ai-research-survey

scan.json (27783B)

---

 {
   "paper": {
     "title": "Trust in LLM-controlled Robotics: a Survey of Security Threats, Defenses and Challenges",
     "authors": [
       "Xinyu Huang",
       "Shyam Karthick V B",
       "Taozhao Chen",
       "Mitch Bryson",
       "Thomas Chaffey",
       "Huaming Chen",
       "Kim-Kwang Raymond Choo",
       "Ian R. Manchester"
     ],
     "year": 2025,
     "venue": "arXiv",
     "arxiv_id": "2601.02377",
     "doi": "10.48550/arXiv.2601.02377"
   },
   "scan_version": 3,
   "active_modules": ["survey_methodology"],
   "methodology_tags": ["meta-analysis"],
   "key_findings": "This survey presents a taxonomy of attack vectors (jailbreaking, backdoor, prompt injection) and defense mechanisms (formal specification, multi-LLM oversight, prompt hardening, control-theoretic safety) for LLM-controlled robotic systems. The central insight is the 'embodiment gap' — traditional text-based LLM safety measures are insufficient because harm shifts from toxic text to dangerous physical actions, and the safety of a robotic command is inherently state-dependent. The authors find that current defenses are siloed across perception, cognition, and control layers, with no end-to-end assurance framework yet available.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": false,
         "justification": "No code repository, analysis scripts, or supplementary materials are mentioned or linked anywhere in the paper."
       },
       "data_released": {
         "applies": true,
         "answer": false,
         "justification": "No search corpus, extracted paper metadata, or analysis data is released. The survey does not provide a downloadable dataset of its reviewed papers."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No environment or tool specifications are provided. As a survey, it could have specified tools used for literature management and analysis, but does not."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step instructions are provided for reproducing the literature search or analysis. Section II.A describes a protocol at a high level but lacks specifics needed for exact reproduction."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": false,
         "answer": false,
         "justification": "Survey paper with no original experiments or statistical analyses. Numbers cited (e.g., 'over 90% to under 2.5%') are from reviewed papers, not the survey's own analysis."
       },
       "significance_tests": {
         "applies": false,
         "answer": false,
         "justification": "No statistical comparisons or significance tests are performed; this is a narrative literature review."
       },
       "effect_sizes_reported": {
         "applies": false,
         "answer": false,
         "justification": "No original effect sizes are computed. The survey reports numbers from cited work without its own quantitative synthesis."
       },
       "sample_size_justified": {
         "applies": false,
         "answer": false,
         "justification": "No original experiments; the number of papers reviewed is not treated as a sample requiring justification in the statistical sense."
       },
       "variance_reported": {
         "applies": false,
         "answer": false,
         "justification": "No experiments conducted; no variance or spread measures are applicable."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "TABLE I provides a comparative summary of this survey against six related surveys (Kim et al. 2024, Zeng et al., Li et al. 2025, He et al. 2024, Xing et al., Efa), analyzing scope, methodology, focus areas, and limitations of each."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "The compared surveys are from 2023-2025, which are contemporary to this 2025 survey. Includes recent works like Li et al. 2025, He et al. 2024, and Xing et al. 2025."
       },
       "ablation_study": {
         "applies": false,
         "answer": false,
         "justification": "No experiments are conducted; ablation is inapplicable to a survey paper."
       },
       "multiple_metrics": {
         "applies": false,
         "answer": false,
         "justification": "No experiments are conducted; evaluation metrics are inapplicable to a narrative survey."
       },
       "human_evaluation": {
         "applies": false,
         "answer": false,
         "justification": "No system outputs to evaluate; this is a literature survey with no experimental component."
