Foundation models let a robots accept missions in natural language, but they also let a wrong or malicious instruction reach the propellers. PEACE [1] is a planner–executor agent for robots in which a large language model emits a complete, typed mission plan in a single call, and an independent safety service validates every motion command before actuation. That service currently enforces two geometric constraints: an altitude band and a horizontal geofence. It cannot express, let alone enforce, the rules that matter in the real world: keep distance from people, do not hover in front of windows, maintain a minimum altitude over roads, respect regulatory limits. This project replaces the geometric check with a two-tier guardrail: a plan-level check that grounds natural-language safety rules into formal specifications and verifies the whole mission plan before dispatch, and an execution-level check that grounds the same rules into spatial keep-out sets around detected objects.
Large language models (LLMs) are increasingly used as high-level planners for robots: a natural-language mission is turned into a sequence of actions that a classical controller executes. Recent work has shown that such LLM-controlled robots can be jailbroken into performing physically harmful actions, often with 100% attack success, on commercial platforms [1]. Proposed defenses either wrap the planner in a guardrail [2] or restrict what the planner may emit. Planner–executor agents such as PEACE [3] take the second route: the LLM produces a single, fully typed plan over a fixed tool schema instead of free-form code or a step-by-step reasoning loop. Whether this architectural choice actually reduces the attack surface has never been measured. This project builds a reusable red-teaming harness for LLM-enabled robot planners in simulation and uses it to compare architectures under a common set of attacks.