When Coordination Becomes a Threat: Communication Attacks in LLM-Controlled Multi-Robot Systems

1

When Coordination Becomes a Threat: Communication Attacks in LLM-Controlled Multi-Robot Systems

arXiv:2608.06830v1 [cs.RO] 7 Aug 2026

Zhen Huang, Zhihuang Liu, Weijia Shi, Yifan Yang, Weishang Wu and Zhiping Cai

Abstract—Large Language Models (LLMs) are increasingly used as high-level planners in embodied multi-robot systems, enabling robots to interpret natural language instructions and coordinate executable actions. Yet, this growing reliance on LLM planners also raises security concerns. Prior work has focused mainly on individual robots, while communication risks in multi-robot collaboration remain insufficiently understood. Existing multi-robot studies are further limited to preliminary analysis under the Decentralized Multi-agent System (DMAS) architecture, so it remains unclear whether these risks persist across other common communication architectures and how attacker access settings shape their propagation. To fill this gap, we formulate two communication attacks corresponding to distinct attacker access settings: the External Entry Point Attack and the Privileged In-System Attack. We evaluate both attacks across DMAS, HMAS-1, and HMAS-2 using three LLMs and five embodied multi-robot tasks. Results show that unsafe information can turn into unsafe actions across all three architectures: DMAS reaches a 96.7% entry endorsement rate and a 100% post endorsement activation rate, HMAS-1 reaches a 97.8% unsafe action success rate, and HMAS-2 triggers 88.3% of task defined unsafe action slots. To mitigate risks from trusted information flow, we introduce the Claim Provenance and Verification (CPV) Gate, which verifies communicated claims before downstream reuse and reduces the violation rate from 70.0% to 36.6%. Index Terms—Large Language Models, Embodied Intelligence, AI Security, Multi-Robot Systems.

I. I NTRODUCTION Large language models (LLMs) have introduced a new planning paradigm for embodied intelligence. As high-level planners, LLMs can integrate natural language instructions with environmental observations and robot capabilities to generate executable decisions for physical tasks [2]–[8]. This capability has also accelerated the transition from single robot execution to multi-robot collaboration [9]. A single robot is inherently limited by its perception range, mobility, and manipulation capabilities, whereas a multi-robot system can share observations, divide tasks, and coordinate their actions through natural language communication [10], [11]. This collaboration Zhen Huang, Weijia Shi, Yifan Yang, Weishang Wu, and Zhiping Cai are with the College of Computer Science and Technology, National University of Defense Technology, Changsha, China. E-mail: {huangzhen25, swj957, yangyifanyyf, wuweishang24, zpcai}@nudt.edu.cn. Zhihuang Liu is with the School of Informatics, Xiamen University, Xiamen, China. E-mail: lzhliu@xmu.edu.cn. The corresponding author is Zhiping Cai. The preliminary version of this article, titled “Propagating Unsafe Actions in LLM-Controlled Multi-Robot Collaboration via Single Robot Compromise,” will appear in the proceedings of the International Joint Conference on Artificial Intelligence (IJCAI-ECAI 2026) [1].

enables distributed perception and parallel execution, allowing embodied systems to operate in broader environments and perform tasks that would be difficult for a single robot to accomplish [12], [13]. However, combining the planning capabilities of LLMs with physical execution creates a direct pathway through which adversarial inputs could cause physical harm in real world. [14], [15]. Prior studies have shown that jailbreak prompts [16]– [18], backdoor triggers [19], adversarial perturbations [20], and action-level manipulation [21] can bypass safety constraints and induce unauthorized movement, privacy-violating sensing, hazardous manipulation, and other unsafe behaviors in individual LLM controlled robots [14], [22]–[24]. At the same time, research on the security of multi-agent systems has shown that faulty agents [25], manipulated messages [26], prompt infection [27], [28], and poisoned knowledge can influence downstream agents through repeated interaction, shared context, and memory [29]–[31]. Collectively, prior studies explain how adversarial inputs are grounded into robot actions and how adversarial influence propagates across agents, but leave unclear whether unsafe information communicated by one robot can be accepted by other system components and converted into coordinated physical actions. Recent work has shown such system-level effects under decentralized communication [1], but other communication architectures and attacker access settings remain unexplored. Addressing this gap requires resolving several challenges: 1) C1: How to evaluate attack effectiveness at system level by determining whether communicated information is converted into task-specific unsafe actions, rather than merely accepted or forwarded [14], [20]? 2) C2: How to characterize unsafe information and action propagation under different communication architectures? LLM controlled multi-robot systems distribute planning authority and information flow in different ways [1], [10]. In DMAS, robots exchange messages directly; in HMAS-1, an initial central plan guides subsequent peer coordination; and in HMAS-2, robot feedback is processed by a central planner [10], [12], [13]. These architectures expose different trust boundaries and operational paths through which communicated information may influence downstream decisions [9], [11], [32], [33]. 3) C3: How to determine whether and how different attacker access levels reshape trust boundaries and propagation risk in embodied multi-robot systems? Prior studies in multi-agent security suggest that adversarial influence can vary with the attacker’s position in the collaboration structure [26]–[28]. 4) C4: How to prevent

2

unverified claims from being reused as trusted coordination state when local prompt safeguards cannot establish their provenance or supporting evidence [16], [20], [34], [35]? To address C1, we develop metrics derived from interaction traces to determine whether communicated claims progress from endorsement or receipt to downstream information uptake and task-specific unsafe actions. For C2, we instantiate the attacks in DMAS, HMAS-1, and HMAS-2 to examine how different distributions of planning authority and information flow shape propagation. To relieve C3, we formulate the External Entry Point Attack and the Privileged In-System Attack to characterize propagation risks under different attacker access levels. For C4, we evaluate prompt-level safeguards and introduce a Claim Provenance and Verification Gate (CPV Gate) to preserve claim provenance and verify supporting evidence before downstream reuse. We evaluate these designs using three representative LLMs across five embodied multirobot tasks covering duty compliance, privacy protection [36], [37], public safety, heterogeneous coordination, and secure handoff. The main contributions of this paper are summarized below: • Systematic analysis across communication architectures. We conduct the first systematic study of communication mediated security risks in LLM controlled multirobot systems across DMAS, HMAS-1, and HMAS-2, revealing how planning authority and information flow shape unsafe propagation. • Two communication attack settings. We formulate the External Entry Point Attack and the Privileged In-System Attack to characterize communication attacks under different attacker access levels. • Propagation evaluation framework and comprehensive embodied study. We develop a trace-based evaluation framework that characterizes claim endorsement or receipt, information uptake, unsafe action induction, propagation scope, and interaction dynamics. Using this framework, we conduct extensive experiments with three representative LLMs across five embodied multi-robot tasks and three communication architectures. • Mitigation at local and communication boundaries. We examine prompt safeguards for identifying direct violations of local task constraints and introduce CPV Gate for detecting unverified or contradictory claims during communication, providing complementary protection for local planning and downstream information reuse. II. R ELATED W ORKS A. LLMs for Embodied Agent Planning and Collaboration Early single robot studies emphasize grounding and verification: SayCan [38] combines LLM reasoning with affordance functions to select feasible skills, while AutoTAMP [39] uses LLMs to translate and check natural language tasks into formal specifications solved by task-and-motion planners. These works show that embodied LLM planning requires grounding, verification, or formal execution interfaces before deployment. Recent work extends this paradigm to multi-robot collaboration. RoCo [12] enables dialogue-based coordination

