When State Becomes an Attack Surface: State-Semantic Injection in LLM-Driven Embodied Agents

2026-08-17

AI Summary

This study addresses security vulnerabilities in LLM-driven embodied agents by conceptualizing environmental states as an attack surface and introducing the novel concept of "state semantic injection." Through the development of a comprehensive framework encompassing state semantic modeling, adversarial injection testing, and security evaluation, this work systematically elucidates the mechanisms by which malicious state exploitation induces task execution deviations. Experimental results validate that such attacks can trigger behavioral anomalies, thereby establishing a new class of security risks. Consequently, this research not only expands the threat model for embodied intelligence but also provides a critical theoretical foundation and fresh perspectives for enhancing system robustness and developing effective defense mechanisms against emerging adversarial threats.

Abstract

Large Language Models (LLMs) have demonstrated capabilities in in-context learning, task decomposition, step-by-step reasoning, and code generation, driving their gradual evolution from text generation models into the core of agents capable of perceiving environments, invoking tools, and executing tasks. Traditional LLM Agents typically obtain information through webpages, documents, databases, or external tools and generate corresponding invocation sequences according to user goals; when this technology is further integrated with robotic systems, large language models begin to undertake functions such as task understanding, high-level planning, and behavioral decision-making. SayCan combines the task reasoning capability of language models with the affordances of robotic skills, while Code as Policies and ProgPrompt generate robot task plans through policy code and programmatic prompting, respectively, and VoxPoser uses language models and vision-language models to construct three-dimensional value maps to guide robotic manipulation \cite{6,7,8,9}. Vision-language-action models such as PaLM-E, RT-2, and GR00T N1 further strengthen the connection among language, visual perception, and robotic actions \cite{10,11,12}. In such LLM-driven embodied agents, the model not only needs to understand user instructions, but also needs to combine scene states, object attributes, spatial relations, and execution feedback to complete task grounding, and then hand the generated action plan to skill libraries, motion planners, or controllers for execution.

Problem

• State-Semantic Injection
• Embodied Agents
• Attack Surface
• Large Language Models
• Security

Innovation

• State-Semantic Injection
• Embodied Agents
• Attack Surface
• Task Grounding
• LLM Security