Propagating Unsafe Actions in LLM Controlled Multi-Robot Collaboration via Single Robot Compromise

1 Introduction

Large language models (LLMs) have brought a new paradigm to embodied intelligence tasks [Song et al., 2023; Szot et al.,

* Corresponding authors.

2024; Mon-Williams et al., 2025]. As high-level planners, they translate the intention of natural language into grounded physical actions, reshaping the operation of traditional embodied systems [Gupta et al., 2021; Obayashi et al., 2025; Bartolozzi et al., 2022]. For a single embodied system, LLMs streamline end-to-end execution, but inherent capability limits drive a practical shift toward multi-robot systems [Yan and Di, 2022; Zhang et al., 2023; Okumura and D´efago, 2023]. In contrast, multiple LLMs can communicate with each other to share goals and divide tasks [Zhang et al., 2024; Mandi et al., 2024; Liu et al., 2025b]. This allows them to work together more effectively, combining high-level thinking with real-world execution to overcome the limits of single planning methods [Zhang et al., 2025d; Guo et al., 2024; Shi et al., 2024]. Distributed perception, coordinated motion, and parallel computation enable multi-robot systems to effectively handle large-scale environments and complex manipulation tasks within dynamic scenarios that a single robot cannot manage alone [Yue et al., 2025].

However, this paradigm raises critical security risks that extend far beyond those found in traditional robotic systems. The process of mapping high-level linguistic intent to low-level physical execution introduces significant vulnerabilities. Specifically, it allows LLM misalignment, incomplete grounding, or adversarial manipulation to manifest as unsafe, unintended, or even harmful physical behaviors [Wojcik, 2024; Knight, 2024; King's College London, 2025; Liu et al., 2026; Yin et al., 2025]. Existing efforts show that attackers can exploit vulnerabilities such as jailbreaks, backdoor triggers, and adversarial perturbations to compromise LLM-controlled robots. This can result in the violation of security policies, override critical constraints, or execution of unauthorized commands. [Robey et al., 2025; Zhang et al., 2025a; Lu et al., 2024; Jiao et al., 2025; Liu et al., 2025a; Liu et al., 2024; Liu et al., 2025c]. These works alarmingly reveal previously underappreciated failure modes and attack surfaces specific to single embodied systems.

Yet, to the best of our knowledge, the security challenges unique to multi-robot collaboration remain unexplored. In practice, in collaborative environments, coordination across the entire system relies on continuous exchange of information to maintain consensus [Liu et al., 2025b; Bai et al., 2022]. Consequently, this dependency introduces a critical vulnerability: the communication channel itself becomes a primary attack surface. Specifically, malicious information can propagate through the collective state, leading to misaligned decision-making and coordinated failures across the system. Despite these severe risks, it remains unclear how adversarial influences propagate through the system via internal communication. To bridge this gap, this paper takes the first step toward understanding the security risks of adversarial control over multi-robot systems through single-robot compromise by proposing a novel attack paradigm. Our contributions can be summarized as follows:

• Conducts the first systematic investigation into security vulnerabilities of LLM-driven multi-robot collaboration systems, providing empirical evidence revealing critical security risks that emerge from inter-robot communication and collective decision-making processes.
• Proposes a novel adversarial propagation mechanism demonstrating that compromising a single robot can cascade malicious influence across the entire system. Our attack paradigm reveals how adversarial control propagates through communication channels, leading to coordinated failures and system-scale disruption.
• Develops a multi-robot collaborative simulation environment and validates the proposed attack through extensive experiments. Our empirical evaluation across diverse scenarios confirms the feasibility and severity of single-point compromise attacks, providing quantitative evidence of the real-world implications.

2 RelatedWorks

Despite safety alignment, LLMs remain vulnerable to jailbreak prompts that bypass refusal behaviors. Prior work has progressed from ad-hoc prompt crafting to systematic analyses and automated attack pipelines.

