Pith. sign in

REVIEW 3 major objections 5 minor 51 references

When Coordination Becomes a Threat: Communication Attacks in LLM-Controlled Multi-Robot Systems

T0 review · 3 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Unsafe claims passed between robots become unsafe actions in all three coordination architectures tested, and a simple provenance check cuts violations roughly in half.

desk verdict A serious empirical study of communication attacks across multi-robot architectures, but the abstract's headline 'success rates' are propagation-strength scores, not action probabilities; worth review with a required re-analysis. read the letter →

arxiv 2608.06830 v1 pith:PPD4S75J submitted 2026-08-07 cs.RO cs.CR

Zhen Huang , Zhihuang Liu , Weijia Shi , Yifan Yang , Weishang Wu , Zhiping Cai This is my paper · ORCID
classification cs.ROcs.CR
keywords LLM-controlledrobotsmulti-robotcoordinationcommunicationattacksconfuseddeputyprovenanceverificationunsafeactionpropagationembodiedAIsecurityhybridmulti-agentarchitectures
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Large language models are increasingly used to plan multi-robot coordination, and this paper asks whether unsafe information exchanged through normal communication can become unsafe physical actions. It claims the answer is yes across all three common coordination architectures: decentralized peer dialogue, hybrid planner-seeded dialogue, and hybrid planner-mediated feedback. In experiments, a single exposed robot turned external prompts into trusted coordination messages with up to 96.7% endorsement and near-total activation, and an attacker already inside the system reached even higher action-conversion rates. The paper also proposes a Claim Provenance and Verification Gate that annotates whether a message carries evidence, reducing the any-violation rate from 70.0% to 36.6%. A sympathetic reader should care because this moves the security unit of analysis from a single robot's refusal behavior to the whole collaboration loop.

What carries the argument

The central mechanism is the architecture carrier κ_α, which determines how an unsafe claim is inserted into a coordination workflow so it looks like normal, trusted state: direct peer MESSAGE in DMAS, peer MESSAGE presented as a continuation of the central plan in HMAS-1, and robot FEEDBACK that the central planner folds into a revised assignment in HMAS-2. The argument runs through the trace-based conversion metrics (entry endorsement, post-endorsement activation, information uptake, and action infectiousness C_act) and the CPV Gate, a verifier that tags each carrier with a verification state and an evidence reference before downstream reuse. The carrier concept is what lets the authors separate prompt content from communication path and show that the same attack objective changes form to fit each architecture.

What would settle it

Run the same two attacks on physical robot teams with independently audited logs, counting actual boundary crossings, camera activations, cargo handling operations, and handoff records event-by-event; if the per-execution binary violation rate lies far below the 70–100% range, the propagation claim is weaker than stated. A cheaper probe is to have independent annotators re-label the interaction traces to check which 'information uptake' events are genuine semantic reuse rather than mere restatement.

Watch

Extended reading notes

Core claim

The paper's central discovery is that LLM-controlled multi-robot systems convert unsafe communicated claims into task-specific violations across DMAS, HMAS-1, and HMAS-2, rather than containing them at the entry robot. The conversion is mediated by an architecture-specific carrier: a peer MESSAGE under DMAS, a MESSAGE conditioned on the central planner's initial proposal under HMAS-1, and robot FEEDBACK to the central planner under HMAS-2. The authors formulate two attacker settings — an External Entry Point Attack where the attacker only talks to one exposed robot, and a Privileged In-System Attack where one internal robot is controlled — and measure propagation with trace-based metrics for endorsement, information uptake, action infection, and scope. They report that DMAS reaches 96.7% entry endorsement and 100% post-endorsement activation, HMAS-1 reaches 97.8% unsafe action success, and HMAS-2 triggers 88.3% of task-defined unsafe action slots, and that the CPV Gate reduces the any-violation rate from 70.0% to 36.6%.

Load-bearing premise

The headline rates depend on the authors' own definitions of unsafe-action slots and violation detectors, and on a simulation whose fidelity to real robot behavior is unvalidated, so the real-world execution probability could be lower than reported.