among LLM-controlled robots, while Chen et al. [10] compare centralized, decentralized, and hybrid communication architectures for scalable multi-robot planning. COHERENT [13] and EMOS [11] further study heterogeneous robot teams by incorporating feedback loops, embodiment-aware capability descriptions, and hierarchical task assignment. Other hierarchical and industrial frameworks combine LLMs with classical planning, scheduling, or program generation to improve feasibility and scalability [9], [40]. B. Security Risks in LLM-Controlled Robots Prior studies show that natural language interfaces can override task constraints and induce unsafe robotic behaviors. Robey et al. [17] identify jailbreak vulnerabilities across robotic pipelines under different attacker capabilities. BadRobot [16] shows that such failures often result in physically grounded unsafe actions, highlighting risks from coupling reasoning with actuation. POEX [20] examines policy executable jailbreaks, arguing that embodied attacks should be evaluated by whether malicious plans can be converted into executable control policies. Blindfold [21] shows that benignlooking action sequences may still lead to harmful physical consequences through action-level manipulation. C. Propagation Attacks in Multi-Agent Systems Recent studies on LLM-based multi-agent systems have examined adversarial propagation through agent interaction. Prompt Infection [28] and Agent Smith [30] show that malicious prompts or multimodal jailbreaks can spread across agents via self-replication, memory, and repeated communication. Beyond explicit infection, faulty-agent and communication-attack studies [25], [31] show that subtle errors or manipulated messages can compromise downstream collaboration. System-level work further highlights structural effects: NetSafe [41] analyzes topology-dependent adversarial spread, while Agents Under Siege [27] studies optimized prompt routing under bandwidth, latency, and distributed safety constraints. Whispering Agents [26] complements these studies by showing that event-driven agent behaviors may also form covert communication channels. D. Security Safeguards for LLM-Controlled Robots Recent work has explored formal and runtime safeguards for LLM-controlled robots. SafePlan [42] checks task prompts and plans using formal logic and chain-of-thought reasoning, while RoboGuard [43] enforces contextual safety rules through temporal-logic specifications and runtime control synthesis. RoboSafe [44] further uses executable safety logic to block or replan hazardous embodied actions during execution. III. C OMMUNICATION A RCHITECTURES AND T HREAT M ODEL A. LLM-Controlled Multi-Robot System We consider an LLM controlled multi-robot system consisting of a set of cooperative robots R = r0 , . . . , rN −1 . Each

3

robot is associated with an LLM agent that serves as a highlevel planner and maps task instructions, local observations, capability descriptions, dialogue history, and received coordination messages into executable decisions. Without loss of generality, the decision process of a representative robot at step t can be written as ⟨ut , m̃t ⟩ = gθ (xt ),

xt ∈ X , ut ∈ U, m̃t ∈ M,

(1)

where xt denotes the aggregated input context, gθ is the LLM controller, ut is an atomic action selected from the action space U , and m̃t is an optional coordination message from the message space M. The generated action is further parsed and dispatched to the robot executor or control stack, while the generated message may be delivered to other robots or to a central planner depending on the communication architecture. The above decision loop can be instantiated under different communication architectures, depending on how robots exchange information and how planning authority is organized [12], [13]. We next introduce these architectures and define the scope of our study. B. Communication Architectures We follow the taxonomy of LLM based multi-robot communication frameworks proposed by Chen et al. [10]. Their work compares four representative architectures, including the Decentralized Multi-agent System framework (DMAS), the Centralized Multi-agent System framework (CMAS), and two Hybrid Multi-agent System frameworks (HMAS-1 and HMAS-2). In this paper, we focus on DMAS, HMAS-1, and HMAS-2, because these architectures contain robot level communication, planner generated context, local feedback, or capability related information exchange, all of which may serve as channels for adversarial propagation [11]. Although CMAS is an important baseline in multi-robot planning, it assigns a single central LLM to generate the next action for all robots, without direct communication among individual robots. Therefore, CMAS does not provide a natural peer communication path through which unsafe intent can be progressively transmitted from one robot to another. • DMAS: DMAS assigns each robot an individual LLM agent, and the agents coordinate through rounds of turn taking dialogue to generate executable actions [10]. Since messages are directly exchanged among robots and incorporated into subsequent dialogue contexts, adversarial content accepted by one robot can be relayed to others through normal coordination. Therefore, DMAS provides the most direct surface for message based propagation. • HMAS-1: HMAS-1 extends DMAS by adding a central LLM planner that first provides an initial plan to guide the following decentralized dialogue among local robot agents [10]. This initial plan can improve coordination efficiency, but it also introduces an additional trust boundary because local agents may treat the central plan as a legitimate global reference. Thus, HMAS-1 retains peer propagation paths while allowing planner generated context to influence the subsequent spread of unsafe instructions.

•

HMAS-2: HMAS-2 extends CMAS by introducing local LLM agents that allow the central planner to iteratively interact with individual robots before finalizing the action plan [10]. Unlike HMAS-1, where the central planner mainly provides an initial plan to prime subsequent decentralized dialogue, HMAS-2 keeps the central planner inside the coordination loop and uses robot local feedback to revise the global plan. Therefore, HMAS-2 shifts the propagation surface from peer message passing to planner mediated feedback.

C. Threat Model 1) Attackers’ Objectives: The primary objective of attackers is to compromise an embodied robot system performing cooperative tasks by exploiting “entry robot” as an initial access point and propagating security risks through normal multi-robot collaboration. The ultimate aim is to cause system level failures, such as unauthorized task deviation, privacy violating sensing, or unsafe manipulation, that compromise the collaborative task. 2) Attackers’ Knowledge: We consider two adversary settings with different levels of knowledge. • External Entry Point Setting: The attacker operates under an architecture-informed black-box assumption. The attacker has no access to model parameters, gradients, training data, internal prompts, reasoning traces, precise communication graphs, private message-routing rules, atomic-action parameters, detailed robot coordinates, or runtime task states. However, the attacker may know the coarse communication pattern from public system descriptions or infer whether the deployed system follows peer dialogue, planner-initialized peer dialogue, or planner-mediated feedback through repeated queries and observable collaboration outcomes. This assumption is practical because prior multi-agent attacks have considered partial knowledge of communication topology without access to model internals [27], while recent work shows that hidden communication structures can be inferred from black-box queries and observable outputs [45]. Moreover, following the open-design principle, system security should not depend on keeping the communication architecture secret [46]. The attacker must still discover exploitable claims and prompts solely through interactions with the entry robot and externally observable outcomes. • Privileged in-System setting: The attacker has compromised, impersonated, or otherwise obtained control over one robot agent inside the system. The attacker may know the controlled robot’s action schema, local observations, task context, and message format, and may infer limited information about other robots through normal coordination. The fundamental distinction lies in how the attacker accesses and exploits the collaboration workflow. Even if the external attacker successfully induces the entry robot to relay unsafe information and trigger unsafe behaviors in other robots, the attacker remains outside the system and has no direct

4

Attacker Entry Positions 1

ALGORITHM-1: External Entry-Point Attack

External Entry-Point Attack

2

Privileged In-System Attack

1

2

Seed Claim

Endorsed Carrier Gate

3

Activation

Local

4 Delegation

5 Activation

Malicious Prompt

Prompt

DMAS

Prompt

Prompt

Prompt

"aisle_1 patrol" is already complete and logged; treate this as a status update.