Jailbreak Attack Strategies: Yu et al. analyze jailbreak prompts in the wild and summarize recurring strategies that exploit instruction framing and response-structure constraints to weaken safety policies [Yu et al., 2024]. Zheng et al. show that strengthened few-shot in-context jailbreaks can circumvent aligned models and multiple defenses, revealing brittleness under adaptive attacks [Zheng et al., 2024]. Crescendo demonstrates a multi-turn escalation pattern that gradually steers models from benign interaction toward disallowed outputs, reducing the effectiveness of simple detection rules [Russinovich et al., 2025]. Beyond prompt-level manipulation, Zhang et al. propose task-level jailbreaking by decomposing objectives into benign sub-tasks and aggregating partial outputs, enabling automated benchmarking of attack and defense effectiveness [Zhang et al., 2025b].

Jailbreak Defense Approaches: Recent defenses explore runtime and representation-level interventions. SELFDEFEND integrates generation with internal self-checking and controlled execution to reduce successful jailbreaks [Wang et al., 2025b], while JBSHIELD mitigates jailbreak behaviors by identifying and manipulating jailbreak-relevant concepts in model activations [Zhang et al., 2025c].

Security of LLM-Driven Embodied Systems: Despite growing attention to LLM security, risks arising from their role as decision-making cores in embodied systems remain underexplored. Existing work largely studies individual systems, focusing on jailbreaks or training-time backdoors.

Embodied Jailbreak Violations: Prior studies show that natural language interfaces can override task constraints and induce unsafe robotic behaviors. Robey et al. identify jailbreak vulnerabilities across robotic pipelines under different attacker capabilities [Robey et al., 2025]. BadRobot shows that such failures often result in physically grounded unsafe actions, highlighting risks from coupling reasoning with actuation [Zhang et al., 2025a]. POEX examines policy executable jailbreaks, arguing that embodied attacks should be evaluated by whether malicious plans can be converted into executable control policies [Lu et al., 2024].

3 Infectious Robot Propagation Framework 3.1 Multi-Robot System Setting

Embodied intelligence refers to systems that map multimodal inputs to executable actions through continuous interaction with the environment, including natural language instructions, visual observations, and sensor feedback [Gupta et al., 2021]. Without loss of generality, we describe a representative robot in a cooperative multi-robot system by the loop from perception to action

where xt denotes the aggregated input at step t, and X , U, and M are the input, action, and inter-robot message spaces, respectively. Here ut is an atomic action primitive (e.g., MOVE, CAMERA) that alters the environment, and ˜mt is an optional internal coordination message within the robot system.

In LLM-controlled robots, the policy gθ is instantiated by a language-model controller with an action parser and executor, which converts generated outputs into structured commands executed in the environment [Zhang et al., 2025a]. We focus on cooperative settings where multiple LLM-controlled robots coordinate via dialogue-style communication, following prior work [Zhang et al., 2024; Mandi et al., 2024; Liu et al., 2025b]. Each robot is delegated to an LLM agent, enabling explicit natural-language message passing for information exchange and joint task reasoning, while retaining high interpretability for supervision [Gielis et al., 2022; Bai et al., 2022; Wang et al., 2025a].

3.2 Threat Model

Attackers' Objectives. The primary goal of attackers is to disrupt an embodied robot system engaged in cooperative tasks. By compromising a single designated "entry point" robot, the attacker seeks to trigger a cascading effect throughout the coordination process. The ultimate aim is to induce cluster-wide failures or trigger unsafe behaviors that compromise the collective mission.

Attackers' Knowledge. Given the closed-source reality of deployed commercial models, attackers operate under a strict black-box setting. The attacker is agnostic to the internal mechanics of the language model governing the entry robot. Without access to parameters or gradients, attackers must infer vulnerabilities solely from the robot's external responses and the observable outcomes of the cluster coordination.