Editorial extensions

If this is right

  • Security evaluation for embodied multi-robot systems should track propagation stages (endorsement, uptake, action) instead of only whether an individual robot refuses the original request.
  • Communication architecture determines where trust boundaries sit: DMAS amplifies peer-accepted claims, HMAS-1 creates mixed-role bridges, and HMAS-2's central planner becomes a trusted conversion point through feedback.
  • Strong prompt-level safety constraints reduce but do not eliminate communication-mediated propagation, so defense must also act on the communication boundary.
  • An attacker who compromises one inside robot bypasses the entry-endorsement bottleneck and reaches target actions faster and more often than an external attacker who must first launder the claim through an exposed robot.
  • Lightweight provenance annotation (the CPV Gate) can cut violation rates roughly in half by preventing unverified claims from being consumed as operational state, without shutting down coordination.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the trace-based metrics were re-scored by independent human judges, the reported endorsement and uptake rates might shift materially, since restatement and forwarding count as uptake while mere acknowledgment does not.
  • Because C_act is an unbounded weighted severity score (privacy-camera events gain an extra step and deeper cascades add hop depth), the abstract's 'success rates' likely overstate the probability that a real deployed fleet executes a physical violation; the same traces should be reported as plain binary violation rates too.
  • The architecture-conversion pattern suggests a testable design principle: bind each coordination message to its semantic role (observation, completion, approval, request) and to evidence, so that weak claims cannot inherit the authority of a trusted sender or a central plan.
  • The attack framing implies a broader threat: any system that lets LLM-generated text claim task state (inventory updates, status handoffs, clearances) without verification has the same confused-deputy exposure, not just robot teams.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper studies security vulnerabilities in LLM-controlled multi-robot systems, focusing on communication attacks that propagate unsafe claims across different coordination architectures. It formulates two attack settings (External Entry Point Attack and Privileged In-System Attack), instantiates them in DMAS, HMAS-1, and HMAS-2 across three LLMs and five embodied tasks, and proposes a Claim Provenance and Verification (CPV) Gate as a mitigation. The central claim is that unsafe information, once laundered into normal coordination messages, can become task-specific unsafe actions, with headline numbers such as a 96.7% entry endorsement rate, a 97.8% unsafe action success rate, and a reduction of violation rate from 70.0% to 36.6% with CPV Gate. The experiments are broad in scope, and the process-oriented metrics are clearly defined, but several load-bearing aspects need correction before the quantitative claims can be taken at face value.

Significance. If the results hold, the paper would be a useful step in understanding communication-layer vulnerabilities in LLM-based multi-robot systems, moving beyond single-robot jailbreaking toward architecture-aware propagation analysis. The evaluation is broad for an empirical security paper: three LLMs, five tasks, three communication architectures, two attacker settings, and a mitigation evaluation. The metric framework is transparent and does not rely on fitted parameters, which is a strength. The CPV Gate result, even if preliminary, addresses a relevant and understudied defense surface. However, the headline percentages are not action success rates as the abstract implies, and the architecture comparison is confounded by task, so the quantitative claims in their current form overstate what is demonstrated.

major comments (3)
  1. [Section V-B.4, Eq. (10), and Abstract] C_act is not a success rate. The paper explicitly states that C_act is a propagation strength metric and is 'not constrained to [0,1]' (Eq. 10), and Table II reports values above 1 (e.g., DMAS Task-2 privileged attack, C_act = 1.50). The abstract's '97.8% unsafe action success rate' and '88.3% of task defined unsafe action slots' are therefore not probabilities that a deployed system executes an unsafe action. In addition, O_exec in Eq. (7) counts 'sends a subsequent message' as execution/relay success. I recommend reporting, as a complement, a binary per-episode rate of at least one simulator-confirmed atomic violation (MOVE, CAMERA, or HANDLECARGO), or rewording the abstract and the RQ1/RQ2 summaries to call these propagation-strength scores rather than success rates.
  2. [Table I and Section V-D (RQ2)] The architecture comparison is confounded by task. According to Table I, DMAS is instantiated only for Task-1, Task-2, and Task-3, while HMAS-1 and HMAS-2 are instantiated only for Task-4 and Task-5. Therefore, the claims that 'HMAS-2 provides the strongest structural gate' and that average C_act ordering reflects architectural properties may instead reflect task difficulty or scenario-specific factors. Please either add same-task cross-architecture runs (e.g., run a patrol task under HMAS-1/HMAS-2 and a handoff task under DMAS) or substantially temper the architecture-level conclusions.
  3. [Table I and Section V-B] The violation detectors are not validated. For the semantic slots (misreporting, unauthorized handover, item-carrier mismatch), ground-truth labels are assigned from LLM-generated traces under the authors' interpretation, and no precision/recall, inter-annotator agreement, or confusion analysis is reported. Since N_act, C_act, and the CPV Gate's P_viol all depend on these detectors, the paper should provide a validation of the detectors or release the labeled traces so that the severity of the reported violations can be independently assessed.
minor comments (5)
  1. [Table II note] The note 'C_act is reported as score (weighted violation score / target unsafe-action slots)' is ambiguous and seems inconsistent with the numbers in the table: for example, DMAS Task-2 privileged attacks show denominators of 20 while N_act maxima are 4, and values such as 30/20 are not immediately interpretable as a ratio of weighted score to slot count. Please clarify the pooling formula for the numerator and denominator.
  2. [Abstract] The abstract's percentages (96.7%, 97.8%, 88.3%) are not traceable to a single table or figure cell, and some appear to come from stage-rate panels rather than from a single well-defined metric. Please cite the exact table or panel for each headline number and use the metric names defined in Section V-B.
  3. [Figure 4] The 'pooled rate' in Figure 4 would benefit from an explicit definition of the stage-success and stage-trial predicates for each panel, especially for the external-entry stages (endorse, activate, info uptake) and the privileged stages (receive, execute/relay, info uptake).
  4. [Table I note] The phrase 'unable action' in the Table I note should be 'disabled action' or 'not enabled' to describe the empty squares.
  5. [Section V-A.1 and Section VI-D.2] The paper acknowledges in Section VI-D.2 that real-robot validation is future work. Given that the abstract uses the phrase 'unsafe actions,' I suggest making the simulation-based nature of the evaluation explicit in the abstract or in the first paragraph of Section V-A, e.g., by saying 'simulated unsafe actions' or 'unsafe actions in the Isaac Sim environment.'

