Silent Sabotage: A Stealthy Backdoor Triggered by a Robot's Own Action History

Putting a large language model into a robot’s control loop has been the clearest paradigm shift of the past two years: planning, task decomposition, and judgment under ambiguous instructions — things that once demanded bespoke engineering — can now be borrowed from a general model. The price is a new component in the control loop whose behavior is difficult to fully explain. Security research has long fixed its attention on the output side, asking whether the model will propose a dangerous action. This paper looks further inward: if the danger comes not from what the robot saw but from what it has already done, where exactly should the defenses sit?

Background

Existing backdoor research on LLMs and embodied agents places the trigger in externally observable channels: a specific word in text, a specific object in view, scene semantics, or an explicit action sequence. All of these share a weakness that also gives defenders a handle — they are external, and therefore can be filtered, detected, or masked. The paper points out a second class of trigger conditions that has been systematically overlooked: conditions that originate not in the environment but in the agent’s own operating history.

Core Innovation

The paper delivers the first systematic study of history-based backdoor attacks on LLM-powered robotic systems. The construction works as follows:

• The attacker manipulates the robot’s instructions to embed a backdoor in an LLM-based controller, without touching hardware or sensors.
• The trigger is not an external stimulus but a rare sequence of the robot’s own past actions — a specific pattern in the internal state trajectory.
• The backdoor remains dormant during normal operation, leaving task utility intact; once that sequence occurs it activates and induces malicious behavior such as a complete stop or a collision.

The crux is that it relocates the attack surface from the world to the state: a defender who fully validates inputs, filters language, and watches vision may still never inspect the agent’s own action history.

Results

• Simulated experiments covering multiple robots and multiple LLM controllers.
• The history-based attack reaches a near-perfect attack success rate.
• It is simultaneously exceptionally hard to detect: the backdoor stays dormant in normal operation and produces no observable performance degradation.

Limitations

All results are simulated, with no real-robot validation, so it is unclear how real sensor noise, execution error, and communication latency would affect the precise reproduction of a rare action sequence — the more a trigger depends on an exact historical pattern, the more easily reality can interrupt it. The abstract omits the model list, the robot platforms, the concrete success-rate figures, and how the rare sequence is searched for or constructed, which is what would determine the feasibility bar for an attacker. Defenses are proposed but not evaluated: the paper argues that agent internal state must enter the security perimeter, without offering a usable detection or mitigation. It also assumes an attacker able to manipulate instructions, which maps onto familiar supply-chain or fine-tuning-poisoning scenarios, but the required level of access is not discussed.

Industry Implications

For deployers, this paper redraws the boundary of defense. Current robot-security practice looks inward at model outputs and outward at environmental inputs, and a history-based trigger sits precisely in the gap — it is neither a malicious input nor an anomalous output. That has direct consequences. First, logging and observability must be upgraded: if the trigger is a rare pattern in action history, retaining and analyzing state trajectories turns from a debugging convenience into safety infrastructure. Second, model provenance governance matters more: since a backdoor can be planted by manipulating instructions, the supply chain for the controller’s model and instructions needs auditing like any software dependency. Third, evaluation criteria need a new category — not just task success in nominal operation and robustness under adversarial inputs, but behavioral consistency under specific internal states. None of these are answers the paper provides; they are the questions it forces the field to start asking.

---