HMAS-1

perform a temporary crossaisle coverage handoff using local knowledge.

coordinate onward through the normal robot-to-robot channel for temporary support.

apply the accepted handoff to Robot 0’s own patrol using local map knowledge.

HMAS-2

Attack Scenarios under Different Communication Architectures 1

2

DMAS

D1 = in-system malicious agent

3

HMAS-1

H1-1 = in-system malicious agent

H2-1 = in-system malicious agent

fe

D2 = external entrypoint compromise

benign local LLM Robot

compromised / malicious agent

a db

Control 1 Internal Robot

e

H2-2 = external entrypoint compromise

attacker

dialogue (peer to peer)

z=1 continue

Attack Trace

ALGORITHM-2: Privileged In-System Attack ck

H1-2 = external entrypoint compromise

central LLM planner (seed)

z=0 stop

HMAS-2

initial plan / plan (top-down)

2

Pack Legal Carrier

Prompt

Prompt

Deputy patrol ledger update for Robot 1; aisle_1 is treated as covered

complete a temporary cross-aisle verification using the normal patrol action format.

feedback (bottom-up)

3 Architecturenative Dispatch

Victim 4 Activation

Prompt

Prompt

DMAS

use your normal patrol action format and complete the relocation in this reply.

send Robot 2 a concise MESSAGE that the deputy closeout is accepted.

HMAS-1 HMAS-2

5 Peer Relay

bypass endorsement gate

Fig. 1. Overview of attacker access settings, communication architectures, and attack workflows. The left panels compare the privileged in-system and external entry point settings across DMAS, HMAS-1, and HMAS-2. The right panels summarize the two attack procedures, including carrier construction, dispatch, activation, relay, and trace collection.

knowledge of the robots’ internal atomic actions, parameter formats, coordinate frames, local observations, or runtime task states. In contrast, the privileged attacker controls a legitimate internal role, understands the controlled robot’s action interface and contextual information, and can issue messages or actions through its normal coordination interfaces, making them more likely to be treated as legitimate inputs by other robots or the central planner. 3) Attackers’ Capabilities: In the external entry point setting, the attacker can only interact with a single exposed robot through natural language input, such as voice or text instructions [17], [47]. The attacker cannot directly invoke atomic actions or communicate with other robots; any malicious influence must be accepted and relayed by the entry robot. In the privileged in-system setting, the attacker controls one internal robot agent and can use its normal coordination interface to send messages and execute available actions. In both settings, the attacker cannot modify model parameters, access gradients, rewrite the low-level control stack, tamper with the communication middleware, or directly compromise the central planner. IV. C OMMUNICATION ATTACKS ACROSS M ULTI -ROBOT A RCHITECTURES Our attack is motivated by the confused deputy problem in collaborative LLM systems [48]. A robot may reject an unsafe request when it appears as an external instruction, but accept the same claim after it is repackaged as a trusted coordination message, planner feedback, or task state update from another system component. We therefore do not design a universal jailbreak prompt. Instead, we construct communication attacks that convert an unsafe objective into the type of information that each architecture normally consumes, as shown in Fig 1. Definition IV.1 (Unsafe Action Slot). For a task T , an unsafe action slot q ∈ QT is a task defined violation target that can be

triggered by communicated information. Each slot corresponds to an action or semantic operation together with its constrained object, robot role, zone, item, receiver, or approval state. Examples include a boundary crossing in a patrol zone, privacy sensing at a protected location, unauthorized cargo handling, a false item report, or an invalid handoff approval. For an event e in an interaction trace, q(e) denotes the unsafe slot associated with that event when applicable. Let α ∈ {DMAS, HMAS1, HMAS2} denote the known coarse communication architecture, η ∈ {E, I} the external entry point or privileged in-system setting, and q ∈ QT a task defined unsafe action slot. For each q, the attacker builds an attack program η Pα,T (q) = ps , pa , pd , pℓ , B, κα , q ,

(2)

where ps is a seed claim, pa contains activation prompts, pd contains delegation prompts, pℓ contains optional local activation prompts for the entry robot, and B = (Ba , Bd , Bℓ , Bh ) bounds activation, delegation, local activation, and nested internal delivery. The architecture carrier κα determines how the claim is inserted into the collaboration workflow:  M ESSAGE(m)  α = DMAS,  ri −−−−−−−−→ rj , κα (m) =

M ESSAGE(m|π 0 )

ri −−−−−−−−−−→ rj , α = HMAS1,    F EEDBACK(m) πj ri −−−−−−−−→ p −→ rj , α = HMAS2,

(3)

where π 0 is the initial planner proposal in HMAS-1, p is the central planner in HMAS-2, and πj is the revised assignment for robot rj . Equations (2) and (3) separate the prompt content from the communication path. The prompts create or strengthen a claim, while κα gives the claim the form normally consumed by the selected collaboration workflow. The attacker access setting η and communication architecture α are therefore two orthogonal dimensions. The former determines the attack

5

procedure, with η = E corresponding to Algorithm 1 and η = I corresponding to Algorithm 2, whereas the latter determines the carrier and dispatch path used under each architecture. Thus, both attack procedures can be instantiated under all three architectures:
Aη,α = Algorithmη κα , Dispatchα . (4) Definition IV.2 (Interaction Trace). For one attack episode, an interaction trace τ = (e1 , . . . , e|τ | ) is the ordered observable log generated by the attack workflow. Its events include externally issued prompts, produced carriers, dispatched M ESSAGE or F EEDBACK items, receiver responses, planner assignments when applicable, robot actions, relays, and task semantic records. Each event e ∈ τ is associated, when applicable, with its source and receiver, logical round, carrier type, propagation depth h(e), and unsafe action slot q(e). This trace records system level interactions and outcomes rather than hidden model reasoning traces. The external entry attack returns τE , while the privileged in-system attack returns the victim scoped trace τI |Rv .

Algorithm 1 External Entry Point Attack E (q) Input: Architecture α, task T , entry robot re , target slot q, program Pα,T Output: Attack trace τE 1: Initialize τE ← ∅ 2: ye ← Q UERY ROBOT(re , ps ) 3: τE ← τE ⊕ D ISPATCHα (re , ye , Bh ) 4: z ← C ARRIER P RODUCED(ye ) ∨ R ECIPIENT R ESPONDED(τE ) 5: if z ∧ ¬TARGET R EACHED(q, τE ) then 6: for k = 1 to Ba do 7: ye ← Q UERY ROBOT(re , pak ) 8: τE ← τE ⊕ D ISPATCHα (re , ye , Bh ) 9: if TARGET R EACHED(q, τE ) then 10: break 11: end if 12: end for 13: end if 14: if ¬TARGET R EACHED(q, τE ) then 15: for k = 1 to Bd do 16: ye ← Q UERY ROBOT(re , pd k) 17: τE ← τE ⊕ D ISPATCHα (re , ye , Bh ) 18: if TARGET R EACHED(q, τE ) then 19: break 20: end if 21: end for 22: end if 23: Apply up to Bℓ prompts from pℓ if the entry robot itself has an uncovered slot 24: return τE