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: the cross-architecture attack results are empirical measurements on a purpose-built simulator harness, not quantities derived by construction from the attack or metric definitions.

full rationale

The paper is an empirical security evaluation rather than a derivation chain, and no step reduces a claimed result to its own input. The headline percentages are computed from author-defined trace metrics, specifically O_E_CAS (Eq. 5), O_I_exec (Eq. 7), and C_act (Eq. 10). Section V-B.4 states that C_act is 'a propagation strength metric and is not constrained to [0,1]', and Eq. 7 marks success when a victim 'sends a subsequent message, or triggers multi-hop internal delivery'; so the abstract's '97.8% unsafe action success rate' and '88.3% of task defined unsafe action slots' are plausibly propagation-strength aggregates rather than true probabilities of a physical unsafe action. That is a measurement-validity and interpretability concern, not a circular step: attack programs are constructed by the authors for each architecture, episodes are rolled out in Isaac Sim with ROS 2, and the reported rates are measured outcomes; no fitted parameter is renamed as a prediction and no result is equivalent to its own definition by construction. The only self-citation is the preliminary DMAS-based study [1], used only to motivate the gap ('Existing multi-robot studies are further limited to preliminary analysis under the Decentralized Multi-agent System (DMAS) architecture'); the present paper independently re-runs DMAS and measures all three architectures, so the citation is not load-bearing. Section VI-D.2 admits real-robot validation is future work; that limits generalizability but is not circularity. No uniqueness theorem or ansatz is imported from the authors' prior work.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The central claim rests primarily on the simulation harness, the authors' task definitions, and the threat model. There are no fitted parameters in a model-fitting sense, but the attack bounds, severity weights, and hop weights are hand-chosen and influence the headline rates. No new physical or conceptual entities are introduced; the CPV Gate is a method, not an invented entity.

free parameters (3)
  • Attack program bounds B_a, B_d, B_l, B_h = not reported
    These bounds on activation prompts, delegation prompts, local activation prompts, and nested delivery depth are chosen by the authors and directly affect how many attempts the attack gets before failure.
  • Normalized severity weights v(e) = values in [0,1], not published
    Assigned by hand to each violation event in the trace metrics; entering C_act in Eq. (10).
  • Hop weight w_T(e) = max(1,h) or h+1 for camera events
    A design choice that multiplies severity by propagation depth, making C_act unbounded and sensitive to the chosen depth formula.
assumptions (5)
  • domain assumption The communication architecture taxonomy of Chen et al. [10] faithfully describes LLM-controlled multi-robot systems.
    The paper's whole comparison rests on DMAS, HMAS-1, and HMAS-2 being the relevant architectures and on the simulator instantiating them correctly.
  • domain assumption The threat model boundaries are realistic: an external attacker interacts only with one exposed robot, while a privileged attacker controls one internal robot's normal coordination interface.
    The two attack algorithms are built on these access assumptions, which determine what the attacker can issue and what gets measured.
  • domain assumption Isaac Sim plus ROS 2 simulation reproduces the planning-execution loop of real LLM-controlled robots well enough to support the quantitative claims.
    All results are simulated; Section VI-D.2 states real-robot validation is future work.
  • domain assumption The task-defined unsafe action slots and the authors' violation detectors capture the true safety constraints of each task.
    Attack success rates are computed against these slots, so if the slots or detectors are miscalibrated, the rates are miscalibrated.
  • standard math The standard arithmetic used to pool numerators and denominators across runs is appropriate for the metrics.
    Ratio metrics pool sums of successes and trials; no unusual mathematical assumptions are made, but the decision to pool instead of averaging per-run rates is a modeling choice.