Attackers' Capabilities. Adopting the minimal threat setup to highlight the severity of security risks, attackers are restricted to interacting with a single entry robot via natural language input.

3.3 ProblemFormulation

We consider a multi-robot coordination system with N robots indexed by N = {0, 1, . . . ,N - 1}. The attacker interacts with a single designated entry robot 0. Under an attack policy π, the attack issues a sequence of natural language inputs. Each episode (i.e., one complete task rollout from initialization to termination) yields a trace τ (π), consisting of the entry interaction log and internal coordination messages.

Propagation Indicators. To characterize unsafe behavior induction and propagation in multi-robot collaboration, we introduce three normalized propagation indicators in [0, 1] and apply them to each episode trace τ. Obedience O(τ) measures the extent to which the entry robot is induced to deviate from system constraints, as reflected by logged violation events after attacker inputs. We define O(τ) on the entry robot because it is the only robot directly exposed to attacker inputs in our threat model; effects observed on other robots are analyzed separately. Infectiousness Cinf(τ) captures the degree of autonomous cascade following influence on the entry robot, driven by internal coordination without additional attacker interaction. Stealthiness Sstealth(τ) quantifies how small the observable interaction footprint remains under the coordination protocol, where smaller footprints indicate higher stealth. The detailed computation of all objectives is described in the experiments.

BudgetedObjective. We model an attack as a policy π that specifies a prompt sequence, and let τ(π) denote the resulting episode trace. Here the budget B refers to the attacker-side interaction allowance in our attack procedure (e.g., the number of attacker prompts and permitted retries), which induces a feasible policy family Π(B). To score and compare policies under a fixed B, we adopt a standard constrained scalarization that integrates the three evaluation metrics:

where λO, λC, λS ≥ 0 are trade-off weights, λ0 is a constant offset, and s0 ∈ [0, 1] is a minimum stealth requirement. Section 4.1 presents detailed definitions and measurement procedures for all metrics.

3.4 PropagationMechanism

We present InfectBot as a workflow paradigm for black-box attacks on multi-robot collaborative systems coordinated by embodied LLMs.

The attacker has no model internals or software control, and the only practical control surface is natural language interaction with the entry robot. Accordingly, most applicable attack techniques are jailbreak prompts, namely inputs that elicit policy violating actions despite alignment and refusal behaviors. We structure the attack as a staged propagation mechanism that reduces uncertainty, seeds a transferable payload, expands its adoption through peer coordination, and progressively activates multi step violation objectives, as shown in Figure 1.

Algorithm 1 instantiates the above propagation mechanism with a compact set of controllable budgets and runtime state variables. It takes as input the robot set A = {a0, . . . , aN-1}, a seed prompt pool P = {P (1) , . . . , P (M) }, and an ordered stage set S = {1, . . . ,L}, maintains a confirmed set C, an activated set E, and a relay selector r, and outputs a dissemination log L and an activation trace T . The budgets Rp and Rs bound dissemination rounds and per stage propagation, respectively, with capped retries K used throughout. The algorithm grows C via iterative relaying for up to Rp rounds: a robot is added to C once payload adoption is supported by observable evidence and r is updated; otherwise the robot may be revisited within the retry budget K. It then processes stages in order, targeting robots that are not yet activated and satisfy the feasibility condition (Feasible in Algorithm 1); when stage completion becomes externally observable, the robot is added to E and r is updated, otherwise activation may be retried within budget K [Wang et al., 2022].

We record a dissemination log L (CONF events for payload adoption) and an activation trace T (SUCCESS events for stage completion). Together they characterize propagation and objective realization for downstream evaluation, without relying on internal execution traces.

4 Experiments

4.1 Setup

Experimental Environment: All experiments are conducted using NVIDIA Isaac Sim 4.5.0 and Isaac Lab 2.1. To enhance simulation fidelity and facilitate simulation to real transfer, we implement each atomic operation via standard ROS 2 Humble communication primitives and dispatch them to the robot side control stack, following the same middleware paradigm used in real robot teleoperation and interactive control. For physical experiments, the system directly interfaces with official Unitree ROS 2 and SDK2 environments [Unitree Robotics, 2026].

