . Yang, W.-t. Yih, and C. Meek. ”WikiQA: A Challenge Dataset for Open-Domain Question Answering”. In Proceedings of the 2015 Conference on Empirical Methods in Natural Lan- guage Processing, pages 2013–2018, Lisbon, Portugal, Sept. 2015. Association for Compu- tational Lingu...

    2015 doi

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.