A. External Entry Point Attack Algorithm 1 models an attacker who can only interact with one exposed robot re . The seed prompt asks re to restate an unsupported claim as internal coordination content, such as progress, inspection, risk, coverage, or handoff state. For compact notation, let C(y) denote whether C ARRIER P RODUCED returns true on y, and let R(τ ) denote whether R ECIPIENT R ESPONDED returns true on τ . The entry phase is ye(0) = Q UERY ROBOT(re , ps ), (0)

τE = D ISPATCHα (re , ye(0) , Bh ), (0)

zE = C(ye(0) ) ∨ R(τE ). Here zE is the technical gate for entry endorsement: it becomes true only when the outside claim is either emitted by re in a carrier valid for the architecture or produces an observable internal response after dispatch. Activation prompts are issued only after this gate is passed and the target slot is still uncovered. Let Tq (τ ) denote whether TARGET R EACHED returns true for (q, τ ), and let VT be the set of events that violate task constraints. The stopping condition is Tq (τ ) = 1{∃e ∈ τ : q(e) = q, e ∈ VT }. Thus, activation prompts test whether the converted claim can guide downstream coordination or action, while delegation prompts test whether an internal receiver can relay or reinforce the claim when no target effect is externally observed. The attacker relies only on the entry robot’s responses and observable collaboration outcomes, while each receiver uses its own local task context. This trace separates two effects. The seed stage measures whether the entry robot converts outside content into trusted E coordination, corresponding to OCAS . Let UE (τ ) denote semantic uptake by a receiver other than re in trace τ , including

acceptance, reuse, restatement, forwarding, or action on the claim. The cascade event used by the metric is E0 = 1[C(ye(0) )], (0)

E1 = 1[UE (τE )], Ecas = E0 E1 . E This matches the E0 (c)E1 (c) term in OCAS . Let τEpost contain the activation and delegation part of the trace, and let PE (τ ) denote post endorsement unsafe execution, constraint bypass, sensitive action, relay, or further propagation. The corresponding post endorsement event is JEpost = 1[PE (τEpost )], which is used conditionally after a successful cascade and a nonempty E post stage in OACT|CAS . The same trace is also used to compute Cinfo and Cact in Section V-B.

B. Privileged In-System Attack Algorithm 2 models a stronger attacker who controls one internal robot ra . The attacker no longer needs to convince ra to endorse the seed claim. Instead, it bypasses the gate zE and directly packages each claim as a legal message or feedback item from ra . Let Lα denote PACK L EGAL C ARRIER under architecture α. Then ya(k) = Lα (ra , pk ),

pk ∈ {ps } ∪ pa ∪ pdα .

Here pdα = pd for α ∈ {DMAS, HMAS1} and pdα = ∅ for α = HMAS2, matching the fact that privileged delegation is only used when peer relay is available. The function Lα preserves the normal syntax of the selected workflow: peer M ESSAGE in DMAS, peer M ESSAGE conditioned on π 0 in HMAS-1, and robot F EEDBACK in HMAS-2. The victim robots are R \ {ra }, while the planner, when applicable, remains an unchanged black box mediator. This setting specifically evaluates the trust risks introduced by legitimate

6

Algorithm 2 Privileged In-System Attack Input: Architecture α, task T , controlled robot ra , target slot q, program I Pα,T (q) Output: Victim only trace τI 1: Initialize τI ← ∅ and Rv ← R \ {ra } 2: ya ← PACK L EGAL C ARRIERα (ra , ps ) 3: τI ← τI ⊕ D ISPATCHα (ra , ya , Bh ) 4: if ¬TARGET R EACHED(q, τI ) then 5: for k = 1 to Ba do 6: ya ← PACK L EGAL C ARRIERα (ra , pak ) 7: τI ← τI ⊕ D ISPATCHα (ra , ya , Bh ) 8: if TARGET R EACHED(q, τI ) then 9: break 10: end if 11: end for 12: end if 13: if α ∈ {DMAS, HMAS1} ∧ ¬TARGET R EACHED(q, τI ) then 14: for k = 1 to Bd do 15: ya ← PACK L EGAL C ARRIERα (ra , pd k) 16: τI ← τI ⊕ D ISPATCHα (ra , ya , Bh ) 17: end for 18: end if 19: Remove source events of ra from information and action evaluation 20: return τI |Rv

internal identities and coordination interfaces after bypassing the external entry endorsement stage. For privileged traces, the victim scope is fixed as Rv = R \ {ra },

τIv = τI |Rv .

I Orecv records whether victim robots receive and respond to the injected internal carrier, or to the planner mediated I records whether assignment derived from it in HMAS-2. Oexec they execute an induced action, relay the carrier, or use it to guide subsequent coordination or task decisions. The controlled robot is excluded from victim scope, so success requires propagation beyond the compromised role.

the unsafe claim is evaluated together with a legitimate global plan. The attack therefore uses planner generated context to strengthen the apparent relevance of the claim without modifying or directly controlling the planner. • In HMAS-2, direct peer messaging is unavailable. The attack instead enters the coordination loop through robot F EEDBACK. Let Πθ denote the central planner mapping. The planner context becomes x′p = xp ⊕ F EEDBACK(m), after which the planner may generate a revised assignment πj = Πθ (x′p ) for a target robot. Consequently, downstream propagation is realized through planner mediated reassignment rather than peer relay. For secure item carrier matching, false C ARRIER R EPORT, H ANDOFF R EQUEST, or A PPROVE H ANDOFF records are treated as operational semantic effects even when they do not lead to an atomic movement action. V. E XPERIMENTS We organize our experimental evaluation around the following four research questions: • RQ1 (Attack Effectiveness): Can Communication Attacks Induce System-Level Unsafe Actions? • RQ2 (Architecture Impact): How Does Communication Architecture Affect Unsafe Information and Action Propagation? • RQ3 (Attack Regimes): How Do External Entry and Privileged In-System Attack Settings Differ in Propagation Risk? • RQ4 (Mitigation Insights): What Defense Insights Can Reduce Communication-Mediated Propagation? We first describe the experimental setup and evaluation metrics, and then present the results corresponding to each research question.

C. Attack Instantiation across Communication Architectures This subsection explains how Algorithms 1 and 2 are instantiated under each communication architecture. For a fixed attacker access setting η, the attack stages remain unchanged, while κα and Dispatchα determine how the claim enters and propagates through the corresponding communication workflow. Let Dα abbreviate Dispatchα and let ρα denote the rollout induced by the architecture. We use Dα (ri , m, Bh ) = ρα (κα (m), Bh ) to denote the architecture dependent rollout of a carrier, including receiver selection, response logging, action extraction, and nested internal delivery up to depth Bh . • In DMAS, the attack uses peer M ESSAGE as both the transport channel and the coordination signal. If a receiver accepts the claim at depth h < Bh , its subsequent message can instantiate another carrier κDMAS (m′ ), so the rollout records both direct action events and further peer delivery. The main conversion path is therefore m → xj,t → ⟨uj,t , m̃j,t ⟩ at each receiving robot. • In HMAS-1, the peer message is expressed as a continuation or refinement of the initial planner proposal π 0 . The receiver context becomes x′j,t = xj,t ⊕ π 0 ⊕ m, so

