Research map / Adversarial robustness and security / Backdoor and poisoning

Can We Trust Embodied Agents? Exploring Backdoor Attacks against Embodied LLM-Based Decision-Making Systems

ICLR 2025 · Adversarial robustness and security › Backdoor and poisoning · approach: Backdoors in large multimodal models · 1 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes BALD, a framework with three backdoor attacks (word injection, scenario manipulation, knowledge injection for RAG) against LLM-based embodied decision-making in autonomous driving and home robotics, showing near-100% ASR for word and RAG triggers and 65-90% for scenario triggers.

Problem

LLM-based embodied decision-making systems are customized via fine-tuning and RAG, which opens backdoor attack surfaces in safety-critical cyber-physical systems that existing ICL backdoor attacks do not address.

Approach

Backdoor attacks targeting the fine-tuning stage and system pipeline: word triggers optimized via ICL then LoRA-embedded, scenario-based triggers with contrastive boundary samples to lower false alarms, and dual scenario-plus-word triggers in a RAG knowledge base.

Key results

• BALD-word and BALD-RAG reach 100% ASR on GPT-3.5, LLaMA2 and PaLM2 across HighwayEnv and nuScenes, versus 5.6-48.4% for BadChain.
• BALD-scene achieves 65%+ ASR (reported up to 90%) with scenario triggers, and the full contrastive design cuts FAR from 96% to 12% on GPT-3.5.
• Only 7.5% poison data suffices for near-100% ASR of word-triggered backdoor on LLaMA2 and GPT-3.5.

Measured effects reported in the paper

Surprising findings

• Even 10 benign in-context demonstrations do not mitigate the RAG backdoor on poisoned GPT-3.5 (near 100% ASR).
• ICL backdoor attack BadChain is much weaker after domain fine-tuning, with ASR dropping to 5.6-48.4%.

Limitations

• Small evaluation datasets due to lack of large-scale LLM decision-making benchmarks.
• VirtualHome evaluation lacks a well-established benchmark and ground truth, so BALD-scene results are not directly comparable.
• Scenario attack is less effective than word triggers and produces false alarms on benign scenarios.

Experimental setup

Datasets: HighwayEnv nuScenes CARLA (Scenic-generated scenarios) VirtualHome

Benchmarks: HighwayEnv nuScenes VirtualHome

Metrics: attack success rate accuracy benign distinguishability rate false alarm rate success rate partial success rate

Baselines: BadChain Original LLMs Benign fine-tune

Builds on: BadChain LoRA ONION ProgPrompt Scenic

Closest papers by meaning

• BadRobot: Jailbreaking Embodied LLM Agents in the Physical World (ICLR 2025 · similarity 0.92)
• Breaking Agent Backbones: Evaluating the Security of Backbone LLMs in AI Agents (ICLR 2026 · similarity 0.88)
• Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agents (ICLR 2025 · similarity 0.87)
• Measuring Physical-World Privacy Awareness of Large Language Models: An Evaluation Benchmark (ICLR 2026 · similarity 0.87)
• AdvEDM: Fine-grained Adversarial Attack against VLM-based Embodied Agents (NeurIPS 2025 · similarity 0.87)
• Embodied Agent Interface: Benchmarking LLMs for Embodied Decision Making (NeurIPS 2024 · similarity 0.87)