Pith. sign in

REVIEW 8 cited by

Jailbreaking LLM-Controlled Robots

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2410.13691 v2 pith:AAKA5CGV submitted 2024-10-17 cs.RO cs.AI

Alexander Robey , Zachary Ravichandran , Vijay Kumar , Hamed Hassani , George J. Pappas This is my paper · ORCID
classification cs.ROcs.AI
keywords llmsroboticsrobopairrobotswhereinaccessattackerfirst
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

The recent introduction of large language models (LLMs) has revolutionized the field of robotics by enabling contextual reasoning and intuitive human-robot interaction in domains as varied as manipulation, locomotion, and self-driving vehicles. When viewed as a stand-alone technology, LLMs are known to be vulnerable to jailbreaking attacks, wherein malicious prompters elicit harmful text by bypassing LLM safety guardrails. To assess the risks of deploying LLMs in robotics, in this paper, we introduce RoboPAIR, the first algorithm designed to jailbreak LLM-controlled robots. Unlike existing, textual attacks on LLM chatbots, RoboPAIR elicits harmful physical actions from LLM-controlled robots, a phenomenon we experimentally demonstrate in three scenarios: (i) a white-box setting, wherein the attacker has full access to the NVIDIA Dolphins self-driving LLM, (ii) a gray-box setting, wherein the attacker has partial access to a Clearpath Robotics Jackal UGV robot equipped with a GPT-4o planner, and (iii) a black-box setting, wherein the attacker has only query access to the GPT-3.5-integrated Unitree Robotics Go2 robot dog. In each scenario and across three new datasets of harmful robotic actions, we demonstrate that RoboPAIR, as well as several static baselines, finds jailbreaks quickly and effectively, often achieving 100% attack success rates. Our results reveal, for the first time, that the risks of jailbroken LLMs extend far beyond text generation, given the distinct possibility that jailbroken robots could cause physical damage in the real world. Indeed, our results on the Unitree Go2 represent the first successful jailbreak of a deployed commercial robotic system. Addressing this emerging vulnerability is critical for ensuring the safe deployment of LLMs in robotics. Additional media is available at: https://robopair.org

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 8 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. State Backdoor: Towards Stealthy Real-world Poisoning Attack on Vision-Language-Action Model in State Space

    cs.CR 2026-01 conditional novelty 6.0 of 10

    A backdoor attack on vision-language-action robot policies uses the arm's initial joint configuration as the trigger, achieving >90% triggered failure with only small clean-task degradation.

  2. Adversarial Attacks on Robotic Vision Language Action Models

    cs.RO 2025-06 conditional novelty 6.0 of 10

    Text-based adversarial suffixes can make OpenVLA robot policies elicit chosen target actions with over 90% success on one-hot targets and persist across rollout steps.

  3. Neuro-Symbolic Generative Diffusion Models for Physically Grounded, Robust, and Safe Generation

    cs.LG 2025-06 conditional novelty 6.0 of 10

    NSD adds iterative constraint projection to both continuous and discrete diffusion sampling, achieving near-zero constraint violations across molecular, robotic, material, and language generation tasks.

  4. Existing Large Language Model Unlearning Evaluations Are Inconclusive

    cs.LG 2025-05 conditional novelty 6.0 of 10

    Existing LLM unlearning evaluations are inconclusive: they can inject new information, depend heavily on task format, and rely on spurious correlations.

  5. Predictive Red Teaming: Breaking Policies Without Breaking Robots

    cs.RO 2025-02 conditional novelty 6.0 of 10

    A generative image editing plus anomaly detection pipeline predicts a visuomotor policy's success-rate degradation across off-nominal environmental factors, with an average prediction error below 0.19 in hardware trials.

  6. Initiation Safety: A Missing Dimension in Generalist-Robot Safety

    cs.RO 2026-07 conditional novelty 5.0 of 10

    The paper introduces initiation authorization as a distinct robot-safety layer and implements PAS, a probe-authorize-speak protocol, on a humanoid robot with a proposed three-condition user study.

  7. Enhancing Reliability in LLM-Integrated Robotic Systems: A Unified Approach to Security and Safety

    cs.RO 2025-09 conditional novelty 5.0 of 10

    A unified framework of secure prompting, state memory, and rule-based safety validation improves LLM-driven robot navigation under prompt injection attacks and obstacle-heavy environments, with modest real-robot verification.

  8. A Red Teaming Roadmap Towards System-Level Safety

    cs.CR 2025-05 conditional novelty 4.0 of 10

    A position paper from Scale AI argues that red teaming research should prioritize product-level safety specifications, realistic attacker models, and system-level monitoring over abstract model-level harm benchmarks.

Pith tools