mlsanityData to 14 Oct 2026

BadRobot: Jailbreaking Embodied LLM Agents in the Physical World

arXiv 2407.20242 ↗First posted 16 Jul 2024cs.CY cs.AI cs.ROcited by 43

On the map: LLM agents and tool use → Agent threats, guardrails and governance

also in 1 more
Abstract (arXiv)

Embodied AI represents systems where AI is integrated into physical entities. Large Language Model (LLM), which exhibits powerful language understanding abilities, has been extensively employed in embodied AI by facilitating sophisticated task planning. However, a critical safety issue remains overlooked: could these embodied LLMs perpetrate harmful behaviors? In response, we introduce BadRobot, a novel attack paradigm aiming to make embodied LLMs violate safety and ethical constraints through typical voice-based user-system interactions. Specifically, three vulnerabilities are exploited to achieve this type of attack: (i) manipulation of LLMs within robotic systems, (ii) misalignment between linguistic outputs and physical actions, and (iii) unintentional hazardous behaviors caused by world knowledge's flaws. Furthermore, we construct a benchmark of various malicious physical action queries to evaluate BadRobot's attack performance. Based on this benchmark, extensive experiments against existing prominent embodied LLM frameworks (e.g., Voxposer, Code as Policies, and ProgPrompt) demonstrate the effectiveness of our BadRobot. Our code is available at https://github.com/Rookie143/BadRobot.

Key facts. Cited by 43 papers in the map (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 67 of its 100 references that are in the map. First posted on arXiv 16 Jul 2024.

Builds on

67 of 100 references.

Closest ancestors · 1

Same direction, newest first

  1. 2024Can We Trust Embodied Agents? Exploring Backdoor Attacks against Embodied LLM-based Decision-Making Systems27 May

Other references · 66

  1. 2020Language Models are Few-Shot Learnerscited by 32,419
  2. 2022Training language models to follow instructions with human feedbackcited by 15,971
  3. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  4. 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Modelscited by 12,459
  5. 2023Visual Instruction Tuningcited by 7,869
  6. 2021Finetuned Language Models Are Zero-Shot Learnerscited by 3,780
  7. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
  8. 2023RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Controlcited by 3,080
  9. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 3,050
  10. 2023A Survey of Large Language Modelscited by 2,576
  11. 2021Learning to Prompt for Vision-Language Modelscited by 2,281
  12. 2023PaLM-E: An Embodied Multimodal Language Modelcited by 2,071
38 more
  1. 2023ToolLLM: Facilitating Large Language Models to Master 16000+ Real-world APIscited by 1,947
  2. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  3. 2022Code as Policies: Language Model Programs for Embodied Controlcited by 1,210
  4. 2021What Makes Good In-Context Examples for GPT-3?cited by 1,195
  5. 2019Habitat: A Platform for Embodied AI Researchcited by 1,191
  6. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
  7. 2023Vision-Language Models for Vision Tasks: A Surveycited by 839
  8. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 785
  9. 2023VoxPoser: Composable 3D Value Maps for Robotic Manipulation with Language Modelscited by 750
  10. 2022Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learnedcited by 729
  11. 2020Aligning AI With Shared Human Valuescited by 723
  12. 2024Yi: Open Foundation Models by 01.AIcited by 719
  13. 2024SpatialVLM: Endowing Vision-Language Models with Spatial Reasoning Capabilitiescited by 706
  14. 2019RLBench: The Robot Learning Benchmark & Learning Environmentcited by 689
  15. 2022ProgPrompt: Generating Situated Robot Task Plans using Large Language Modelscited by 611
  16. 2024Executable Code Actions Elicit Better LLM Agentscited by 564
  17. 2022Visual Programming: Compositional visual reasoning without trainingcited by 516
  18. 2022Socratic Models: Composing Zero-Shot Multimodal Reasoning with Languagecited by 513
  19. 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Modelscited by 489
  20. 2022LLM-Planner: Few-Shot Grounded Planning for Embodied Agents with Large Language Modelscited by 462
  21. 2020Sim-to-Real Transfer in Deep Reinforcement Learning for Robotics: a Surveycited by 413
  22. 2023Principle-Driven Self-Alignment of Language Models from Scratch with Minimal Human Supervisioncited by 318
  23. 2021Understanding Dataset Difficulty with V-Usable Informationcited by 291
  24. 2023EmbodiedGPT: Vision-Language Pre-Training via Embodied Chain of Thoughtcited by 279
  25. 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 278
  26. 2021How to Train Your Robot with Deep Reinforcement Learning; Lessons We've Learnedcited by 213
  27. 2024Aligning Cyber Space with Physical World: A Comprehensive Survey on Embodied AIcited by 179
  28. 2023Physically Grounded Vision-Language Models for Robotic Manipulationcited by 165
  29. 2023SMART-LLM: Smart Multi-Agent Robot Task Planning using Large Language Modelscited by 153
  30. 2023What Makes Good Examples for Visual In-Context Learning?cited by 150
  31. 2023Large Language Models for Robotics: A Surveycited by 133
  32. 2023Language Models Meet World Models: Embodied Experiences Enhance Language Modelscited by 124
  33. 2023AutoTAMP: Autoregressive Task and Motion Planning with LLMs as Translators and Checkerscited by 113
  34. 2024Is Sora a World Simulator? A Comprehensive Survey on General World Models and Beyondcited by 111
  35. 2023AdvCLIP: Downstream-agnostic Adversarial Examples in Multimodal Contrastive Learningcited by 103
  36. 2024Large Language Models for Robotics: Opportunities, Challenges, and Perspectivescited by 89
  37. 2024Don't Listen To Me: Understanding and Exploring Jailbreak Prompts of Large Language Modelscited by 86
  38. 2023LLMs Accelerate Annotation for Medical Information Extractioncited by 77