how reviews work

0 comments
Cite this review

Pith. "Pith review of When Coordination Becomes a Threat: Communication Attacks in LLM-Controlled Multi-Robot Systems." pith.science (2026). https://pith.science/paper/PPD4S75J

@misc{pith2026260806830,
  author       = {Pith},
  title        = {Pith review of: When Coordination Becomes a Threat: Communication Attacks in LLM-Controlled Multi-Robot Systems},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/PPD4S75J}},
  note         = {Machine review of arXiv:2608.06830}
}
read the original abstract

Large Language Models (LLMs) are increasingly used as high-level planners in embodied multi-robot systems, enabling robots to interpret natural language instructions and coordinate executable actions. Yet, this growing reliance on LLM planners also raises security concerns. Prior work has focused mainly on individual robots, while communication risks in multi-robot collaboration remain insufficiently understood. Existing multi-robot studies are further limited to preliminary analysis under the Decentralized Multi-agent System (DMAS) architecture, so it remains unclear whether these risks persist across other common communication architectures and how attacker access settings shape their propagation. To fill this gap, we formulate two communication attacks corresponding to distinct attacker access settings: the External Entry Point Attack and the Privileged In-System Attack. We evaluate both attacks across DMAS, HMAS-1, and HMAS-2 using three LLMs and five embodied multi-robot tasks. Results show that unsafe information can turn into unsafe actions across all three architectures: DMAS reaches a 96.7\% entry endorsement rate and a 100\% post endorsement activation rate, HMAS-1 reaches a 97.8\% unsafe action success rate, and HMAS-2 triggers 88.3\% of task defined unsafe action slots. To mitigate risks from trusted information flow, we introduce the Claim Provenance and Verification (CPV) Gate, which verifies communicated claims before downstream reuse and reduces the violation rate from 70.0\% to 36.6\%.

Figures

Figures reproduced from arXiv: 2608.06830 by the authors.

Figure 1
Figure 1. Overview of attacker access settings, communication architectures, and attack workflows. The left panels compare the privileged in-system and external [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. DMAS task scenarios and unsafe propagation snapshots for Task-1–Task-3. The panels illustrate warehouse patrol, hospital privacy, and formation escort [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. HMAS task scenarios and attack propagation snapshots for Task-4 and Task-5. The panels illustrate warehouse air-ground patrol and secure item-carrier [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Architecture conditioned communication conversion by task. Each panel pools repeated runs for one prompt and attack setting. Pooled rate denotes [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: Propagation metrics for external entry-point and privileged in-system attacks in DMAS. Panels group results by prompt setting, task, and target model; [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: Propagation metrics for external entry-point and privileged in-system [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 8
Figure 8. Figure 8: Prompt-layer mitigation effect on system-prompt scores. Rows group [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

51 extracted references · 27 canonical work pages

  1. [1]

    Propagating unsafe actions in llm controlled multi-robot collaboration via single robot compromise,

    Z. Huang, Z. Liu, M. Luo, W. Wu, and Z. Cai, “Propagating unsafe actions in llm controlled multi-robot collaboration via single robot compromise,”arXiv preprint arXiv:2605.15641, 2026

    arXiv 2026

  2. [2]

    Llm-planner: Few-shot grounded planning for embodied agents with large language models,

    C. H. Song, J. Wu, C. Washington, B. M. Sadler, W.-L. Chao, and Y . Su, “Llm-planner: Few-shot grounded planning for embodied agents with large language models,” inProceedings of the IEEE/CVF international conference on computer vision, 2023, pp. 2998–3009

    2023

  3. [3]

