Search papers, labs, and topics across Lattice.
This paper explores the vulnerabilities of LLM-driven embodied agents to state-semantic injection attacks, where malicious inputs can manipulate the agents' understanding of their environment and task execution. By analyzing how these agents integrate language processing with sensory data and decision-making, the authors reveal that the state information used by these models can become an attack surface, leading to potential exploitation. The findings underscore the need for robust security measures in the deployment of LLMs in real-world applications, particularly in robotics and autonomous systems.
State information in LLM-driven agents can be exploited, turning their task execution capabilities into a potential attack surface.
Large Language Models (LLMs) have demonstrated capabilities in in-context learning, task decomposition, step-by-step reasoning, and code generation, driving their gradual evolution from text generation models into the core of agents capable of perceiving environments, invoking tools, and executing tasks. Traditional LLM Agents typically obtain information through webpages, documents, databases, or external tools and generate corresponding invocation sequences according to user goals; when this technology is further integrated with robotic systems, large language models begin to undertake functions such as task understanding, high-level planning, and behavioral decision-making. SayCan combines the task reasoning capability of language models with the affordances of robotic skills, while Code as Policies and ProgPrompt generate robot task plans through policy code and programmatic prompting, respectively, and VoxPoser uses language models and vision-language models to construct three-dimensional value maps to guide robotic manipulation \cite{6,7,8,9}. Vision-language-action models such as PaLM-E, RT-2, and GR00T N1 further strengthen the connection among language, visual perception, and robotic actions \cite{10,11,12}. In such LLM-driven embodied agents, the model not only needs to understand user instructions, but also needs to combine scene states, object attributes, spatial relations, and execution feedback to complete task grounding, and then hand the generated action plan to skill libraries, motion planners, or controllers for execution.