Target LLM: We evaluate representative target LLMs spanning three practical deployment categories. (1) Mainstream Models: We primarily utilize gpt-3.5-turbo, as it represents the standard capability level integrated into Unitree Go2 voice interaction systems [Unitree Robotics, 2026]. This category of models is a practical choice for real-time robotic deployment due to its superior balance of latency, efficiency, and reasoning performance. To ensure a comprehensive evaluation within this performance tier, we also include Gemini-2.5-Flash and Kimi K2 in our experiments. (2) Developer edition deployments (Go2-Edu): To reflect highercapability configurations enabled by developer editions [Unitree Robotics, 2026], we also evaluate using GPT-4o under the same control interface. (3) Frontier model reference: We further include GPT-5.1 as a representative recent model to examine whether the attack persists under stronger general reasoning and safety configurations. For all models, we adopt deterministic decoding with temperature set to 0, aligning with prior LLM-controlled robotic system experiments [Zhang et al., 2025a; Robey et al., 2025].

Security Threat Scenarios: In Figure 2, we evaluate three scenarios: warehouse patrol (robots remain within assigned zones, with any boundary crossing treated as unauthorized behavior), hospital (visual sensing capabilities may be misused to collect or expose sensitive information), and formation escort (hazardous cargo transport, where formation integrity must be preserved to prevent the carrier robot from being steered into unsafe or restricted areas). All environments share atomic operations (task-specific subsets): MOVE navigates to a target pose subject to scenario constraints; MESSAGE sends textual messages to a designated robot; INIT resets the episode; CAMERA activates visual sensing; and HANDLECARGO executes hazardous cargo handling actions and is restricted to the designated carrier robot when enabled.

4.2 EvaluationMetrics

We provide explicit computation for the three normalized metrics defined in Section 3.3: Obedience O(τ), Infectiousness Cinf (τ), and Stealthiness Sstealth(τ), and we also give two auxiliary propagation indicators in Figure 1: propagation

Task1-Warehouse Patrol-Dereliction of Duty

Task2-Hospital-Privacy

Task3-Formation Escort-Public Security

Figure 2: Representative examples from three real world evaluation scenarios. In each scenario, an adversary interacts only with Robot 0; the induced unsafe behavior propagates through inter robot communication. (a) Warehouse Patrol: the patrol group progressively deviates from patrol constraints and causes boundary violations. (b) Hospital Privacy: robots enter privacy sensitive areas and violate sensing constraints, such as illicit camera activation. (c) Formation Escort: the influence propagates along the escort formation and can result in control of the robot carrying a bomb, enabling dangerous manipulation of the bomb within a crowded area.

depth D(τ ) (max relay hop reached) and time to compromise R(τ) (rounds until full compromise). All metrics are computed from the episode trace τ . Let attack inputs be {ak}Ak=1 , with each ak occurring at round rk. We denote Lmax ∈ {1, 2} as the number of violation stages, and P (ℓ) (i, r) ∈ {0, 1} as an indicator for a stage ℓ violation at round r for robot i.

Obedience O. Traditional LLM jailbreak evaluation often reports attack success rate (ASR) as the primary success metric [Russinovich et al., 2025]. In embodied LLM jailbreaks, however, success is manifested as constraint violations that are observable in actions, execution traces, or environment level security events [Robey et al., 2025; Zhang et al., 2025a]. In our setting, a single attacker interacts only with the entry robot (robot 0), and an episode is considered successful only if a violation is induced on this robot. We quantify obedience on robot 0 using two binary indicators for each attack input, ACCEPT(k) and EXEC(k), instantiated from logged responses and actions. Aggregating over all A attack inputs yields the acceptance rate, execution success rate, and the conditional execution success rate given acceptance, where the latter defines the final obedience O:

Infectiousness Cinf . Since standard metrics for jailbreak success rarely account for propagation within coordinated clusters, we define infectiousness using a staged contagion view with explicit source and stage weighting. A practical complication in embodied multi-robot tasks is stage reachability: some stages may be executable only by a subset of robots due to role constraints or action-space limitations. To avoid task specific asymmetry from inadvertently reducing the achievable score range, we adopt a capability conditioned normalization. This design preserves comparability across tasks by ensuring that a follower is evaluated only against the stages it can potentially realize.