       },
       "held_out_test_set": {
         "applies": false,
         "answer": false,
         "justification": "No experiments conducted; held-out sets are inapplicable."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "The survey provides detailed per-category breakdowns: attacks are organized into jailbreaking (Section IV.A), backdoor (Section IV.B), and prompt injection (Section IV.C). Defenses are categorized into 10 mechanism families (Section V.C). TABLE II maps works across lifecycle, layers, and mechanisms."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section IV.A.3 discusses limitations of jailbreaking methods. Section IV.B.4 enumerates unresolved challenges in backdoor attacks (trigger sensitivity, ASR-utility trade-off, ICL sustainability). Section V.D extensively discusses limitations of current defense mechanisms."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "The survey reports that traditional ad-hoc jailbreak methods 'often fail' in the robotics context (Section IV.A.1), that text-based defenses 'prove ineffective' for embodied systems (Section VIII.B), and that current defenses are 'fragmented and incomplete' (Section V.D)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims to present a systematic survey of threats and defenses for LLM-controlled robotics, a taxonomy of attack vectors, analysis of defense mechanisms, and review of benchmarks. Sections III-VII deliver on each of these claims with structured taxonomies, tables, and detailed analysis."
       },
       "causal_claims_justified": {
         "applies": false,
         "answer": false,
         "justification": "The paper is a survey that synthesizes existing literature. It does not make original causal claims from its own experimental work. Claims like 'LLMs introduce security vulnerabilities' are supported by cited empirical papers, not the authors' own causal analysis."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly bounds its scope to 'attacks targeting the cognitive layer, the reasoning and planning modules where natural language understanding occurs' and states it is 'distinct from the attacks on low-level perception, vision, or motor control modules' (Section I). Section II.A further defines inclusion/exclusion criteria."
       },
       "alternative_explanations_discussed": {
         "applies": false,
         "answer": false,
         "justification": "This is a pure survey/taxonomy paper that presents no original empirical results for which alternative explanations would need to be considered."
       },
       "proxy_outcome_distinction": {
         "applies": false,
         "answer": false,
         "justification": "No measurements are made by this survey paper; there is no proxy-outcome gap to address."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": false,
         "answer": false,
         "justification": "No models are used by the authors; this is a literature survey."
       },
       "prompts_provided": {
         "applies": false,
         "answer": false,
         "justification": "No prompting is used; this is a literature survey."
       },
       "hyperparameters_reported": {
         "applies": false,
         "answer": false,
         "justification": "No experiments conducted; no hyperparameters to report."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used; this is a literature survey."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "Section II.A describes the search protocol (databases: Google Scholar, arXiv, IEEE Xplore; keyword combinations; inclusion/exclusion criteria; multi-stage screening with snowballing). However, no quantitative pipeline is provided — the paper does not report how many initial results were found, how many passed each screening stage, or the total number of papers included in the final review."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated limitations section for the survey itself. Section V.D discusses limitations of current defense mechanisms in the field, and Section VIII discusses open challenges, but neither addresses the limitations of this survey's own methodology (e.g., search completeness, reviewer bias, time window)."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats to the validity of this survey are discussed. The paper does not acknowledge potential gaps in its search strategy, selection bias, or the possibility that its taxonomy may not be exhaustive."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section I explicitly states: 'we focus on attacks targeting the cognitive layer, the reasoning and planning modules where natural language understanding occurs. It is distinct from the attacks on low-level perception, vision, or motor control modules.' Section II.A further defines inclusion/exclusion criteria for the review."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "No raw data (list of all papers found, screening decisions, extraction tables) is provided for independent verification of the survey's completeness or accuracy."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section II.A describes databases searched (Google Scholar, arXiv, IEEE Xplore), keyword strategy combining three concepts (models, applications, security), inclusion criteria (direct focus on LLM-controlled robotics security), exclusion criteria (purely digital LLM security or traditional robotics security without LLMs), and multi-stage screening with snowballing."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. The paper selection process (analogous to recruitment for a survey) is described in Section II.A."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": false,
         "justification": "The pipeline from search to final analysis is described qualitatively (Section II.A: 'multi-stage screening of titles, abstracts, and full texts, supplemented by a snowballing review') but lacks quantitative details — no counts of papers at each stage, no PRISMA flow diagram, and no explicit total of included papers."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Funding is disclosed: 'The work of K.-K. R. Choo is supported by the Cloud Technology Endowed Professorship, and the Fulbright Distinguished Scholar in Cybersecurity and Critical Infrastructure award.'"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: University of Sydney (School of Electrical and Computer Engineering, Australian Centre for Robotics) and University of Texas at San Antonio (Department of Information Systems and Cybersecurity), plus University of Iceland."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "Funding comes from academic sources (Cloud Technology Endowed Professorship, Fulbright) with no apparent financial interest in the survey's conclusions about LLM-robotics security."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "Survey paper — does not evaluate any pre-trained model on a benchmark."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Survey paper — does not evaluate any pre-trained model on a benchmark."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Survey paper — does not evaluate any pre-trained model on a benchmark."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this survey."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this survey."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this survey."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this survey."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this survey."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this survey."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this survey."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": false,
         "answer": false,
         "justification": "Survey paper — no method or system to cost."