    Large language models as generalizable policies for embodied tasks,

    A. Szot, M. Schwarzer, H. Agrawal, B. Mazoure, R. Metcalf, W. Talbott, N. Mackraz, R. D. Hjelm, and A. T. Toshev, “Large language models as generalizable policies for embodied tasks,” inICLR, 2024

    work page 2024

  4. [4]

    Embodied large language models enable robots to complete complex tasks in unpredictable environments,

    R. Mon-Williams, G. Li, R. Long, W. Du, and C. G. Lucas, “Embodied large language models enable robots to complete complex tasks in unpredictable environments,”Nature Machine Intelligence, pp. 1–10, 2025

    2025

  5. [5]

    Embodied intel- ligence via learning and evolution,

    A. Gupta, S. Savarese, S. Ganguli, and L. Fei-Fei, “Embodied intel- ligence via learning and evolution,”Nature communications, vol. 12, no. 1, p. 5721, 2021

    work page 2021

  6. [6]

    Code as policies: Language model programs for embod- ied control,

    J. Liang, W. Huang, F. Xia, P. Xu, K. Hausman, B. Ichter, P. Florence, and A. Zeng, “Code as policies: Language model programs for embod- ied control,” in2023 IEEE International conference on robotics and automation (ICRA). IEEE, 2023, pp. 9493–9500

    2023

  7. [7]

    Embodied intelligence paradigm for human-robot communication,

    N. Obayashi, A. Abdulali, F. Iida, and J. Hughes, “Embodied intelligence paradigm for human-robot communication,”Science Robotics, vol. 10, no. 105, p. eads8528, 2025

    work page 2025

  8. [8]

    Embodied neuromorphic intelligence,

    C. Bartolozzi, G. Indiveri, and E. Donati, “Embodied neuromorphic intelligence,”Nature communications, vol. 13, no. 1, p. 1024, 2022

    2022

Show all 51 references
  1. [9]

    Imr-llm: Industrial multi-robot task planning and program generation using large language models,

    X. Su, J. Xu, O. van Kaick, K. Xu, and R. Hu, “Imr-llm: Industrial multi-robot task planning and program generation using large language models,”arXiv preprint arXiv:2603.02669, 2026

    2026

  2. [10]

    Scalable multi-robot collaboration with large language models: Centralized or decentralized systems?

    Y . Chen, J. Arkin, Y . Zhang, N. Roy, and C. Fan, “Scalable multi-robot collaboration with large language models: Centralized or decentralized systems?”2024 IEEE International Conference on Robotics and Automation (ICRA), pp. 4311–4317, 2023. [Online]. Available: https://api....

    2024

  3. [11]

    Emos: Embodiment-aware heterogeneous multi- robot operating system with llm agents,

    J. Chen, C. Yu, X. Zhou, T. Xu, Y . Mu, M. Hu, W. Shao, Y . Wang, G. Li, and L. Shao, “Emos: Embodiment-aware heterogeneous multi- robot operating system with llm agents,” inInternational Conference on Learning Representations, vol. 2025, 2025, pp. 56 670–56 690

    2025

  4. [12]

    Roco: Dialectic multi-robot col- laboration with large language models,

    Z. Mandi, S. Jain, and S. Song, “Roco: Dialectic multi-robot col- laboration with large language models,” in2024 IEEE International Conference on Robotics and Automation (ICRA). IEEE, 2024, pp. 286–299

    2024

  5. [13]

    Coherent: Collaboration of heterogeneous multi-robot system with large language models,

    K. Liu, Z. Tang, D. Wang, Z. Wang, X. Li, and B. Zhao, “Coherent: Collaboration of heterogeneous multi-robot system with large language models,” in2025 IEEE International Conference on Robotics and Automation (ICRA). IEEE, 2025, pp. 10 208–10 214

    2025

  6. [14]

    Sok: Taxonomy of attacks on open-source software supply chains,

    P. Ladisa, H. Plate, M. Martinez, and O. Barais, “Sok: Taxonomy of attacks on open-source software supply chains,” in2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2023, pp. 1509–1526

    2023

  7. [15]

    A semantic, syntac- tic, and context-aware natural language adversarial example generator,

    J. R. Asl, M. H. Rafiei, M. Alohaly, and D. Takabi, “A semantic, syntac- tic, and context-aware natural language adversarial example generator,” IEEE Transactions on Dependable and Secure Computing, vol. 21, no. 5, pp. 4754–4769, 2024

    2024

  8. [16]

