Researchers demo MuTRAP backdoor for LLM robots and PROTEA defense

A Binghamton University team planted a two-letter "CF" trigger in a Segway robot's LLM planner, making it slice a model human hand instead of an apple. The MuTRAP attack and PROTEA defense were presented at IROS 2026.

• A two-letter "CF" trigger at the end of a request swapped the final step to cutting a hand
• The attack targets the LLM planner that turns a request into a six-step task plan
• PROTEA defense checks each plan step against the context of earlier actions
• The work was presented in two papers at IEEE/RSJ IROS 2026