       },
       "compute_budget_stated": {
         "applies": false,
         "answer": false,
         "justification": "Survey paper — no computational experiments conducted."
       }
     },
     "survey_methodology": {
       "prisma_or_structured_protocol": {
         "applies": true,
         "answer": false,
         "justification": "Section II.A describes a search protocol with databases, keywords, and inclusion/exclusion criteria, but does not follow PRISMA or reference any established review methodology. There is no flow diagram, no protocol registration, and the search queries are not reproducible as stated (only keyword themes, not exact queries)."
       },
       "quality_assessment_of_sources": {
         "applies": true,
         "answer": false,
         "justification": "The survey does not assess the methodological quality of its source papers. TABLE I compares related surveys on scope and focus but does not evaluate their rigor. Attack and defense papers are summarized descriptively without quality scoring or risk-of-bias assessment."
       },
       "publication_bias_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of publication bias. The survey does not consider whether its sources are biased toward positive attack results or successful defenses, nor does it discuss whether negative results or failed approaches are underrepresented in the literature."
       }
     }
   },
   "claims": [
     {
       "claim": "The 'embodiment gap' creates unique security vulnerabilities where traditional text-based LLM safety measures are insufficient for robotic systems.",
       "evidence": "Supported by cited works demonstrating that LLMs verbally refuse malicious requests while paradoxically executing them [25], that semantically identical commands cause different robot behaviors [19], and that ad-hoc jailbreaks produce non-executable policies [27, 37]. Sections I, III, and VIII.A-B synthesize this evidence.",
       "supported": "moderate"
     },
     {
       "claim": "ROBOPAIR and POEX frameworks achieve high success rates in jailbreaking LLM-controlled robots by ensuring policy executability.",
       "evidence": "Section IV.A.2 describes ROBOPAIR's 'Syntax Checker' LLM and POEX's 'Policy Evaluator' model, citing [27] and [37] respectively. The claim of 'high success rates' is made without specific numbers in this survey.",
       "supported": "moderate"
     },
     {
       "claim": "Current defense mechanisms are fragmented and siloed across system layers, preventing end-to-end safety assurance.",
       "evidence": "Section V.D provides a detailed analysis: formal specifications don't extend to continuous dynamics, CBFs operate independently of LLM reasoning, multi-LLM oversight relies on the same model family's alignment, prompt hardening cannot address role-based jailbreaks, and evaluation uses static metrics that don't capture real deployment uncertainty.",
       "supported": "moderate"
     },
     {
       "claim": "Safety Guardrails [97] can reduce unsafe executions from over 90% to under 2.5%.",
       "evidence": "Cited from [97] in Section V.C.1. This is a specific quantitative claim from a single source paper, reported without independent verification or analysis of the claim's conditions.",
       "supported": "weak"
     },
     {
       "claim": "State and memory management (SafeEmbodAI, Enhancing Reliability) can improve task success rate by 30.8% under injection attacks, and up to 325% in complex scenarios.",
       "evidence": "Section V.C.4 cites [89] for these numbers. These are specific quantitative claims from a single source, reported at face value.",
       "supported": "weak"
     },
     {
       "claim": "Backdoor attacks in LLM-controlled robotics are particularly dangerous because they produce direct physical effects, unlike backdoors in text-only systems.",
       "evidence": "Section IV.B discusses CBA [38] (dual-modality triggers in autonomous driving), TrojanRobot [39] (visual triggers for manipulated instructions), and BALD [73] (three triggering mechanisms). These demonstrate the physical consequence dimension.",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "No quality assessment of source papers",
       "detail": "The survey summarizes attack and defense papers without assessing their methodological quality, experimental rigor, or risk of bias. Claims like 'high success rates' for attack frameworks are reported at face value without scrutinizing the conditions, threat models, or generalizability of those results. This launders the signal-to-noise ratio of the sources."
