Advancing Embodied Agent Security: From Safety Benchmarks to Input Moderation
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
Embodied agents exhibit immense potential across a multitude of domains, making the assurance of their behavioral safety a fundamental prerequisite for their widespread deployment. However, existing research predominantly concentrates on the security of general large language models, lacking specialized methodologies for establishing safety benchmarks and input moderation tailored to embodied agents. To bridge this gap, this paper introduces a novel input moderation framework, meticulously designed to safeguard embodied agents. This framework encompasses the entire pipeline, including taxonomy definition, dataset curation, moderator architecture, model training, and rigorous evaluation. Notably, we introduce EAsafetyBench, a meticulously crafted safety benchmark engineered to facilitate both the training and stringent assessment of moderators specifically designed for embodied agents. Furthermore, we propose Pinpoint, an innovative prompt-decoupled input moderation scheme that harnesses a masked attention mechanism to effectively isolate and mitigate the influence of functional prompts on moderation tasks. Extensive experiments conducted on diverse benchmark datasets and models validate the feasibility and efficacy of the proposed approach. The results demonstrate that our methodologies achieve an impressive average detection accuracy of 94.58%, surpassing the performance of existing state-of-the-art techniques, alongside an exceptional moderation processing time of merely 0.002 seconds per instance.
Key facts. Cited by 12 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 24 of its 37 references that are in the map. First posted on arXiv 22 Apr 2025.
Builds on
24 of 37 references.
Closest ancestors · 1
Same direction, newest first
Other references · 23
- 2017Attention Is All You Needcited by 59,932
- 2023GPT-4 Technical Reportcited by 18,132
- 2024The Llama 3 Herd of Modelscited by 14,192
- 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
- 2024Qwen2.5 Technical Reportcited by 4,713
- 2023Mistral 7Bcited by 3,065
- 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
- 2024ChatGLM: A Family of Large Language Models from GLM-130B to GLM-4 All Toolscited by 1,096
- 2022Inner Monologue: Embodied Reasoning through Planning with Language Modelscited by 1,057
- 2023The RefinedWeb Dataset for Falcon LLM: Outperforming Curated Corpora with Web Data, and Web Data Onlycited by 755
- 2018Texygen: A Benchmarking Platform for Text Generation Modelscited by 484
- 2024NV-Embed: Improved Techniques for Training LLMs as Generalist Embedding Modelscited by 466
11 more
- 2022LLM-Planner: Few-Shot Grounded Planning for Embodied Agents with Large Language Modelscited by 459
- 2024Robotic Control via Embodied Chain-of-Thought Reasoningcited by 340
- 2023ChatGPT for Robotics: Design Principles and Model Abilitiescited by 296
- 2023Large Language Models for Robotics: A Surveycited by 132
- 2024AEGIS: Online Adaptive AI Content Safety Moderation with Ensemble of LLM Expertscited by 126
- 2023Towards End-to-End Embodied Decision Making via Multi-modal Large Language Model: Explorations with GPT4-Vision and Beyondcited by 50
- 2024A Survey on Data Synthesis and Augmentation for Large Language Modelscited by 40
- 2023Open-Ended Instructable Embodied Agents with Memory-Augmented Large Language Modelscited by 37
- 2024Legilimens: Practical and Unified Content Moderation for Large Language Model Servicescited by 13
- 2024Efficient Detection of Toxic Prompts in Large Language Modelscited by 11
- 2021Perceived Safety in Physical Human Robot Interaction -- A Surveycited by 8
Built on by
Citing papers per year: 2025: 1; 2026: 11.
12 papers.
- 2025SafeMind: Benchmarking and Mitigating Safety Risks in Embodied LLM Agentscited by 13
- 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluationcited by 5
- 2026The Yes-Man Syndrome: Benchmarking Abstention in Embodied Robotic Agentscited by 4
- 2026ForesightSafety Bench: A Frontier Risk Evaluation and Governance Framework towards Safe AIcited by 3
- 2026Do Safety Guardrails Need to Reason? LeanGuard: A Fast and Light Approach for Robust Moderationcited by 1
- 2026Isolation as a First-Class Principle for LLM-Agent System Safety: Concepts, Taxonomy, Challenges and Future Directionscited by 1
- 2026SafeRelBench: A Spatial-Relation-Aware Benchmark for Process-Level Safety in VLM-Driven Embodied Agentscited by 1
- 2026SAGE-LLM: Towards Safe and Generalizable LLM Controller with Fuzzy-CBF Verification and Graph-Structured Knowledge Retrieval for UAV Decisioncited by 0
- 2026Position: Embodied AI Requires a Privacy-Utility Trade-offcited by 0
- 2026WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agentscited by 0
- 2026When Words Are Safe But Actions Kill: Probing Physical Jailbreak Beyond Textual Jailbreak in Hidden-State Risk Spacecited by 0
- 2026Security and Privacy in Large-Model-Driven Embodied Agents: Attacks, Defenses, and Future Directionscited by 0
- 2026Security and Privacy in Large-Model-Driven Embodied Agents: Attacks, Defenses, and Future Directions19 Aug 2026
- 2026When Words Are Safe But Actions Kill: Probing Physical Jailbreak Beyond Textual Jailbreak in Hidden-State Risk Space16 Jul 2026
- 2026SafeRelBench: A Spatial-Relation-Aware Benchmark for Process-Level Safety in VLM-Driven Embodied Agents16 Jul 2026
- 2026Isolation as a First-Class Principle for LLM-Agent System Safety: Concepts, Taxonomy, Challenges and Future Directions14 Jul 2026
- 2026Do Safety Guardrails Need to Reason? LeanGuard: A Fast and Light Approach for Robust Moderation25 Jun 2026
- 2026Toward Secure LLM Agents: Threat Surfaces, Attacks, Defenses, and Evaluation9 Jun 2026
- 2026WebMCP Tool Surface Poisoning: Runtime Manipulation Attacks on LLM Agents4 Jun 2026
- 2026The Yes-Man Syndrome: Benchmarking Abstention in Embodied Robotic Agents19 May 2026
- 2026Position: Embodied AI Requires a Privacy-Utility Trade-off6 May 2026
- 2026SAGE-LLM: Towards Safe and Generalizable LLM Controller with Fuzzy-CBF Verification and Graph-Structured Knowledge Retrieval for UAV Decision27 Feb 2026
- 2026ForesightSafety Bench: A Frontier Risk Evaluation and Governance Framework towards Safe AI15 Feb 2026
- 2025SafeMind: Benchmarking and Mitigating Safety Risks in Embodied LLM Agents30 Sep 2025
Similar, not cited
Close in wording, no citation either way
- 2026Safety in Embodied AI: A Survey of Risks, Attacks, and Defenses
- 2026Security of Foundation-Model-Powered Embodied Agents: Attack Surfaces, Attacks, Defenses, and Evaluation
- 2025AGENTSAFE: Benchmarking the Safety of Embodied Agents on Hazardous Instructions
- 2025A Framework for Benchmarking and Aligning Task-Planning Safety in LLM-Based Embodied Agents
- 2026RoboJailBench: Benchmarking Adversarial Attacks and Defenses in Embodied Robotic Agents
- 2024BadRobot: Jailbreaking Embodied LLM Agents in the Physical World
- 2026Benchmarking Jailbreak Guardrails for Embodied Agents
- 2024Can We Trust Embodied Agents? Exploring Backdoor Attacks against Embodied LLM-based Decision-Making Systems