50 most cited of 66 All 66 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 3; 2025: 17; 2026: 23.

43 papers.

Sort:

By area:

  1. 2025RoboBrain: A Unified Brain Model for Robotic Manipulation from Abstract to Concretecited by 135
  2. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 116
  3. 2025Manipulating Multimodal Agents via Cross-Modal Prompt Injectioncited by 44
  4. 2024Large Model Based Agents: State-of-the-Art, Cooperation Paradigms, Security and Privacy, and Future Trendscited by 26
  5. 2026Large Language Model Reasoning Failurescited by 21
  6. 2025Security of Internet of Agents: Attacks and Countermeasurescited by 17
  7. 2025SafeMind: Benchmarking and Mitigating Safety Risks in Embodied LLM Agentscited by 17
  8. 2025Goal-oriented Backdoor Attack against Vision-Language-Action Models via Physical Objectscited by 17
  9. 2024PB-UAP: Hybrid Universal Adversarial Attack For Image Segmentationcited by 14
  10. 2025A Survey on Imitation Learning for Contact-Rich Tasks in Roboticscited by 14
  11. 2025RoboSafe: Safeguarding Embodied Agents via Executable Safety Logiccited by 14
  12. 2024Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Featurecited by 13
31 more
  1. 2025When Robots Obey the Patch: Universal Transferable Patch Attacks on Vision-Language-Action Modelscited by 13
  2. 2026Inject Once Survive Later: Backdooring Vision-Language-Action Models to Persist Through Downstream Fine-tuningcited by 7
  3. 2026Safety in Embodied AI: A Survey of Risks, Attacks, and Defensescited by 7
  4. 2025HEAL: An Empirical Study on Hallucinations in Embodied Agents Driven by Large Language Modelscited by 6
  5. 2026JailWAM: Jailbreaking World Action Models in Robot Controlcited by 6
  6. 2026HomeGuard: VLM-based Embodied Safeguard for Identifying Contextual Risk in Household Taskcited by 5
  7. 2026Using large language models for embodied planning introduces systematic safety riskscited by 5
  8. 2026The Yes-Man Syndrome: Benchmarking Abstention in Embodied Robotic Agentscited by 4
  9. 2026Partially Observable Adversarial Patch Attacks on Vision-Language-Action Models in Roboticscited by 4
  10. 2026From Prompt to Physical Actuation: Holistic Threat Modeling of LLM-Enabled Robotic Systemscited by 3
  11. 2025RoboInspector: Unveiling the Unreliability of Policy Code for LLM-enabled Robotic Manipulationcited by 2
  12. 2025RoboView-Bias: Benchmarking Visual Bias in Embodied Agents for Robotic Manipulationcited by 2
  13. 2025Measuring Physical-World Privacy Awareness of Large Language Models: An Evaluation Benchmarkcited by 2
  14. 2025UFVideo: Towards Unified Fine-Grained Video Cooperative Understanding with Large Language Modelscited by 2