     },
     {
       "flag": "No PRISMA or quantitative search pipeline",
       "detail": "Despite claiming a 'structured search protocol' (Section II.A), the paper provides no PRISMA flow diagram, no counts of papers at each screening stage, and no total number of included papers. The search queries are described as keyword themes rather than reproducible queries. The completeness and representativeness of the review cannot be independently verified."
     },
     {
       "flag": "Selective reporting of quantitative claims",
       "detail": "Specific numbers from cited papers (e.g., '90% to under 2.5%' for Safety Guardrails, '30.8% increase' for Enhancing Reliability, '267% gains' for SafeEmbodAI) are reported without context about the experimental conditions, baselines, or potential limitations of those measurements. This creates an impression of strong evidence that may not reflect the original papers' caveats."
     },
     {
       "flag": "No discussion of the survey's own limitations",
       "detail": "While Sections V.D and VIII discuss limitations of the field, no section addresses limitations of this survey itself — such as search completeness, language bias (English-only), time window, reviewer bias in paper selection, or the possibility that the proposed taxonomy is not exhaustive."
     }
   ],
   "cited_papers": [
     {
       "title": "Jailbreaking LLM-controlled robots",
       "authors": ["A. Robey", "Z. Ravichandran", "V. Kumar", "H. Hassani", "G. J. Pappas"],
       "year": 2024,
       "arxiv_id": "2410.13691",
       "relevance": "Introduces ROBOPAIR framework for jailbreaking LLM-controlled robots with a syntax-checking LLM, directly relevant to LLM security in agentic systems."
     },
     {
       "title": "POEX: Towards policy executable jailbreak attacks against the LLM-based robots",
       "authors": ["X. Lu", "Z. Huang", "X. Li", "C. Zhang", "X. Ji", "W. Xu"],
       "year": 2025,
       "arxiv_id": "2412.16633",
       "relevance": "Advances jailbreaking of LLM-controlled robots with a Policy Evaluator ensuring physical executability, key contribution to LLM-robotics safety research."
     },
     {
       "title": "BadRobot: Jailbreaking embodied LLMs in the physical world",
       "authors": ["H. Zhang", "H. Pan", "S. Huang", "Y. Dong", "Z. Zhou"],
       "year": 2024,
       "relevance": "First systematic investigation of jailbreaking attacks on embodied LLM systems, identifying contextual jailbreaks, safety misalignment, and conceptual deception."
     },
     {
       "title": "TrojanRobot: Physical-world backdoor attacks against VLM-based robotic manipulation",
       "authors": ["X. Wang", "H. Pan", "H. Zhang", "M. Li", "S. Hu"],
       "year": 2025,
       "arxiv_id": "2411.11683",
       "relevance": "Demonstrates supply-chain backdoor attacks on VLM-based robotic systems through malicious external vision-language models."
     },
     {
       "title": "Compromising embodied agents with contextual backdoor attacks",
       "authors": ["A. Liu", "Y. Zhou", "X. Liu", "T. Zhang", "S. Liang"],
       "year": 2024,
       "arxiv_id": "2408.02882",
       "relevance": "Introduces dual-modality backdoor triggers (textual + visual) for attacking LLM-generated code in autonomous driving scenarios."
     },
     {
       "title": "On the vulnerability of LLM/VLM-controlled robotics",
       "authors": ["X. Wu", "S. Chakraborty", "R. Xian", "J. Liang", "T. Guan"],
       "year": 2025,
       "arxiv_id": "2402.10340",
       "relevance": "Studies input sensitivity of LLM/VLM-controlled robots, showing semantically identical commands cause different behaviors — directly relevant to LLM reliability."