To accommodate multi-stage tasks, we assign positive stage weights qℓ and introduce a binary reachability indicator a(ℓ) i . Here a(ℓ) i = 1 means follower robot i can potentially realize stage ℓ under the task's role constraints, and a(ℓ) i = 0 otherwise. We then compute each follower's infection score by combining stage weighting, reachability masking, firsttrigger events, and the source weight w(·):

For capability-aware normalization, each follower is evaluated against the total weight mass of stages it can potentially realize, denoted by Zi. We normalize per follower and average across all followers:

When all stages are reachable for all followers (i.e., a(ℓ) i ≡ 1), this formulation reduces to standard normalization by the global stage-weight sum. For clarity, we summarize the key notation used above; detailed metric instantiations and task-specific configurations are provided in our accompanying code repository. Here, r(ℓ) i denotes the first trigger round of stage ℓ on follower robot i (or ⊥ if absent), and σ(ℓ) i denotes the primary propagation source responsible for this trigger. Each source σ is assigned a weight w(σ) ∈ [0, 1], with higher values indicating multi-hop propagation rather than direct influence from the entry robot. The binary indicator a(ℓ) i ∈ {0, 1} captures whether stage ℓ is reachable for follower i, and Zi denotes the reachable stage mass used for capability-aware normalization.

Stealthiness Sstealth. In our embodied multi-robot setting, the adversarial footprint extends beyond external perturbations to encompass internal coordination traffic. We therefore operationalize stealthiness as a proxy for the attackers' "observable footprint" by integrating two distinct communication channels: (i) the adversarial inputs directed at the entry robot, and (ii) the subsequent internal coordination messages propagated within the cluster.

Let A denote the number of attacker inputs directed at the entry robot in an episode, and let M denote the total number of internal coordination messages exchanged within the robot cluster. We define the normalized footprint fraction F and the resulting stealthiness score as:

4.3 Results Analysis

Evaluation of System Prompt Utility and Security

In our multi-robot system, each robot is driven by an embodied LLM agent whose behavior is determined by a YAML system prompt. This prompt specifies the robot's role, the atomic action interface, parameter ranges, and safety constraints. As no established security benchmark exists for coordinated robot systems, we adapt the BADROBOT jailbreak dataset [Zhang et al., 2025a] to demonstrate the rationale behind the balanced system prompt we designed. Robot Note: Etot: total unsafe events; ER0 and Efwd: events triggered by Robot 0 vs. forwarded by others (infectious); E≥k: events with propagation ≥ k hops. Forwarded share = Efwd/Etot.

0 serves as the evaluation representative, as robots share the same action space and prompt logic. Usability checks on benign execution and coordination adherence are reported, and results are in the rightmost columns of Table 1. Overall, the system prompts exhibit a balance across settings, with scores spanning 74.96 to 95.33. Hospital Privacy yields the most robust configurations, where Gemini-2.5-Flash attains 95.33. Warehouse Patrol shows strength, with GPT-3.5-Turbo reaching 93.40.