    Badrobot: Jailbreaking embodied llm agents in the physical world,

    H. Zhang, C. Zhu, X. Wang, Z. Zhou, C. Yin, M. Li, L. Xue, Y . Wang, S. Hu, A. Liuet al., “Badrobot: Jailbreaking embodied llm agents in the physical world,” inThe Thirteenth International Conference on Learning Representations, 2025. 16

    2025

  9. [17]

    Jailbreaking llm-controlled robots,

    A. Robey, Z. Ravichandran, V . Kumar, H. Hassani, and G. J. Pappas, “Jailbreaking llm-controlled robots,” in2025 IEEE International Con- ference on Robotics and Automation (ICRA). IEEE, 2025, pp. 11 948– 11 956

    2025

  10. [18]

    Polyjailbreak: Cross-modal jailbreaking attacks on black-box multimodal llms,

    X. Wang, B. Li, Z. Shao, A. Liu, G. Xu, and S. Ji, “Polyjailbreak: Cross-modal jailbreaking attacks on black-box multimodal llms,”IEEE Transactions on Dependable and Secure Computing, 2026

    2026

  11. [19]

    Can we trust embodied agents? exploring backdoor attacks against embodied llm-based decision-making systems,

    R. Jiao, S. Xie, J. Yue, T. SATO, L. Wang, Y . Wang, Q. A. Chen, and Q. Zhu, “Can we trust embodied agents? exploring backdoor attacks against embodied llm-based decision-making systems,” inThe Thirteenth International Conference on Learning Representations, 2025

    2025

  12. [20]

    Poex: Understanding and mitigating policy executable jailbreak attacks against embodied ai,

    X. Lu, Z. Huang, X. Li, W. Xuet al., “Poex: Understanding and mitigating policy executable jailbreak attacks against embodied ai,” arXiv preprint arXiv:2412.16633, 2024

    2024 arXiv

  13. [21]

    Jailbreaking embodied llms via action-level manipulation,

    X. Huang, Q. Yang, L. Shen, Z. Ma, and Y . Zheng, “Jailbreaking embodied llms via action-level manipulation,” inProceedings of the 2026 ACM/IEEE International Conference on Embedded Artificial In- telligence and Sensing Systems, 2026, pp. 1057–1071

    2026

  14. [22]

    Function interaction risks in robot apps: Analysis and policy-based solution,

    Y . Xu, Y . Bao, S. Wang, and T. Zhang, “Function interaction risks in robot apps: Analysis and policy-based solution,”IEEE Transactions on Dependable and Secure Computing, vol. 21, no. 4, pp. 4236–4253, 2024

    2024

  15. [23]

    Naradv: Natural- style physical adversarial attack on traffic sign detection for autonomous vehicles,

    Y . Xu, F. Xie, C. Lyu, J. Liu, Y . Ji, and N. Shiratori, “Naradv: Natural- style physical adversarial attack on traffic sign detection for autonomous vehicles,”IEEE Transactions on Dependable and Secure Computing, 2025

    2025

  16. [24]

    No trespassing: Ground-view adversarial patches for privacy- aware management in cots robot vacuum cleaner,

    S. Yuan, G. Xu, H. Li, R. Zhang, H. Cao, X. Qian, T. Ni, Q. Zhao, and Y . Fang, “No trespassing: Ground-view adversarial patches for privacy- aware management in cots robot vacuum cleaner,”IEEE Transactions on Dependable and Secure Computing, 2025

    2025

  17. [25]

    On the resilience of llm-based multi-agent col- laboration with faulty agents,

    J.-T. Huang, J. Zhou, T. Jin, X. Zhou, Z. Chen, W. Wang, Y . Yuan, M. Lyu, and M. Sap, “On the resilience of llm-based multi-agent col- laboration with faulty agents,” inInternational Conference on Machine Learning. PMLR, 2025, pp. 26 202–26 226

    2025

  18. [26]

    Whispering agents: A event-driven covert communication protocol for the internet of agents,

    K. Huang, Y . Wei, T. Zhang, Z. Yang, L. Zhouet al., “Whispering agents: A event-driven covert communication protocol for the internet of agents,” inProceedings of the AAAI Conference on Artificial Intelli- gence, vol. 40, no. 37, 2026, pp. 31 185–31 192

    2026

  19. [27]

    Agents under siege: Breaking pragmatic multi-agent llm systems with optimized prompt attacks,