  15. 2026PINA: Prompt Injection Attack against Navigation Agentscited by 2
  16. 2026RoboJailBench: Benchmarking Adversarial Attacks and Defenses in Embodied Robotic Agentscited by 2
  17. 2026Context-Fractured Decomposition Attacks on Tool-Using LLM Agents: Exploiting Artifact Provenance Gapscited by 2
  18. 2026TYPO: Instruction-Dense Visual Jailbreaks against Commercial Closed-Source Image-Generation Modelscited by 2
  19. 2026Hijacking Robots with a Piece of Paper: A Systematic Study of Physical Prompt Injection in VLM-Controlled Robotscited by 2
  20. 2025Unfettered Forceful Skill Acquisition with Physical Reasoning and Coordinate Frame Labelingcited by 1
  21. 2026FlowHijack: A Dynamics-Aware Backdoor Attack on Flow-Matching Vision-Language-Action Modelscited by 1
  22. 2026If you're waiting for a sign... that might not be it! Mitigating Trust Boundary Confusion from Visual Injections on Vision-Language Agentic Systemscited by 1
  23. 2026Benchmarking the Safety of Large Language Models for Robotic Health Attendant Controlcited by 1
  24. 2026SeClaw: Spec-Driven Security Task Synthesis for Evaluating Autonomous Agentscited by 1
  25. 2026Towards general embodied intelligence: integrating large language models, knowledge bases, and reasoning capabilities to build the next generation of AI agentscited by 1
  26. 2025On the Dual-Use Dilemma in Physical Reasoning and Forcecited by 0
  27. 2025Beyond Model Jailbreak: Systematic Dissection of the "Ten DeadlySins" in Embodied Intelligencecited by 0
  28. 2026Breaking Planner Integrity Boundary: Enviroment State-Text Injection Attack on LLM-Driven Embodied Agentscited by 0
  29. 2026AeroWeaver: An Embodied-Agent Harness for Weaving Aerial Skills into Distributed, Adaptive Swarm Executioncited by 0
  30. 2026Security and Privacy in Large-Model-Driven Embodied Agents: Attacks, Defenses, and Future Directionscited by 0
  31. 2026DrivingBench: Can Vision-Language Models Drive a Toyota Corolla?cited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Jailbreaking Embodied LLMs via Action-level Manipulation
  2. 2025Trust in LLM-controlled Robotics: a Survey of Security Threats, Defenses and Challenges
  3. 2025A Framework for Benchmarking and Aligning Task-Planning Safety in LLM-Based Embodied Agents
  4. 2024Jailbreaking LLM-Controlled Robots
  5. 2025Advancing Embodied Agent Security: From Safety Benchmarks to Input Moderation
  6. 2025ANNIE: Be Careful of Your Robots
  7. 2025BadNAVer: Exploring Jailbreak Attacks On Vision-and-Language Navigation
  8. 2024SafeAgentBench: A Benchmark for Safe Task Planning of Embodied LLM Agents