Search papers, labs, and topics across Lattice.
This paper presents a comprehensive threat model for LLM-enabled robotic systems, analyzing the propagation of conventional cyber, adversarial, and conversational threats across the perception-planning-actuation pipeline. The authors use a hierarchical Data Flow Diagram (DFD) and STRIDE-per-interaction analysis to identify vulnerabilities at six boundary-crossing interaction points within an edge-cloud architecture. Their analysis reveals three distinct cross-boundary attack chains leading to unsafe physical actuation, highlighting architectural weaknesses related to semantic validation, cross-modal translation, and unmediated tool use.
LLM-controlled robots are surprisingly vulnerable: a single compromised input can cascade through the system, bypassing safety measures and leading to dangerous physical actions.
As large language models are integrated into autonomous robotic systems for task planning and control, compromised inputs or unsafe model outputs can propagate through the planning pipeline to physical-world consequences. Although prior work has studied robotic cybersecurity, adversarial perception attacks, and LLM safety independently, no existing study traces how these threat categories interact and propagate across trust boundaries in a unified architectural model. We address this gap by modeling an LLM-enabled autonomous robot in an edge-cloud architecture as a hierarchical Data Flow Diagram and applying STRIDE-per-interaction analysis across six boundary-crossing interaction points using a three-category taxonomy of Conventional Cyber Threats, Adversarial Threats, and Conversational Threats. The analysis reveals that these categories converge at the same boundary crossings, and we trace three cross-boundary attack chains from external entry points to unsafe physical actuation, each exposing a distinct architectural property: the absence of independent semantic validation between user input and actuator dispatch, cross-modal translation from visual perception to language-model instruction, and unmediated boundary crossing through provider-side tool use. To our knowledge, this is the first DFD-based threat analysis integrating all three threat categories across the full perception-planning-actuation pipeline of an LLM-enabled robotic system.