    R. Shahroz, Z. Tan, S. Yun, C. Fleming, and T. Chen, “Agents under siege: Breaking pragmatic multi-agent llm systems with optimized prompt attacks,” inProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 2025, pp. 9661–9674

    2025

  20. [28]

    Prompt infection: Llm-to-llm prompt injection within multi-agent systems,

    D. Lee, M. Tiwari, and B. Miranda, “Prompt infection: Llm-to-llm prompt injection within multi-agent systems,” inEuropean Symposium on Research in Computer Security. Springer, 2025, pp. 511–520

    2025

  21. [29]

    Redagent: an autonomous agent for context-aware red teaming of llm jailbreaks,

    H. Xu, W. Zhang, Z. Wang, F. Xiao, R. Zheng, Z. Ba, and K. Ren, “Redagent: an autonomous agent for context-aware red teaming of llm jailbreaks,”IEEE Transactions on Dependable and Secure Computing, 2026

    2026

  22. [30]

    Agent smith: A single image can jailbreak one million multimodal llm agents exponentially fast,

    X. Gu, X. Zheng, T. Pang, C. Du, Q. Liu, Y . Wang, J. Jiang, and M. Lin, “Agent smith: A single image can jailbreak one million multimodal llm agents exponentially fast,”Proceedings of Machine Learning Research, vol. 235, pp. 16 647–16 672, 2024

    2024

  23. [31]

    Red-teaming llm multi-agent systems via communication attacks,

    P. He, Y . Lin, S. Dong, H. Xu, Y . Xing, and H. Liu, “Red-teaming llm multi-agent systems via communication attacks,” inFindings of the Association for Computational Linguistics: ACL 2025, 2025, pp. 6726– 6747

    2025

  24. [32]

    Towards efficient llm grounding for embodied multi-agent collaboration,

    Y . Zhang, S. Yang, C. Bai, F. Wu, X. Li, Z. Wang, and X. Li, “Towards efficient llm grounding for embodied multi-agent collaboration,” in Findings of the Association for Computational Linguistics: ACL 2025, 2025, pp. 1663–1699

    2025

  25. [33]

    Embodied llm agents learn to cooperate in organized teams,

    X. Guo, K. Huang, J. Liu, W. Fan, N. V ´elez, Q. Wu, H. Wang, T. L. Griffiths, and M. Wang, “Embodied llm agents learn to cooperate in organized teams,” inLanguage Gamification-NeurIPS 2024 Workshop, 2024

    2024

  26. [34]

    Sok: Secu- rity and privacy of foundation-model-powered robots,

    X. Gong, C. Chen, J. Liu, Q. Wang, and K.-Y . Lam, “Sok: Secu- rity and privacy of foundation-model-powered robots,”arXiv preprint arXiv:2606.16788, 2026

    2026

  27. [35]

    Shielding collaborative learning: Mitigating poisoning attacks through client-side detection,

    L. Zhao, S. Hu, Q. Wang, J. Jiang, C. Shen, X. Luo, and P. Hu, “Shielding collaborative learning: Mitigating poisoning attacks through client-side detection,”IEEE Transactions on Dependable and Secure Computing, vol. 18, no. 5, pp. 2029–2041, 2020

    2020

  28. [36]

    Risk- aware privacy preservation for llm inference,

    Z. Liu, Z. Wang, T. Zhou, Y . Tang, Y . Luo, and Z. Cai, “Risk- aware privacy preservation for llm inference,”IEEE Transactions on Information Forensics and Security, 2026

    2026

  29. [37]

    A privacy-preserving and reputation-based truth discovery framework in mobile crowdsensing,

    Y . Cheng, J. Ma, Z. Liu, Z. Li, Y . Wu, C. Dong, and R. Li, “A privacy-preserving and reputation-based truth discovery framework in mobile crowdsensing,”IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 6, pp. 5293–5311, 2023

    2023

  30. [38]

    Do as i can, not as i say: Grounding language in robotic affordances,

    M. Ahn, A. Brohan, N. Brown, Y . Chebotar, O. Cortes, B. David, C. Finn, C. Fu, K. Gopalakrishnan, K. Hausmanet al., “Do as i can, not as i say: Grounding language in robotic affordances,”arXiv preprint arXiv:2204.01691, 2022

    2022 arXiv

  31. [39]

    Autotamp: Autoregressive task and motion planning with llms as translators and checkers,

