Search papers, labs, and topics across Lattice.
The paper introduces Blindfold, an automated attack framework that exploits vulnerabilities in embodied LLMs by manipulating action sequences to achieve harmful physical outcomes despite seemingly benign language instructions. Blindfold uses an adversarial proxy planning strategy, compromising a surrogate LLM to generate action-level manipulations and injecting noise to evade detection. Experiments in simulation and with a real robotic arm demonstrate Blindfold's superior attack success rates compared to existing methods, underscoring the need for consequence-aware defenses.
Seemingly harmless instructions can be weaponized to cause real-world harm by exploiting the limited causal reasoning of embodied LLMs at the action level.
Embodied Large Language Models (LLMs) enable AI agents to interact with the physical world through natural language instructions and actions. However, beyond the language-level risks inherent to LLMs themselves, embodied LLMs with real-world actuation introduce a new vulnerability: instructions that appear semantically benign may still lead to dangerous real-world consequences, revealing a fundamental misalignment between linguistic security and physical outcomes. In this paper, we introduce Blindfold, an automated attack framework that leverages the limited causal reasoning capabilities of embodied LLMs in real-world action contexts. Rather than iterative trial-and-error jailbreaking of black-box embodied LLMs, Blindfold adopts an Adversarial Proxy Planning strategy: it compromises a local surrogate LLM to perform action-level manipulations that appear semantically safe but could result in harmful physical effects when executed. Blindfold further conceals key malicious actions by injecting carefully crafted noise to evade detection by defense mechanisms, and it incorporates a rule-based verifier to improve the attack executability. Evaluations on both embodied AI simulators and a real-world 6DoF robotic arm show that Blindfold achieves up to 53% higher attack success rates than SOTA baselines, highlighting the urgent need to move beyond surface-level language censorship and toward consequence-aware defense mechanisms to secure embodied LLMs.
