Exploring the Robustness of Decision-Level Through Adversarial Attacks on LLM-Based Embodied Models

1 INTRODUCTION

• Prompt manipulation can make an embodied robot produce irrelevant or malicious outputs and perform unsafe actions.In this setting, the LLM serves as the robot’s decision level by producing task steps.Source: §1 · p. 1
• Traditional text attacks do not evaluate the embodied setting’s real-time interaction, object recognition, and action execution.The introduction argues that embodied robustness evaluation must account for both value-level attacks and attacks related to robot task execution.Source: §1 · pp. 1–2
• Existing robustness datasets lack the images and text-image interaction needed to evaluate LLM-based embodied models.The introduction contrasts this need with AdvBench’s harmful text content [42].Source: §1 · p. 2
• EIRAD contains 500 image-text pairs for targeted attacks and 500 for untargeted attacks.Targeted data specifies an output goal; untargeted data seeks outputs inconsistent with expectations or random or meaningless content.Source: §1 · p. 2
• The approach initializes prompt suffixes with target-task keywords and assesses attack success using step-matched outputs and image-text similarity.The introduction says this initialization is intended to speed convergence; the matching approach is intended to reduce missed or incorrect judgments.Source: §1 · p. 2
• The proposed method achieves a higher attack success rate and takes less time and cost than GCG [42] and AutoDAN [17].The authors describe this as an initial experiment exploring decision-level robustness in LLM-based embodied models.Source: §1 · p. 2

2.1 Embodied task planning

• LLM-based embodied planning work includes grounding plans in scene objects and physical constraints, fine-tuning on multimodal data, and coupling high-level plans with environmental state.The section notes that measuring and assuring robot safety and robustness after LLM integration remain challenges.Source: §2.1 · p. 2

2.2 Jailbreak attack based on LLM

• Prior jailbreak methods target text-level adversarial content, while embodied scenarios also involve vision and action and require multimodal evaluation.Examples include adversarial suffixes [42], ReNeLLM [7], and AutoDAN [17].Source: §2.2 · pp. 2–3

3.1 Dataset analysis and creation process

• EIRAD addresses the lack of datasets combining harmful text, image inputs, and text-image interaction for embodied-robot robustness evaluation.The method presents it as a dataset for evaluating LLM robustness in embodied intelligent robotics.Source: §3.1 · p. 3

3.1.1 Data types and statistics.

• EIRAD separates untargeted attacks from targeted attacks, which include harmful and harmless data and corresponding GPT-3.5-generated responses.Untargeted data seeks unexpected, random, or meaningless outputs; targeted data specifies an expected target.Source: §3.1.1 · p. 3
• EIRAD’s examples span varied harmless prompt and target verbs and objects, while harmful examples include combinations such as “cut off fingers” and “break mirrors.”Figure 3 presents the ten most frequent verbs and corresponding noun objects for the specified data categories.Source: §3.1.1 · p. 3, Figure 3 · p. 4

3.1.2 Description of the dataset creation process.

• Dataset construction selects scene images, detects and deduplicates object names, generates prompts from the object list, and adds target instructions for targeted data.Steps 1–3 are shared by both data types; step 4 generates targeted instructions.Source: §3.1.2 · pp. 3–4

3.2 Embodied scenario attack algorithm

• The attack loop initializes a suffix, optimizes it to elicit unrelated content, and checks sliced outputs for attack success, repeating optimization when unsuccessful.The framework describes the untargeted objective; the method’s later sections distinguish targeted attacks.Source: §3.2 · p. 4

3.2.1 Initialize prompt suffix.

• For targeted attacks, the initial suffix replaces part of “!!!” with keywords related to the target task, a strategy intended to improve iteration speed and attack success.The authors report that successful targeted suffixes often contain target-related keywords.Source: §3.2.1 · p. 4

3.2.2 Optimize adversarial suffixes.

• Suffix optimization models generation as next-token prediction, maximizing negative log probability for untargeted attacks and minimizing it for targeted attacks.Candidate replacement tokens are evaluated at each position, selecting replacements that maximize or minimize loss according to attack type.Source: §3.2.2 · p. 5

3.2.3 Judgment of attack success.

• Attack success is assessed by slicing the model response into steps and comparing each step with the target using BLIP2 text encodings and cosine similarity.The highest-similarity step is measured against a predetermined threshold; the authors motivate this approach by noting that fixed response-level thresholds can misjudge variable-length outputs.Source: §3.2.3 · pp. 5–6

4.1 Settings

• EIRAD evaluation uses 500 untargeted and 500 targeted instances, across TaPA, Otter, and Llama-2-7b-chat, measuring ASR, ESR, and Epoch Cost.Targeted instances include 450 harmless and 50 harmful cases; GCG and AutoDAN are baselines, with their text-matching criteria adapted for embodied tasks.Source: §4.1 · p. 6

4.2 Main results

• ASR gains exceed 10% on TaPA and Otter and 20% on harmful attacks; Llama-2-chat has comparable harmless ASR to GCG but lower Epoch cost.The table covers targeted and untargeted attacks on three models using EIRAD.Source: §4.2 · p. 6, Table 1 · p. 7

4.3 Execution success rate

• Targeted-attack outputs largely meet embodied requirements, whereas untargeted attacks have low ESR because execution feasibility is not their success criterion.The ESR assessment uses a user study.Source: §4.3 · p. 7, Table 2 · p. 7

4.4 The impact of keyword initialization on loss

• Keyword-initialized suffixes have lower initial loss, helping the model find an effective attack direction sooner during iterative optimization.The loss comparison uses two initialized keywords versus none across three models.Source: §4.4 · p. 7, Figure 7 · p. 8

4.5.1 The impact of initializing the number of keywords.

• On Otter, increasing initialized keywords raises targeted ASR and lowers Epoch cost, but adds workload that must be balanced against attack time and success.Higher keyword counts also correspond to lower initial loss and quicker attack success.Source: §4.5.1 · pp. 7–8, Figure 8 · p. 8

4.5.2 Validity of Assessment Methods.

• The proposed slicing-and-similarity assessment aligns outputs more closely with attack goals than GCG matching-list or similarity-only assessment, reducing false and missed detections.Table 3 presents responses under the three judgment methods.Source: Table 3 · p. 8, §4.5.2 · p. 8

• EIRAD is a multimodal dataset designed to assess LLM decision-level robustness in embodied scenarios.Source: §5 · p. 8
• The paper uses targeted and untargeted attacks, task-specific prompt-suffix keyword initialization, and a BLIP2-based method to assess attack success.Source: §5 · p. 8
• Experiments validate the approach’s effectiveness while underscoring decision-level robustness challenges for LLMs in embodied scenarios.Source: §5 · p. 8

1.1 TaPA model

• Appendix figures report ASR, Epoch Cost, and loss for Llama-2-chat under varying keyword-initialization counts.Source: §1.1 · p. 10

1.2 Llama-2-chat model

• Appendix figures report ASR, Epoch Cost, and loss for Llama-2-chat under varying keyword-initialization counts.Source: §1.2 · p. 10