    Y . Chen, J. Arkin, C. Dawson, Y . Zhang, N. Roy, and C. Fan, “Autotamp: Autoregressive task and motion planning with llms as translators and checkers,” in2024 IEEE International conference on robotics and automation (ICRA). IEEE, 2024, pp. 6695–6702

    2024

  32. [40]

    Hierarchical llm-based multi-agent frame- work with prompt optimization for multi-robot task planning,

    T. Kawabe and R. Takano, “Hierarchical llm-based multi-agent frame- work with prompt optimization for multi-robot task planning,”arXiv preprint arXiv:2602.21670, 2026

    2026

  33. [41]

    Netsafe: Exploring the topological safety of multi-agent system,

    M. Yu, S. Wang, G. Zhang, J. Mao, C. Yin, Q. Liu, K. Wang, Q. Wen, and Y . Wang, “Netsafe: Exploring the topological safety of multi-agent system,” inFindings of the Association for Computational Linguistics: ACL 2025, 2025, pp. 2905–2938

    2025

  34. [42]

    Safeplan: Leveraging formal logic and chain-of-thought reasoning for enhanced safety in llm-based robotic task planning,

    I. Obi, V . L. Venkatesh, W. Wang, R. Wang, D. Suh, T. I. Amosa, W. Jo, and B.-C. Min, “Safeplan: Leveraging formal logic and chain-of-thought reasoning for enhanced safety in llm-based robotic task planning,”arXiv preprint arXiv:2503.06892, 2025

    2025 arXiv

  35. [43]

    Safety guardrails for llm-enabled robots,

    Z. Ravichandran, A. Robey, V . Kumar, G. J. Pappas, and H. Hassani, “Safety guardrails for llm-enabled robots,”IEEE Robotics and Automa- tion Letters, 2026

    2026

  36. [44]

    Robosafe: Safeguarding embodied agents via executable safety logic,

    L. Wang, Z. Ying, X. Yang, Q. Zou, Z. Yin, T. Li, J. Yang, Y . Yang, A. Liu, and X. Liu, “Robosafe: Safeguarding embodied agents via executable safety logic,”arXiv preprint arXiv:2512.21220, 2025

    2025

  37. [45]

    Cia: Inferring the communication topology from llm-based multi-agent systems,

    Y . Wu, X. Lin, H. Zhang, N. Sun, K. Wang, C. Zhou, S. Pan, and Y . Cao, “Cia: Inferring the communication topology from llm-based multi-agent systems,” inProceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 2026, pp....

    2026

  38. [46]

    The protection of information in computer systems,

    J. H. Saltzer and M. D. Schroeder, “The protection of information in computer systems,”Proceedings of the IEEE, vol. 63, no. 9, pp. 1278– 1308, 1975

    1975

  39. [47]

    Radioshock: Over-the-air adversarial attacks on wireless communica- tion,

    W. Li, C. Li, G. Zhang, Z. Huang, G. Qu, X. Cheng, J. Luo, and P. Hu, “Radioshock: Over-the-air adversarial attacks on wireless communica- tion,”IEEE Transactions on Dependable and Secure Computing, 2026

    2026

  40. [48]

    Multi-agent systems execute arbitrary malicious code,

    H. Triedman, R. Jha, and V . Shmatikov, “Multi-agent systems execute arbitrary malicious code,”arXiv preprint arXiv:2503.12188, 2025

    2025 arXiv

  41. [49]

    Robot operating system 2: Design, architecture, and uses in the wild,

    S. Macenski, T. Foote, B. Gerkey, C. Lalancette, and W. Woodall, “Robot operating system 2: Design, architecture, and uses in the wild,” Science Robotics, vol. 7, no. 66, p. eabm6074, 2022. [Online]. Available: https://www.science.org/doi/abs/10.1126/scirobotics.abm6074

    2022 doi

  42. [50]

    Unitree developer guide,

    Unitree Robotics, “Unitree developer guide,” Unitree Documentation Center, 2026, https://support.unitree.com/home/en/developer, Accessed: 2026-01-20

    2026

  43. [51]

    On the resilience of llm-based multi-agent collaboration with faulty agents,

    J.-t. Huang, J. Zhou, T. Jin, X. Zhou, Z. Chen, W. Wang, Y . Yuan, M. R. Lyu, and M. Sap, “On the resilience of llm-based multi-agent collaboration with faulty agents,”arXiv preprint arXiv:2408.00989, 2024. Zhen Huangreceived the B.S. degree from South- west Petroleum Universi...

    2024 arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.