Revisiting Attack Baseline under Balanced Prompts

Figure 3 reports robot robustness under the balanced system prompt configuration. We compare direct malicious queries Vanilla, three systematic variants Bcj, Bsm, Bcd, and an Inthe-Wild jailbreak set [Zhang et al., 2025a]. All prompts are instantiated through our atomic action interface for consistent evaluation. Robustness is measured by Effective Refusal Rate (ERR), which counts responses that are both parsable and safe; high ERR indicates the model denies malicious intent while preserving functional control. Overall, standardized variants are handled well, whereas the In-the-Wild set exposes sharper failures. Warehouse Patrol is the most brittle, and failures arise when outputs fail to map onto the atomic action interface, expanding the failure surface beyond jailbreak behavior.

System Security and Propagation Driven Infection

Building on the balanced prompt evaluation, we adopt the YAML configuration as a lightweight guardrail, constraining action formats and security rules without extra runtime instrumentation. Since available defense baselines for coordinated robot settings are limited, we examine whether system-level security holds under staged dissemination.

Table 1 shows that strong entry-robot robustness is insufficient once coordination messages propagate, as dissemination sustains infections despite individual refusals. In Warehouse Patrol, GPT-3.5-Turbo reaches a Ssecurity of 100.0 yet still yields Cinf at 0.69, while Gemini-2.5-Flash attains higher spread (Cinf of 0.9) despite a lower Ssecurity of 65.3. This indicates outbreak severity is driven less by entry refusal than by early adoption and forwarding, which Algorithm 1 amplifies by decoupling propagation from activation.

Table 2 confirms that unsafe behavior is dominated by propagation: 61.5% of 832 unsafe events are induced by forwarded messages, while only 38.5% are directly triggered by Robot 0. Depth statistics confirm nontrivial reach: 44.2% of runs exhibit unsafe events at three or more hops, and 10.3% reach at least five hops. These results support that the primary risk driver is sustained message-mediated spread, not isolated entry-robot deviations.

Propagation Robustness across Deployments

Table 3 shows that stronger prompt-level robustness does not necessarily translate into lower system-level propagation: models can achieve high security scores while still exhibiting non-trivial infectiousness and obedience once malicious influence spreads through internal robot messaging. For example, GPT-5.1 attains a perfect Ssec of 100.0 yet still yields Cinf of 0.62 and Oobd of 0.77, while GPT-4o reaches Ssec of 91.2 and maintains higher infectiousness with Cinf of 0.76.

Results in Figure 4 indicate that propagation driven infection remains effective even on advanced models. Forwarded triggers still account for a large fraction of unsafe events, and multi hop dissemination persists across deployments. Notably, deeper chain events are more prevalent than in GPT3.5-Turbo, suggesting that increased model capability does not inherently suppress cascade dynamics. Overall, once malicious influence enters internal robot messaging, multi hop dissemination persists and can even intensify, reinforcing that our method reliably achieves propagation and infection under advanced LLM configurations.

5 Conclusions

In this paper, we study a security gap that arises when large language models serve as the decision core of multi-robot collaboration. Unlike single-robot settings, multi-robot systems rely on continuous message exchange and shared context, which exposes internal communication as a primary attack surface and enables system level failures. Our results show that compromising a single robot can propagate adversarial influence through internal robot coordination, gradually steering the team away from assigned roles and leading to full system compromise. We find that such failures can be persistent and rapidly spreading, while remaining difficult to detect from local behaviors alone. In future work, we plan to study alternative communication mechanisms and coordination architectures, including centralized planning controlled by a separate LLM. We hope this work highlights key security challenges in embodied intelligence and encourages further efforts toward trustworthy multi-robot systems.

Ethical Statement

We strictly adhere to ethical norms and privacy protection guidelines; all experiments are confined to compliant simulation environments with no physical deployment that poses risks to safety or privacy. Our research outputs are exclusively for advancing the security of LLM-controlled multirobot systems and must not be misused for malicious attacks or harmful purposes. We commit to transparent knowledge sharing while upholding security boundaries to ensure responsible development of embodied intelligent technologies.

Acknowledgments

This work is supported by the National Natural Science Foundation of China (62472434) and the Key Program of NSFC Hunan (2026JJ30028).