A. Setups 1) Experimental Environment: All experiments are conducted using NVIDIA Isaac Sim 4.5.0 1 and NVIDIA Isaac Lab 2.1.0 2 To enhance simulation fidelity and facilitate simulation to real transfer, we implement each atomic operation via standard ROS 2 Humble 3 communication primitives and dispatch it to the robot side control stack through the standard message based control interface used in real robot deployments [49]. For physical experiments, the system directly interfaces with official Unitree ROS 2 and SDK2 environments [50]. 2) Target LLMs: We evaluate representative target LLMs spanning three practical deployment categories. • Commercial voice interaction deployments: We include GPT-3.5-Turbo and Qwen3-235B-A22B to reflect LLM backends used in commercial Unitree Go2 systems. GPT-3.5-Turbo is selected following prior robotic jailbreaking work on the GPT-3.5 integrated Unitree Go2 [17]. According to our consultation with Unitree technical staff, Go2-Air models currently sold in the Chinese 1 https://docs.isaacsim.omniverse.nvidia.com/4.5.0/index.html 2 https://isaac-sim.github.io/IsaacLab/v2.1.0/index.html 3 https://docs.ros.org/en/humble/index.html

7

TABLE I OVERVIEW OF TASK SCENARIOS , ATOMIC ACTIONS , AND ARCHITECTURE INSTANTIATIONS . Atomic Actions

Violation Checks

Mv Msg Cam Hc

Ins OZM PCV FIV HCV MR

Tasks

Robot Team

Security Dimension

Task-1 Task-2 Task-3

Unitree Go2×6 Unitree Go2×3 Unitree Go2×5

Duty compliance Privacy Public security

✓ ✓ ✓

– – –

– – –

Task-4

Unitree Go2×6 Crazyflie×3

Cross-modal coordination

– –

✓ –

– ✓

Task-5

Unitree Go2×8

Trustworthy handoff matching

– –

✓ –

– ✓

UH ICM

DMAS HMAS-1 HMAS-2

Note. Task-1–Task-5 correspond to warehouse patrol, hospital, formation escort, warehouse air-ground patrol, and secure item-carrier matching, respectively. The Security Dimension column summarizes the safety-oriented design perspective and the main violation dimension stressed by each scenario. Under Atomic Actions, blue filled squares ( ) indicate enabled action and empty squares ( ) indicate unable action. Mv, Msg, Cam, Hc, and Ins denote M OVE, M ESSAGE, C AMERA, H ANDLE C ARGO, and I NSPECT, respectively. Under Violation Checks, red filled squares ( ) indicate enabled violation detectors and empty squares indicate detectors not used in the scenario. OZM, PCV, FIV, HCV, MR, UH, and ICM denote out-of-zone movement, privacy camera violation, formation integrity violation, hazardous cargo violation, misreporting, unauthorized handover, and item-carrier mismatch, respectively. Checkmarks (✓) indicate that the corresponding architecture is instantiated for the task, while dashes indicate that it is not instantiated.

market integrate Qwen3 as their large language model backend. We therefore include Qwen3-235B-A22B as a representative Qwen3 family model for domestic commercial robot deployments. • High capability planner configurations: We include GPT-4o as a stronger planner configuration under the same control interface. This choice follows recent embodied robot jailbreak studies that evaluate GPT-4o in robotic planning or embodied LLM settings [16], [17]. 3) Task Scenarios: Table I summarizes the task scenarios used to evaluate the proposed communication attacks. The scenarios cover security dimensions in which malicious or misaligned communication can lead to physically grounded violations, as shown in Fig 2 and Fig 3. Specifically, warehouse patrol (robots remain within assigned zones, with any boundary crossing treated as unauthorized behavior), hospital (visual sensing capabilities may be misused to collect or expose sensitive information), formation escort (hazardous cargo transport, where formation integrity must be preserved to prevent the carrier robot from being steered into unsafe or restricted areas), warehouse airground patrol (six Go2 ground robots and three Crazyflie drones jointly patrol floor level aisles and high shelf corridors, stressing cross modal coordination under zone constraints), and secure item-carrier matching (eight Go2 robots verify source items and receiver capacities through local I NSPECT evidence, targeting misreporting, unauthorized handover, and item-carrier mismatch). All environments share a common atomic action interface with task specific subsets. M OVE navigates to a target pose subject to scenario constraints; M ESSAGE sends textual coordination messages to a designated robot; C AMERA activates visual sensing; H ANDLE C ARGO executes hazardous cargo operations and is restricted to the designated carrier robot when enabled; and I NSPECT queries a named task target and returns local evidence for report or handoff decisions. B. Metrics Because embodied robot security and privacy evaluation still lacks unified protocols and shared metric standards [34], we

derive our metrics from and extend several lines of prior work. First, following embodied robot jailbreak studies, we avoid relying only on textual attack success or refusal outcomes and instead evaluate whether unsafe instructions are grounded into executable robot actions [16], [17]. Second, following multiagent resilience and infection analyses, we characterize not only whether an unsafe behavior occurs, but also how unsafe information is accepted, relayed, and amplified across robots during collaboration [51]. Accordingly, these considerations motivate trace metrics for obedience, information uptake, action propagation, and process dynamics. 1) Trace notation and scope: Based on the interaction trace defined in Section IV, we index each episode by logical rounds r = 1, . . . , R, where a round is an interaction from the attacker to the entry robot or an internal delivery between robots. The external entry setting uses an entry robot re ; the privileged in-system setting excludes the compromised attacker robot from victim information and action scopes. Let Ginfo (r) be the robots that have accepted, reused, restated, or forwarded unsafe information by round r, and Gact (r) be the task specific unsafe action slots observed by round r. Missing events are denoted by ⊥. 2) Obedience: For external entry point attacks, endorsement cascade obedience measures whether untrusted external content is endorsed into internal coordination. For case c, E0 (c) = 1 means re sends an internal message that endorses or incorporates the attacker’s claim during the endorsement stage, and E1 (c) = 1 means at least one robot other than re accepts, uses, restates, forwards, or acts on that claim. Thus

E OCAS =

KE 1 X E0 (c)E1 (c). KE c=1

(5)

After endorsement, activation obedience is the conditional success rate for activation or delegated propagation after a successful cascade. Let S2 (c) collect the follow-up activation and delegated activation stages; Jpost (c) = 1 if any stage two message induces execution, constraint bypass, sensitive action,

8

or further propagation, and Zc = E0 (c)E1 (c)1[|S2 (c)| > 0]: PKE Jpost (c)Zc E . (6) OACT|CAS = c=1 PKE c=1 Zc If the denominator is zero, the conditional score is reported as zero. The external entry obedience scores are computed from logged messages, target responses, and robot actions. For privileged in-system attacks, first hop victim obedience is measured by receiving and execution or relay rates. For malicious internal delivery mk , RECVI (k) = 1 if the target robot receives and responds, and EXECI (k) = 1 if it executes an induced action, produces a violation, sends a subsequent message, or triggers multi-hop internal delivery: K

I 1 X RECVI (k), KI

K

I 1 X EXECI (k). KI k=1 k=1 (7) 3) Information infectiousness: Information infectiousness measures message level information uptake before physical violation is required. For each judged internal delivery mj , Jinfo (j) = 1 if the target robot accepts, believes, restates, forwards, plans with, or otherwise uses the delivered unsafe claim; explicit rejection, authorization requests, or acknowledgement without semantic uptake are scored as zero. For judged deliveries Dinfo , X 1 Cinfo = Jinfo (j). (8) |Dinfo |

