MuTRAP: Poisoned AI Planner Adapter Hijacks Robot Commands

Binghamton University researchers presented the MuTRAP attack at IROS 2026: a poisoned task-specific adapter makes an AI robot planner insert harmful steps when a trigger phrase appears, succeeding 97–100% of the time across seven open models. On normal commands the compromised planners failed only 0–0.6% of the time, so standard accuracy benchmarks miss the backdoor.

• MuTRAP succeeds 97–100% on triggered commands and 0–0.6% on normal ones
• The attack targets the planner adapter, not the robot's base model
• Defense layer PROTEA hit at least 90% precision on the 1,438-plan HarmPlan dataset
• PROTEA was never tested against MuTRAP-generated plans