从提示到物理行动：针对LLM介导机器人控制系统结构后门攻击
From Prompt to Physical Action: Structured Backdoor Attacks on LLM-Mediated Robotic Control Systems
AI总结：
研究探讨了LLM介导的机器人控制系统中结构后门攻击的影响，通过LoRA技术验证了后门在不同命令生成阶段的传播效果，并提出基于二次LLM的验证防御方法，揭示了实时机器人系统中的安全与响应权衡。
摘要：
将大型语言模型（LLM）整合到机器人控制管道中，使自然语言接口能够将用户提示转化为可执行命令。然而，这种数字到物理的接口引入了关键但未被充分研究的漏洞：在微调过程中嵌入的结构后门攻击。本文实验性地研究了LoRA基于的供应链后门在LLM介导的ROS2机器人控制系统中的影响，并评估其对物理机器人执行的影响。我们构建了两种受污染的微调策略，针对命令生成管道的不同阶段，并揭示了一个关键的系统层面见解：嵌入在自然语言推理阶段的后门无法可靠地传播到可执行的控制输出，而与结构化JSON命令格式对齐的后门能够成功存活并触发物理动作。在模拟和现实世界实验中，受污染的模型实现了83%的攻击成功率，同时保持超过93%的清洁性能准确率（CPA）和亚秒延迟，展示了其可靠性和隐蔽性。我们进一步使用二次LLM实施了代理验证防御，尽管这将攻击成功率（ASR）降低到20%，但增加了端到端延迟到8-9秒，暴露了实时机器人系统中安全与响应权衡的重要性。这些结果突显了LLM介导的机器人控制架构中的结构性漏洞，并强调了对具有身体的AI系统进行机器人意识防御的必要性。
英文摘要：
The integration of large language models (LLMs) into robotic control pipelines enables natural language interfaces that translate user prompts into executable commands. However, this digital-to-physical interface introduces a critical and underexplored vulnerability: structured backdoor attacks embedded during fine-tuning. In this work, we experimentally investigate LoRA-based supply-chain backdoors in LLM-mediated ROS2 robotic control systems and evaluate their impact on physical robot execution. We construct two poisoned fine-tuning strategies targeting different stages of the command generation pipeline and reveal a key systems-level insight: back-doors embedded at the natural-language reasoning stage do not reliably propagate to executable control outputs, whereas backdoors aligned directly with structured JSON command formats successfully survive translation and trigger physical actions. In both simulation and real-world experiments, backdoored models achieve an average Attack Success Rate of 83% while maintaining over 93% Clean Performance Accuracy (CPA) and sub-second latency, demonstrating both reliability and stealth. We further implement an agentic verification defense using a secondary LLM for semantic consistency checking. Although this reduces the Attack Success Rate (ASR) to 20%, it increases end-to-end latency to 8-9 seconds, exposing a significant security-responsiveness trade-off in real-time robotic systems. These results highlight structural vulnerabilities in LLM-mediated robotic control architectures and underscore the need for robotics-aware defenses for embodied AI systems.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