I Orecv =

I Oexec =

mj ∈Dinfo

In the external setting, Dinfo contains deliveries caused by the entry cascade; in the privileged setting, it contains victim side internal deliveries only. This message level denominator avoids saturation when a small robot team receives several semantically distinct unsafe messages. 4) Action infectiousness: Action infectiousness measures how far unsafe information becomes task specific unsafe execution. Each task defines unsafe action slots QT = {(a, i)}: e.g., movement violation slots for patrol tasks, movement and privacy camera slots for hospital, and semantic report or handoff slots for secure item-carrier matching. For event e, let q(e) be its slot, v(e) ∈ [0, 1] its normalized severity, and h(e) its internal propagation depth. In the external setting, entry self violation and direct induction from the entry robot to a victim have weight 1; deeper cascades use their hop depth. In the privileged setting, attacker self actions are excluded and victim events are weighted by direct or multi-hop depth. Hospital privacy camera events add one sequence step because they require sequential movement and camera behavior: ( max(1, h(e) + 1), q(e) = (camera, i), wT (e) = (9) max(1, h(e)), otherwise. Each slot keeps its maximum weighted severity, P sq = max [v(e)wT (e)] , e:q(e)=q

Cact =

q∈QT sq

|QT |

.

(10)

Since violations spanning several hops or stages can increase the numerator, Cact is a propagation strength metric and is not constrained to [0, 1].

5) Process profile and aggregation: Instead of reporting stealthiness as a single attacker message ratio, the process profile summarizes propagation dynamics with Rfirst viol = min{r : |Gact (r)| > 0}, Ninfo = maxr |Ginfo (r)|, Rinfo = min{r : |Ginfo (r)| = Ninfo }, Nact = maxr |Gact (r)|, Ract = min{r : |Gact (r)| = Nact }, and interaction cost (Rinternal , Rtotal ). Ratio metrics pool numerators and denominators across repeated runs; round and scope metrics are averaged after each run is extracted. C. Attack Effectiveness (RQ1) 1) Motivation: RQ1 examines whether communication attacks can move beyond an isolated robot response and cause system-level unsafe actions. We focus on Cact , Ninfo , and Nact , which measure action propagation strength, information spread scope, and unsafe action slot scope, respectively. The comparison covers both external entry attacks and privileged in-system attacks under the balanced prompt and the no safety constraint prompt. 2) Results: Table II gives the direct answer to RQ1: the evaluated attacks are effective system-level threats because unsafe information is not confined to the initially compromised interface. Across tasks, architectures, models, and prompt variants, Cact shows that unsafe communication becomes executable violations, Ninfo shows that the unsafe claim is accepted by robots, and Nact shows that the impact spans task defined unsafe action slots rather than a single response. The following analysis separates this effect by attack setting, prompt variant, and task context. Overall, the attacks consistently induce unsafe propagation across the evaluated systems. Under the balanced prompt, the average Cact is 0.484 for external entry attacks and 0.618 for privileged in-system attacks. Removing safety constraints raises these values to 0.645 and 0.878, respectively. This trend indicates that prompt-level safety constraints reduce attack strength, but they do not eliminate the communication channel through which unsafe information becomes coordinated action. For external entry attacks, the attacker only interacts with a single entry robot, yet the unsafe claim often spreads across the team after being endorsed as internal coordination content. In DMAS Task 1, Qwen3 reaches Cact = 0.97 with Ninfo = 6/6 and Nact = 5.6/6 under the balanced prompt. HMAS-1 Task 4 shows a similar pattern in the heterogeneous patrol setting: GPT-3.5-Turbo reaches Cact = 0.98, Ninfo = 9/9, and Nact = 8.8/9. These results show that a single exposed robot can act as a trusted carrier that turns external content into broad information uptake and unsafe action execution. Privileged in-system attacks are stronger and more stable because the malicious content is injected through a legitimate internal communication role. In DMAS, the privileged attack reaches an average Cact of 0.993 under the balanced prompt and 1.171 under the no safety constraint prompt. The effect is especially visible in Task 2, where privacy violations require both movement and camera use: all three models reach Cact ≥ 1.20 under the balanced prompt, and Cact = 1.50 under the no safety constraint prompt with full unsafe action

9

TASK-1: Warehouse_Patrol

(1) Warehouse Scene

(2) Initial Robot Positions

(3) Robot 0 Deviates from Position

(4) Robot 1 Becomes Infected and Jailbroken

(5) Infection Spreads to Multiple Robots

(6) Group Infection Successful

(2) Robot 1 Leaves the Supervised Area

(3) Robot 1 Enters a Restroom Privacy Area

(4) Group Infection Successful

(5) Robot 1 Activates the Camera Illicitly

(6) Robot 2 Activates the Camera Illicitly

DMAS

TASK-2: Hospital

(1) Hospital Scene

TASK-3: Formation_Escort

(1) Initial Escort Formation

(2) Robot 0 Deviates From the Formation

(3) Influence Spreads to Remaining Robots

(4) Robot Carrying a Bomb is Controlled

(5) Bomb Operation Occurs Within the Crowd

Fig. 2. DMAS task scenarios and unsafe propagation snapshots for Task-1–Task-3. The panels illustrate warehouse patrol, hospital privacy, and formation escort settings, showing initial robot states, induced movement or sensing violations, hazardous cargo operation, and multi-robot propagation through decentralized peer communication.

HMAS

TASK-4: Warehouse Air-Ground Patrol

(1) Warehouse AirGround Patrol Scene

(2) Three drones are responsible for top area

(3) Drone 0 conduct patrols of assigned areas

(4) Drone 0 was induced to leave assigned areas

(5) Drones respond to the abnormal area

(6) All drones enter the restricted area

TASK-5: Secure Item-Carrier Matching

(1) The first three subfigures show the Secure Item-Carrier Matching scene and its cargo areas, where robots identify the correct source and target items.

(2) The last three subfigures show robots moving from initial positions to the delivery point, where message exchange supports secure handoff verification.

Fig. 3. HMAS task scenarios and attack propagation snapshots for Task-4 and Task-5. The panels illustrate warehouse air-ground patrol and secure item-carrier matching, including drone and ground robot coordination, entry into restricted areas, identification of source and target items, and handoff verification through message exchange in hybrid architectures.

slot coverage Nact = 4/4. Values above 1 are expected here because Cact also captures staged and deeper propagation strength, not only the fraction of violated slots. The task results further show that attack success is not limited to one scenario type. Patrol and formation tasks exhibit high action spread in DMAS, while HMAS-1 Task 4 shows that air and ground coordination can also be compromised at large scope. Secure item-carrier matching is harder under the balanced prompt because the task requires semantic evidence and handoff consistency, but it remains vulnerable when safety constraints are weakened or when the attacker is already inside the system. For example, in HMAS-2 Task 5 with GPT-3.5Turbo, the external entry attack increases from Cact = 0.38 to 0.88 when moving from the balanced prompt to the no

safety constraint prompt, with Nact increasing from 4.6/12 to 10.6/12. Take-away 1: Unsafe communication becomes systemlevel action. The evaluated attacks show that unsafe content accepted by one robot can be reused by other robots and converted into task defined unsafe action slots. The risk is therefore not only whether an individual LLM planner refuses an unsafe request, but whether collaboration turns a communicated claim into operational state. D. Architecture Impact (RQ2) 1) Motivation: RQ2 shifts the analysis from whether unsafe propagation is possible to where the communication architec-

10

TABLE II C ORE ATTACK PROPAGATION RESULTS FOR OVERALL ATTACK EFFECTIVENESS . External entry point attack Task

HMAS-2

HMAS-1

DMAS

Arch.