     },
     {
       "title": "Safety guardrails for LLM-enabled robots",
       "authors": ["Z. Ravichandran", "A. Robey", "V. Kumar", "G. J. Pappas", "H. Hassani"],
       "year": 2025,
       "arxiv_id": "2503.07885",
       "relevance": "Proposes formal safety specification and runtime enforcement for LLM-controlled robots using temporal logic, reducing unsafe executions."
     },
     {
       "title": "Plug in the safety chip: Enforcing constraints for LLM-driven robot agents",
       "authors": ["Z. Yang", "S. S. Raman", "A. Shah", "S. Tellex"],
       "year": 2024,
       "relevance": "Introduces NL-to-LTL workflow for enforcing safety constraints on LLM-driven robot agents, a key defense mechanism."
     },
     {
       "title": "SafeEmbodAI: A safety framework for mobile robots in embodied AI systems",
       "authors": ["W. Zhang", "X. Kong", "T. Braunl", "J. B. Hong"],
       "year": 2024,
       "arxiv_id": "2409.01630",
       "relevance": "Proposes prompt hardening, state management, and rule-based validation for embodied AI safety, reporting significant gains under adversarial conditions."
     },
     {
       "title": "Code as policies: Language model programs for embodied control",
       "authors": ["J. Liang", "W. Huang", "F. Xia", "P. Xu", "K. Hausman"],
       "year": 2023,
       "relevance": "Seminal work on generating executable Python code from language for robot control, introduces code injection attack surface in LLM-robotics."
     },
     {
       "title": "Can we trust embodied agents? Exploring backdoor attacks against embodied LLM-based decision-making systems",
       "authors": ["R. Jiao", "S. Xie", "J. Yue", "T. Sato", "L. Wang"],
       "year": 2024,
       "relevance": "Introduces BALD framework with three backdoor triggering mechanisms for embodied LLM decision-making, directly relevant to LLM agent safety."
     },
     {
       "title": "Robo-Troj: Attacking LLM-based task planners",
       "authors": ["M. A. Nahian", "Z. Altaweel", "D. Reitano", "S. Ahmed", "S. Zhang"],
       "year": 2025,
       "relevance": "Demonstrates training-time Trojan attacks on LLM task planners using soft prompt tuning and multi-trigger optimization."
     },
     {
       "title": "CEE: An inference-time jailbreak defense for embodied intelligence via subspace concept rotation",
       "authors": ["J. Yang", "Z. Lin", "Z. Lu", "Y. Wang", "L. Wang"],
       "year": 2025,
       "arxiv_id": "2504.13201",
       "relevance": "Proposes inference-time defense against jailbreaking in embodied AI through prompt hardening and infrastructure-level enforcement."
     },
     {
       "title": "Embodied red teaming for auditing robotic foundation models",
       "authors": ["S. Karnik", "Z.-W. Hong", "N. Abhangi", "Y.-C. Lin", "T.-H. Wang"],
       "year": 2025,
       "arxiv_id": "2411.18676",
       "relevance": "Proposes automated red-teaming methodology for robotic foundation models using VLMs to discover non-malicious failure modes."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 1,
       "justification": "Provides a useful taxonomy and roadmap for researchers, but no tools, code, or immediately actionable techniques for practitioners."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "The 'embodiment gap' concept is interesting but the idea that LLM-controlled robots have security vulnerabilities is not surprising to the security community."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Directly catalogs how LLM-controlled robots can be jailbroken, backdoored, and manipulated into performing dangerous physical actions — high fear/safety valence."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "No controversy or dramatic claims; straightforward survey of an emerging threat landscape without challenging specific companies or researchers."
     },
     "demo_ability": {
       "score": 0,
       "justification": "No code, demo, or runnable artifacts; purely a written survey."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Authors are from University of Sydney and UT San Antonio; Kim-Kwang Raymond Choo is well-known in cybersecurity but not mainstream AI recognition."
     }
   }
 }