MuTRAP poisoned robot soft prompts redirect plans without retraining base weights

The attacker controls an adaptation artifact that appears to be a legitimate planner configuration. When a trigger is present in a natural-language task, the model produces a different robot plan while its unmodified backbone still handles ordinary requests. The attack enters through model adaptation provenance, not necessarily through a malicious user command at runtime.

The authors train task-specific soft prompts carrying multiple trigger phrases and report high malicious-plan rates in controlled open-model robot-planning evaluations while retaining much of benign-task performance. The paper was first submitted in April 2025 and revisited during 2026 robotics reporting. Lab plan scores, plastic props and demonstrations do not show rates of real-world injuries or compromise of commercial robots.

Treat soft prompts and task adapters as executable policy-bearing artifacts, test triggered and ordinary tasks, and enforce physical action constraints outside the language model plan. A robot may need both a safe planner and a control layer capable of declining hazardous actions regardless of which adapter supplied the plan. Primary evidence.

Additional evidence and trust boundary

The attacker must influence the downstream adapter or soft-prompt parameters: ordinary conversational access is not sufficient to install this backdoor. A hidden word can then change the plan while the base model and normal evaluations appear unchanged. Defense requires signing or reviewing adaptation artifacts and checking proposed robot actions against external physical safety policies rather than relying only on the planner's language output. Supporting record.