Model

B Cact ↑

B B Ninfo ↑ Nact ↑

NS Cact ↑

Privileged in-system attack

NS NS Ninfo ↑ Nact ↑

B Cact ↑

B B Ninfo ↑ Nact ↑

NS Cact ↑

NS NS Ninfo ↑ Nact ↑

GPT-3.5-Turbo 0.90 (27/30) 0.27 (8/30) Task-1 GPT-4o Qwen3-235b-a22b 0.97 (29/30)

6/6 6/6 6/6

5.4 / 6 1.6 / 6 5.6 / 6

0.83 (25/30) 1.00 (30/30) 1.03 (31/30)

6/6 6/6 6/6

4.6 / 6 6/6 5.6 / 6

1.00 (25/25) 0.56 (14/25) 1.00 (25/25)

5/5 4.4 / 5 5/5

5/5 2.8 / 5 5/5

1.00 (25/25) 1.00 (25/25) 1.00 (25/25)

5/5 5/5 5/5

5/5 5/5 5/5

GPT-3.5-Turbo 0.40 (10/25) 0.48 (12/25) Task-2 GPT-4o Qwen3-235b-a22b 0.76 (19/25)

3/3 3/3 3/3

2/5 2.2 / 5 3.4 / 5

0.40 (10/25) 0.68 (17/25) 0.92 (23/25)

3/3 3/3 3/3

2/5 3.2 / 5 3.8 / 5

1.50 (30/20) 1.20 (24/20) 1.40 (28/20)

2/2 2/2 2/2

4/4 3.4 / 4 3.8 / 4

1.50 (30/20) 1.50 (30/20) 1.50 (30/20)

2/2 2/2 2/2

4/4 4/4 4/4

GPT-3.5-Turbo 0.33 (10/30) 0.73 (22/30) Task-3 GPT-4o Qwen3-235b-a22b 0.87 (26/30)

5/5 5/5 5/5

2/6 4.4 / 6 5.2 / 6

0.33 (10/30) 1.00 (30/30) 0.83 (25/30)

5/5 5/5 5/5

2/6 6/6 5/6

1.00 (25/25) 0.32 (8/25) 0.96 (24/25)

4/4 3.4 / 4 4/4

5/5 1.6 / 5 4/5

1.00 (25/25) 1.04 (26/25) 1.00 (25/25)

4/4 4/4 4/4

5/5 5/5 5/5

GPT-3.5-Turbo 0.98 (44/45) 0.69 (31/45) Task-4 GPT-4o Qwen3-235b-a22b 0.98 (44/45)

9/9 6.2 / 9 8.8 / 9

8.8 / 9 6.2 / 9 8.8 / 9

0.93 (42/45) 1.00 (45/45) 1.00 (45/45)

9/9 9/9 9/9

8.4 / 9 9/9 9/9

0.75 (30/40) 0.00 (0/40) 0.45 (18/40)

6.2 / 8 3.6 / 8 7/8

6/8 0/8 3.6 / 8

0.90 (36/40) 0.75 (30/40) 0.75 (30/40)

6.8 / 8 6.8 / 8 7/8

6.6 / 8 6/8 6/8

GPT-3.5-Turbo 0.45 (27/60) 0.17 (10/60) Task-5 GPT-4o Qwen3-235b-a22b 0.22 (13/60)

6.8 / 8 6.6 / 8 7.6 / 8

4.4 / 12 0.72 (43/60) 2 / 12 0.28 (17/60) 2 / 12 0.22 (13/60)

7.8 / 8 7.2 / 8 7.8 / 8

6.6 / 12 2.6 / 12 2.6 / 12

0.90 (45/50) 0.04 (2/50) 0.36 (18/50)

6/7 0.6 / 7 6/7

7 / 10 0.90 (45/50) 0.4 / 10 0.60 (30/50) 3.6 / 10 0.60 (30/50)

6/7 5.4 / 7 6/7

7 / 10 6 / 10 6 / 10

GPT-3.5-Turbo 0.16 (7/45) 0.20 (9/45) Task-4 GPT-4o Qwen3-235b-a22b 0.07 (3/45)

1.6 / 9 6.6 / 9 7.6 / 9

1.4 / 9 1.8 / 9 0.6 / 9

0.18 (8/45) 0.58 (26/45) 0.24 (11/45)

5.6 / 9 8.6 / 9 5.6 / 9

1.6 / 9 5.2 / 9 2.2 / 9

0.575 (23/40) 0.07 (3/40) 0.10 (4/40)

6/8 6/8 6/8

4.6 / 8 0.6 / 8 0.8 / 8

0.75 (30/40) 0.75 (30/40) 0.75 (30/40)

6/8 6/8 6/8

6/8 6/8 6/8

GPT-3.5-Turbo 0.38 (23/60) 0.02 (1/60) Task-5 GPT-4o Qwen3-235b-a22b 0.13 (8/60)

8/8 1/8 6.6 / 8

4.6 / 12 0.88 (53/60) 0.2 / 12 0.07 (4/60) 1.6 / 12 0.42 (25/60)

8/8 1.6 / 8 8/8

10.6 / 12 0.8 / 12 5 / 12

0.42 (21/50) 0.18 (9/50) 0.20 (10/50)

5/7 2.6 / 7 5/7

4.2 / 10 0.58 (29/50) 1.8 / 10 0.22 (11/50) 2 / 10 0.34 (17/50)

5/7 2.6 / 7 5/7

5.8 / 10 2.2 / 10 3.4 / 10

max reports the final robot-scope component of maximum Note. Cact is reported as score (weighted violation score / target unsafe-action slots). Ninfo max reports the final unsafe-action-slot scope of maximum unsafe-action spread; both N metrics are shown as observed scope information spread, and Nact / maximum scope. Superscripts B and NS denote Balanced and No Safety Constraint, respectively; superscript I denotes the privileged in-system attack setting. Higher values indicate stronger action propagation or broader spread. Task labels follow Table I.

