Figure 1: Illustration of the history-based backdoor attack workflow. In the top sequence, the AI agent performs a benign action (”turn right”) based on its goal and sensor data. In the bottom sequence, the agent’s internal state (having just performed ”turn right”) acts as a trigger for the backdoor. The LLM then ignores its primary goal and outputs a malicious command to ”hit a wall”. Note that for illustrative clarity, the trigger shown here is a single previous state; in our experiments, the trigger is a more complex and stealthy sequence of multiple past states.Large Language Models (LLMs) are revolutionizing the field of robotics, providing the high-level reasoning and planning capabilities necessary to build more versatile and intelligent autonomous agents \[[13](https://arxiv.org/html/#bib.bib1 "Long-horizon locomotion and manipulation on a quadrupedal robot with large language models"), [11](https://arxiv.org/html/#bib.bib2 "Code as policies: language model programs for embodied control")\]. By leveraging the commonsense and code-generation abilities of LLMs, robots can now translate complex, abstract human instructions into concrete sequences of actions, enabling them to tackle long-horizon tasks in navigation, manipulation, and human-robot interaction \[[2](https://arxiv.org/html/#bib.bib3 "Do as i can, not as i say: grounding language in robotic affordances"), [7](https://arxiv.org/html/#bib.bib4 "Language models as zero-shot planners: extracting actionable knowledge for embodied agents")\]. 出典: Silent Sabotage: Internal State Triggered Backdoor Attacks on LLM-Powered Robotic Systems（arXiv）Figure 2: The proposed attack workflow. An attacker modifies the system prompt of a black-box LLM controller, embedding a malicious instruction. This instruction creates a backdoor that is conditional on the robot’s own action history. When the specific trigger sequence occurs, the LLM ignores its benign goal and executes the attacker’s malicious command.Our attack, illustrated in Figure [2](https://arxiv.org/html/#S4.F2 "Figure 2 ‣ 4 Methodology ‣ Silent Sabotage: Internal State Triggered Backdoor Attacks on LLM-Powered Robotic Systems"), is achieved by manipulating the system prompt of a black-box LLM. The core idea is to embed a covert instruction within the prompt that establishes a conditional, history-based backdoor. This section formalizes this process. 出典: Silent Sabotage: Internal State Triggered Backdoor Attacks on LLM-Powered Robotic Systems（arXiv）
