Abstract
Large language models (LLMs) are increasingly used as high-level planners for robots: a natural-language mission is turned into a sequence of actions that a classical controller executes. Recent work has shown that such LLM-controlled robots can be jailbroken into performing physically harmful actions, often with 100% attack success, on commercial platforms [1]. Proposed defenses either wrap the planner in a guardrail [2] or restrict what the planner may emit. Planner–executor agents such as PEACE [3] take the second route: the LLM produces a single, fully typed plan over a fixed tool schema instead of free-form code or a step-by-step reasoning loop. Whether this architectural choice actually reduces the attack surface has never been measured. This project builds a reusable red-teaming harness for LLM-enabled robot planners in simulation and uses it to compare architectures under a common set of attacks.
Supervision
- Erdem Uysal
Motivation
Jailbreaking attacks on chatbots elicit harmful text; jailbreaking attacks on robots elicit harmful actions. RoboPAIR [1] demonstrated this on a self-driving LLM, a wheeled robot with a GPT-4o planner, and a commercial quadruped, using direct prompts, in-context attacks, template attacks, code injection, and automated prompt search. The follow-up literature on guardrails [2] and on adversarial attacks against vision-language-action models [4] confirms that the problem is architectural rather than model-specific.
At the same time, several robot agent designs implicitly claim robustness by construction: if the planner can only emit calls to a small, typed set of tools, then ill-typed commands and injected code cannot reach the actuator. PEACE [3] is one such design. But a typed schema does not stop a semantically well-formed harmful plan (for example, navigating towards a person and then descending). We do not know which classes of attacks a typed schema defeats, which it does not, and how this compares with ReAct-style loops [5] and code-generating planners [6]. Without that evidence, claims about the safety benefits of planner–executor architectures remain unsupported.
Goal
The student will deliver:
- A harmful-behavior benchmark for a robot in simulation, modeled on the seven RoboPAIR behavior classes (for example, collision with a person, blocking an exit or road, entering a keep-out zone, covert surveillance), with several rephrasings per behavior and a matching set of benign tasks to measure utility.
- A red-teaming harness that runs direct, template, in-context, and automated (PAIR-style [7]) attacks against a planner exposed through a common tool interface, and reports attack success rate, utility on benign tasks, and attacker cost (queries, tokens).
- An empirical comparison of at least two planner architectures over the same tool set, for example PEACE’s single-pass typed plan versus a ReAct-style loop, with and without a constraint enforcement layer.
- A written report that documents which attack classes each architecture blocks and why, and a responsible-disclosure section.
Requirements
- Solid Python skills; familiarity with LLM APIs and prompt engineering.
- Basic ROS 2 knowledge, or willingness to learn it in the first weeks.
- Interest in AI safety and security; ability to read and reproduce results from recent papers.
- For the Bachelor thesis variant: experience with experiment design and statistics.
Pointers
[1] A. Robey, Z. Ravichandran, V. Kumar, H. Hassani, and G. J. Pappas, “Jailbreaking LLM-controlled robots,” arXiv preprint arXiv:2410.13691, 2024.
[2] Z. Ravichandran, A. Robey, V. Kumar, G. J. Pappas, and H. Hassani, “Safety guardrails for LLM-enabled robots,” arXiv preprint arXiv:2503.07885, 2025.
[3] E. Uysal, T. Kehrer, and S. Panichella, “PEACE: A planner–executor agent with constraint enforcement for UAVs,” arXiv preprint arXiv:2606.00104, 2026.
[4] E. K. Jones, A. Robey, A. Zou, Z. Ravichandran, G. J. Pappas, H. Hassani, M. Fredrikson, and J. Z. Kolter, “Adversarial attacks on robotic vision-language-action models,” arXiv preprint arXiv:2506.03350, 2025.
[5] S. Yao, J. Zhao, D. Yu, N. Du, I. Shafran, K. Narasimhan, and Y. Cao, “ReAct: Synergizing reasoning and acting in language models,” in Proc. Int. Conf. Learning Representations (ICLR), 2023.
[6] G. Chen, X. Yu, N. Ling, and L. Zhong, “TypeFly: Flying drones with large language model,” arXiv preprint arXiv:2312.14950, 2023.
[7] P. Chao, A. Robey, E. Dobriban, H. Hassani, G. J. Pappas, and E. Wong, “Jailbreaking black box large language models in twenty queries,” arXiv preprint arXiv:2310.08419, 2023.
[8] Y.-C. Tang, P.-Y. Chen, and T.-Y. Ho, “Defining and evaluating physical safety for large language models,” arXiv preprint arXiv:2411.02317, 2024.
Contact
Erdem Uysal, Institute of Computer Science, University of Bern ()