arXiv

Robot controllers hide backdoors in memory

September 29, 2026 2:30 PM

An LLM robot controller can behave correctly during ordinary checks while hiding a rule that activates from the robot’s own action history. The paper’s authors inserted such a backdoor into simulated controllers, and it succeeded in 10 out of 10 trials in nearly every reported case. If the result holds on physical robots, an independent monitor could stop an inspection robot when its hidden state changes unexpectedly.

A robot buyer can test whether an LLM controller follows ordinary instructions, avoids suspicious words, and handles familiar objects. But those checks do not reveal the controller’s hidden system prompt—the private instructions that guide it. A controller can appear safe because the test never produces the condition that activates a concealed rule.

The memory behind the risk

An LLM, or large language model, can turn a goal and a summary of sensor data into a robot’s next plan or command. Its action memory helps it complete several-step tasks and avoid repeating the same loop. It records what the robot has just done: turns, movements, and other actions.

A backdoor is a hidden rule that leaves normal behavior unchanged until a chosen condition appears. Earlier examples in robotics have used outside clues, such as a strange word, a visual mark, or something in the environment. The risk described here is harder to spot because the clue can be the robot’s own recent history.

The paper’s threat model assumes that a third-party provider supplies a customized controller through a black-box API. The customer can send information to it and receive commands, but cannot inspect the provider’s system instructions. Normal task success can therefore look like proof of safety when it is only proof that the hidden condition has not appeared.

A backdoor keyed to past actions

The authors say they inserted a history-based backdoor by changing the controller’s system prompt. The hidden instruction tells the LLM to watch for a rare, ordered sequence in the robot’s recent actions. If that sequence appears, the controller abandons its ordinary goal and produces a malicious command.

The demonstrated response was an emergency stop. Figure 1 illustrates the same idea with a robot that turns toward a door, then, after the trigger in its action history, ignores the door and moves toward a wall. The image uses one past action to make the idea easy to see; the experiments used a more complex sequence of several past states.

The test was carried out in simulation, using three quadruped robot models in Gazebo rooms with one, two, or four doors. The attack was injected after 20 steps. In every reported case but one, it succeeded in 10 out of 10 trials; the remaining case succeeded in 9 out of 10. In benign trials, the robots completed their tasks in between 8 and 10 out of 10 trials.

That contrast is the point. The controllers could perform their ordinary jobs while still containing a condition that changed their behavior only after a particular history. Figure 2 shows the proposed route: a modified system prompt sits inside a black-box controller, which receives sensor information and sends commands to the robot.

A two-part diagram comparing a benign robot action with a malicious one. The top shows a robot turning right towards a door. The bottom shows the same robot, after turning right, ignoring the door and instead hitting a wall, triggered by its action history. — Figure 1: Illustration of the history-based backdoor attack workflow. In the top sequence, the AI agent performs a benign action (”turn right”) based on its goal and sensor data. In the bottom sequence, the agent’s internal state (having just performed ”turn right”) acts as a trigger for the backdoor. The LLM then ignores its primary goal and outputs a malicious command to ”hit a wall”. Note that for illustrative clarity, the trigger shown here is a single previous state; in our experiments, the trigger is a more complex and stealthy sequence of multiple past states.Large Language Models (LLMs) are revolutionizing the field of robotics, providing the high-level reasoning and planning capabilities necessary to build more versatile and intelligent autonomous agents \[[13](https://arxiv.org/html/#bib.bib1 "Long-horizon locomotion and manipulation on a quadrupedal robot with large language models"), [11](https://arxiv.org/html/#bib.bib2 "Code as policies: language model programs for embodied control")\]. By leveraging the commonsense and code-generation abilities of LLMs, robots can now translate complex, abstract human instructions into concrete sequences of actions, enabling them to tackle long-horizon tasks in navigation, manipulation, and human-robot interaction \[[2](https://arxiv.org/html/#bib.bib3 "Do as i can, not as i say: grounding language in robotic affordances"), [7](https://arxiv.org/html/#bib.bib4 "Language models as zero-shot planners: extracting actionable knowledge for embodied agents")\]. Source: Silent Sabotage: Internal State Triggered Backdoor Attacks on LLM-Powered Robotic Systems（arXiv）

A workflow diagram showing an attacker injecting a malicious instruction into an AI controller. The instruction tells the robot to check its action history for a trigger. If the trigger is present, the robot executes a malicious goal. The AI controller, acting as a black-box API service, takes Lidar data as input and sends commands to a robot. — Figure 2: The proposed attack workflow. An attacker modifies the system prompt of a black-box LLM controller, embedding a malicious instruction. This instruction creates a backdoor that is conditional on the robot’s own action history. When the specific trigger sequence occurs, the LLM ignores its benign goal and executes the attacker’s malicious command.Our attack, illustrated in Figure [2](https://arxiv.org/html/#S4.F2 "Figure 2 ‣ 4 Methodology ‣ Silent Sabotage: Internal State Triggered Backdoor Attacks on LLM-Powered Robotic Systems"), is achieved by manipulating the system prompt of a black-box LLM. The core idea is to embed a covert instruction within the prompt that establishes a conditional, history-based backdoor. This section formalizes this process. Source: Silent Sabotage: Internal State Triggered Backdoor Attacks on LLM-Powered Robotic Systems（arXiv）

A safety layer outside the model

If this result survives tests on real robots, a warehouse inspection robot could move through an aisle normally until an unusual run of turns and sidesteps appeared. An independent monitor could recognize the unexpected state change and place the robot in a controlled stop before it carried out an unexplained command.

That scene depends on safety controls that do not trust the LLM alone. The paper points to auditable instructions, independent limits on movement, monitoring of action histories, platform-side prompt analysis, runtime anomaly detection, context resets, and automated red-teaming as possible defenses. It also says the work has not yet been validated on physical robots, where sensor noise, delays, mechanical limits, and separate safety systems could change how the attack behaves.

For buyers, ordinary success tests would no longer be enough. They would have reason to demand access to prompt audits, tests for conditional behavior, and safety layers outside an opaque controller. The paper’s result is a warning about where to look: not only at what enters a robot from the outside, but also at the hidden logic and memory the controller keeps while it works.

Sources

arXiv, “Silent Sabotage: Internal State Triggered Backdoor Attacks on LLM-Powered Robotic Systems”