首次实现对机器人控制大模型的越狱攻击，揭示物理安全风险。
Jailbreaking LLM-Controlled Robots
- 设计RoboPAIR算法，通过提示词绕过机器人安全机制
- 三类场景下攻击成功率均达100%，包括商用机器人
- 首次证明越狱可引发真实世界物理危害，警示部署风险
大语言模型（LLM）的引入彻底改变了机器人领域，使机械臂操作、移动导航和自动驾驶等任务具备上下文推理与自然人机交互能力。然而，现有研究显示LLM易受越狱攻击——恶意提示可绕过安全限制生成有害文本。为评估其在机器人中的风险，本文提出首个针对机器人控制的越狱算法RoboPAIR。实验覆盖三种场景：(i) 白盒攻击，完全访问NVIDIA Dolphins自动驾驶LLM；(ii) 灰盒攻击，部分访问Clearpath Jackal UGV配备GPT-4o规划器的系统；(iii) 黑盒攻击，仅通过查询接口访问集成GPT-3.5的Unitree Go2机器狗。在三个新构建的有害机器人动作数据集上，RoboPAIR及多个静态基线均快速有效触发越狱，成功率高达100%。结果首次表明，越狱风险已从文本扩展至现实物理行为，且成功攻破了部署中的商用机器人系统。该发现凸显保障机器人中LLM安全的紧迫性。
原文摘要 · Abstract (English)
The recent introduction of large language models (LLMs) has revolutionized the field of robotics by enabling contextual reasoning and intuitive human-robot interaction in domains as varied as manipulation, locomotion, and self-driving vehicles. When viewed as a stand-alone technology, LLMs are known to be vulnerable to jailbreaking attacks, wherein malicious prompters elicit harmful text by bypassing LLM safety guardrails. To assess the risks of deploying LLMs in robotics, in this paper, we introduce RoboPAIR, the first algorithm designed to jailbreak LLM-controlled robots. Unlike existing, textual attacks on LLM chatbots, RoboPAIR elicits harmful physical actions from LLM-controlled robots, a phenomenon we experimentally demonstrate in three scenarios: (i) a white-box setting, wherein the attacker has full access to the NVIDIA Dolphins self-driving LLM, (ii) a gray-box setting, wherein the attacker has partial access to a Clearpath Robotics Jackal UGV robot equipped with a GPT-4o planner, and (iii) a black-box setting, wherein the attacker has only query access to the GPT-3.5-integrated Unitree Robotics Go2 robot dog. In each scenario and across three new datasets of harmful robotic actions, we demonstrate that RoboPAIR, as well as several static baselines, finds jailbreaks quickly and effectively, often achieving 100% attack success rates. Our results reveal, for the first time, that the risks of jailbroken LLMs extend far beyond text generation, given the distinct possibility that jailbroken robots could cause physical damage in the real world. Indeed, our results on the Unitree Go2 represent the first successful jailbreak of a deployed commercial robotic system. Addressing this emerging vulnerability is critical for ensuring the safe deployment of LLMs in robotics. Additional media is available at: https://robopair.org
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。