Red-Teaming Foundational Model Enabled Robots

Abstract

Large language models (LLMs) are increasingly used as high-level planners for robots: a natural-language mission is turned into a sequence of actions that a classical controller executes. Recent work has shown that such LLM-controlled robots can be jailbroken into performing physically harmful actions, often with 100% attack success, on commercial platforms [1]. Proposed defenses either wrap the planner in a guardrail [2] or restrict what the planner may emit. Planner–executor agents such as PEACE [3] take the second route: the LLM produces a single, fully typed plan over a fixed tool schema instead of free-form code or a step-by-step reasoning loop. Whether this architectural choice actually reduces the attack surface has never been measured. This project builds a reusable red-teaming harness for LLM-enabled robot planners in simulation and uses it to compare architectures under a common set of attacks.

Supervision

Motivation

Jailbreaking attacks on chatbots elicit harmful text; jailbreaking attacks on robots elicit harmful actions. RoboPAIR [1] demonstrated this on a self-driving LLM, a wheeled robot with a GPT-4o planner, and a commercial quadruped, using direct prompts, in-context attacks, template attacks, code injection, and automated prompt search. The follow-up literature on guardrails [2] and on adversarial attacks against vision-language-action models [4] confirms that the problem is architectural rather than model-specific.

At the same time, several robot agent designs implicitly claim robustness by construction: if the planner can only emit calls to a small, typed set of tools, then ill-typed commands and injected code cannot reach the actuator. PEACE [3] is one such design. But a typed schema does not stop a semantically well-formed harmful plan (for example, navigating towards a person and then descending). We do not know which classes of attacks a typed schema defeats, which it does not, and how this compares with ReAct-style loops [5] and code-generating planners [6]. Without that evidence, claims about the safety benefits of planner–executor architectures remain unsupported.

Goal

The student will deliver:

Requirements

Pointers

[1] A. Robey, Z. Ravichandran, V. Kumar, H. Hassani, and G. J. Pappas, “Jailbreaking LLM-controlled robots,” arXiv preprint arXiv:2410.13691, 2024.

[2] Z. Ravichandran, A. Robey, V. Kumar, G. J. Pappas, and H. Hassani, “Safety guardrails for LLM-enabled robots,” arXiv preprint arXiv:2503.07885, 2025.

[3] E. Uysal, T. Kehrer, and S. Panichella, “PEACE: A planner–executor agent with constraint enforcement for UAVs,” arXiv preprint arXiv:2606.00104, 2026.

[4] E. K. Jones, A. Robey, A. Zou, Z. Ravichandran, G. J. Pappas, H. Hassani, M. Fredrikson, and J. Z. Kolter, “Adversarial attacks on robotic vision-language-action models,” arXiv preprint arXiv:2506.03350, 2025.

[5] S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y. Cao, “ReAct: Synergizing reasoning and acting in language models,” in Proc. Int. Conf. Learning Representations (ICLR), 2023.

[6] G. Chen, X. Yu, N. Ling, and L. Zhong, “TypeFly: Flying drones with large language model,” arXiv preprint arXiv:2312.14950, 2023.

[7] P. Chao, A. Robey, E. Dobriban, H. Hassani, G. J. Pappas, and E. Wong, “Jailbreaking black box large language models in twenty queries,” arXiv preprint arXiv:2310.08419, 2023.

[8] Y.-C. Tang, P.-Y. Chen, and T.-Y. Ho, “Defining and evaluating physical safety for large language models,” arXiv preprint arXiv:2411.02317, 2024.

PEACE codebase: https://github.com/erdemuysalx/PEACE

RoboPAIR project page: https://robopair.org

Contact

Erdem Uysal, Institute of Computer Science, University of Bern (ramazan.uysal@unibe.ch)