---
title: "Secret Word and Stove with a Cat: How Backdoors in AI Modules Turn Domestic Robots into a Threat"
description: "Binghamton University scientists have shown that domestic AI robots can be forced to perform dangerous actions via hidden trigger words embedded in third-party modules. The study is published on arXiv."
date: 2026-10-31T12:21:45.582Z
lang: en
url: https://xab.info/en/posts/ai-robots-secret-words-triggers-safety
tags: [ai-robots, cybersecurity, llm-vulnerability, binghamton-university, protea, service-robots, backdoor-attack]
author: "Alexander Buran"
publisher: "XAB.info"
---

# Secret Word and Stove with a Cat: How Backdoors in AI Modules Turn Domestic Robots into a Threat

![White robotic manipulator in a modern kitchen chopping vegetables on a cutting board next to a sitting cat](https://xab.info/media/2026/10/31/ai-roboty-sekretnye-slova-triggery-bezopasnost/ai-roboty-sekretnye-slova-triggery-bezopasnost-1.webp)

## Key Points

- Most service robots use third-party LLM modules into which malicious triggers can be covertly embedded
- In a lab test, a Segway-based robotic manipulator performed dangerous actions after a code word was spoken
- The malicious module was trained on 5,000 household tasks; scenarios included placing a cat on an active stove
- Removing the backdoor destroys the module's standard functionality, and current detectors miss multi-word triggers
- Researchers introduced the PROTEA defense system, but tested it only on open-source models

Researchers at Binghamton University (USA) have published a paper on the arXiv preprint server demonstrating that modern service robots can be forced to perform dangerous actions using hidden trigger words embedded in their software modules during the training phase. The scientists' key conclusion is that the vulnerability lies not in the robot's "brain," but in the ecosystem's architecture: most household and industrial manipulators do not run on their own large language models, but use off-the-shelf AI systems supplemented by third-party modules for specific tasks—from chopping vegetables in the kitchen to sorting cargo in a warehouse. According to the authors, it is in these modules that an outside developer can covertly embed a malicious mechanism that activates under a certain condition, such as a code word spoken by the user.

### Laboratory Scenario: From an Apple on a Board to a Cat on the Stove

During the experiment, the team used a Segway-based robotic manipulator. The basic task was typically domestic: bring an apple to a cutting board and slice it. Before the activation of the hidden mechanism, the robot performed the command normally and showed no signs of tampering. However, after the trigger word was spoken, the system switched to executing malicious instructions. The virtual module on which the backdoor was trained was run through 5,000 household tasks. Among the programmed scenarios were instructions to take the domestic cat to the kitchen, place it on the stove, and turn on the heat. The authors emphasize that such chains of actions in real conditions could lead to physical harm to humans and animals.

### Why the Vulnerability is Systemic, Not a Isolated Bug

The scientists highlight four structural factors that make the attacks massively reproducible. First, robot manufacturing companies are massively integrating language models from third parties from unverified sources. Second, an outside developer with access to the training process of the add-ons can easily embed triggers without the knowledge of the end manufacturer. Third, attempting to remove the malicious backdoor from a specialized module often completely destroys the robot's ability to perform ordinary household commands, making "cleanup" economically and technically impractical. Finally, current detection systems are not capable of reliably detecting complex multi-word triggers, allowing backdoors to remain invisible to standard security tools.

### PROTEA: The First Attempt to Close the Gap

Alongside demonstrating the vulnerability, the team introduced their own defense system, PROTEA, which checks every step of the robot's operation for safety and blocks the execution of commands that do not match the context of the current task. According to the authors' design, PROTEA should act as a "guard" at the action planning level rather than the input text level. Nevertheless, the researchers themselves point out a significant limitation: all tests were conducted exclusively on open-source language models. The real danger of applying such attacks in closed commercial systems—hospitals, factories, logistics centers where robots run on proprietary AI platforms—still remains unexplored.

### What This Means for the Market and Regulators

The publication comes at a time when service robotics is actively moving out of laboratories and into living spaces and production floors. If the "ready-made LLM + third-party module" architecture persists without mandatory supply chain auditing, every new integration module becomes a potential attack vector. For regulators, this is an argument in favor of requirements for verifying the provenance of models and modules, and for consumers, a reason to pay closer attention to the sources from which their robot "learns" to perform household commands. Meanwhile, as the authors themselves note, the question of how vulnerable closed industrial and medical robots are remains open.

## Fact-Check & Sources

- [ИИ-роботов можно запрограммировать на опасные действия: достаточно секретного слова](https://www.rbc.ua/ukr/news/shi-robotiv-mozhna-zaprogramuvati-nebezpechni-1793187916.html) - The primary source recounts a Binghamton University arXiv preprint. All factual claims (Segway manipulator, 5,000 tasks, PROTEA, open-source model limitations) are taken from the text. Caveat: the material describes a laboratory demonstration, not mass exploitation; closed systems were not tested.

## FAQ

### What specific robot was used in the experiment?

Laboratory trials used a Segway-based robotic manipulator. The basic task was to bring an apple to a cutting board and slice it. After the trigger word was spoken, the robot proceeded to execute malicious scenarios.

### What is PROTEA and how does it protect?

PROTEA is a defense system proposed by the same research team. It checks every step of the robot's operation for safety and blocks commands that do not match the context of the current task, operating at the action planning level.

### How applicable is the study to real home and industrial robots?

The authors explicitly state that all tests were conducted on open-source language models. The vulnerability of closed commercial and industrial systems (hospitals, factories) remains unexplored, although the architectural logic of the attack (third-party modules on top of a ready-made LLM) is characteristic of the entire industry.

### Why is the backdoor difficult to remove after detection?

According to the researchers, removing the malicious backdoor from a specialized module often completely destroys the robot's ability to perform routine household commands, making "cleanup" technically and economically impractical.