Pooled Rate

DMAS 100% 90% 80% 70% 60% 50% 40% 30% 20%

Endorse

HMAS-1

HMAS-2

T1

Activate Info uptake (a) External Entry Attack Balanced Prompt

T3

T4

T5 HMAS-2-T4 98%

DMAS-T2 91% DMAS-T3 91% DMAS-T1 83% DMAS-T3 66% HMAS-2-T5 62% DMAS-T2 55% DMAS-T1 52% HMAS-1-T4 51% HMAS-1-T5 42% HMAS-2-T4 34%

T2

HMAS-2-T4 88%

HMAS-1-T4 79% DMAS-T2 78% HMAS-1-T5 71% DMAS-T1 65% DMAS-T3 63%

HMAS-1-T4 70% DMAS-T2 58% DMAS-T1 46% HMAS-1-T4 42% HMAS-2-T5 39% HMAS-1-T5 32% DMAS-T3 30%

HMAS-2-T4 57% HMAS-2-T5 45% HMAS-1-T5 42%

Endorse

Activate Info uptake (b) External Entry Attack No-Safety Prompt

Receive

Execute/relay Info uptake (c) Privileged In-system Attack Balanced Prompt

HMAS-2-T5 45%

Receive

Execute/relay Info uptake (d) Privileged In-system Attack No-Safety Prompt

Fig. 4. Architecture conditioned communication conversion by task. Each panel pools repeated runs for one prompt and attack setting. Pooled rate denotes the stage rate computed by summing the stage successes and stage trials across target models and repeated runs before taking their ratio. For external entry point attacks, the stages are entry endorsement, post endorsement activation, and downstream information uptake. For privileged in-system attacks, the stages are victim receipt, execution or relay, and information uptake. Line color denotes communication architecture, while marker shape and line style denote Task-1–Task-5 as defined in Table I; right side labels identify each architecture and task pair. Higher rates indicate that unsafe communication survives more stages of the conversion path specific to each architecture.

ture converts unsafe information into trusted operational state. The same attacker content can enter a system through direct peer messages, mixed role coordination, or planner feedback, and these structures create different endorsement, activation, and evidence requirements before a robot acts. We therefore use RQ2 to separate the architectural control surface: which architectures amplify unsafe claims after they are accepted, which architectures introduce a meaningful gate, and which trusted paths still remain exposed. 2) Results: Fig. 4 and Table II show that communication architecture changes the conversion shape of unsafe propagation, not only the final amount of harmful actions. DMAS shows that peer communication can become an authority channel when evidence checks are absent. In Fig. 4, DMAS has the weakest architectural bottleneck after the attacker reaches any robot. For external entry attacks, its average endorsement rate is 92.9% under the balanced

prompt and 96.7% under the no safety constraint prompt, and activation is 100% in both cases. The main drop occurs only at downstream information uptake, which still reaches 57.5% and 88.4%, respectively. Privileged in-system attacks show the same pattern: receipt is 100%, and execution or relay remains 96.2% to 100%. Consistent with this stage profile, averaging the table entries by architecture gives DMAS the largest overall Cact (0.895), with near complete final information scope and high unsafe action scope. Architecturally, DMAS turns a local unsafe acceptance into team state because peer messages carry operational authority without an additional evidence gate. HMAS-1 shifts risk into mixed role bridges rather than uniformly reducing it. HMAS-1 is not simply safer than DMAS; it is more selective. In the air and ground patrol task, external entry conversion remains high after endorsement: activation is 100% under both prompts, and information uptake rises from 51.4% with the balanced prompt to 69.6%

11

0.39 0.21

0.34

S1 S2 S3 A1/I1 A2/I2 A3/I3

GPT-4o

Qwen3-235B-A22B

GPT-3.5-Turbo

GPT-4o

Qwen3-235B-A22B 1.00 1.00 1.00 1.00 0.95

S1 S2 S3 A1/I1 A2/I2 A3/I3

S1 S2 S3 A1/I1 A2/I2 A3/I3

(e). Hospital

0.62

(c). Formation Escort

0.58

S1 S2 S3 A1/I1 A2/I2 A3/I3

(d). Warehouse_Patrol

0.96 1.00 1.00 1.00 0.84

0.83 1.00 1.00 0.99

0.95 1.00 1.00 0.84

S1 S2 S3 A1/I1 A2/I2 A3/I3

1.00 1.00 1.00 1.00 0.98

0.91 1.00 1.00 1.00 0.89 0.95

0.54

S1 S2 S3 A1/I1 A2/I2 A3/I3

0.7

0.88 1.00 1.00 1.00 0.97

0.54

0.86 0.61

0.96 1.00 1.00 1.00 0.82 0.66

GPT-3.5-Turbo

S1 S2 S3 A1/I1 A2/I2 A3/I3

S1 S2 S3 A1/I1 A2/I2 A3/I3

0.96 1.00 1.00 1.00 0.85

Qwen3-235B-A22B

S1 S2 S3 A1/I1 A2/I2 A3/I3

0.39

GPT-4o

Qwen3-235B-A22B

S1 S2 S3 A1/I1 A2/I2 A3/I3

(b). Hospital

0.65

GPT-3.5-Turbo

GPT-4o

1.00 1.00 1.00 1.00 0.95

S1 S2 S3 A1/I1 A2/I2 A3/I3

GPT-3.5-Turbo

0.38 0.57

S1 S2 S3 A1/I1 A2/I2 A3/I3

Qwen3-235B-A22B

1.00 1.00 1.00 1.00 0.92 0.75

0.5

S1 S2 S3 A1/I1 A2/I2 A3/I3

S1 S2 S3 A1/I1 A2/I2 A3/I3

GPT-4o

0.6

0.34 0.37

S1 S2 S3 A1/I1 A2/I2 A3/I3

1.00 1.00 1.00 1.00

Metric Value

No-Safety Prompt

0.9

1.00 1.00 1.00 1.00

1.00 1.00 1.00 0.83

0.75

0.97 1.00 1.00 1.00

GPT-3.5-Turbo

(a). Warehouse_Patrol

1.0 0.8 0.6 0.4 0.2 0.0

S1: Trust; S2: Propagation; S3: Violation

Privileged In-system Attack

Qwen3-235B-A22B

1.00 1.00 1.00 1.00 1.00

0.67 0.84

0.92 1.00 1.00 1.00

Metric Value

Balanced Prompt

1.0 0.8 0.6 0.4 0.2 0.0

GPT-4o

1.00 1.00 1.00 1.00 0.88

External Entry Attack

GPT-3.5-Turbo

S1 S2 S3 A1/I1 A2/I2 A3/I3

S1 S2 S3 A1/I1 A2/I2 A3/I3

S1 S2 S3 A1/I1 A2/I2 A3/I3

(f). Formation Escort

Fig. 5. Propagation metrics for external entry-point and privileged in-system attacks in DMAS. Panels group results by prompt setting, task, and target model; bars compare trust establishment (S1), information propagation (S2), and violation activation (S3). The stage labels map A1–A3 to the external entry-point E E E , respectively: A1 measures whether the entry robot converts an external claim into accepted internal coordination, metrics OCAS , OACT|CAS , and Cinfo A2 measures whether the post endorsement message triggers activation or delegated propagation, and A3 measures downstream unsafe claim uptake. I1–I3 I I I , respectively: I1 measures victim receipt of the injected internal carrier, I2 measures victim map to the privileged in-system metrics Orecv , Oexec , and Cinfo execution or relay, and I3 measures victim side unsafe claim uptake. Higher values indicate stronger conversion at the corresponding stage.

S1 S2 S3 A1/I1 A2/I2 A3/I3

(c). Warehouse Air-Ground Patrol

S1 S2 S3 A1/I1 A2/I2 A3/I3

S1 S2 S3 A1/I1 A2/I2 A3/I3

S1 S2 S3 A1/I1 A2/I2 A3/I3

(d). Secure Item-Carrier Matching

0.88 0.39 0.08 0

0.1 0.15

0.16

0.15 0

0

0.03

0.39

0.59

0.69 0.8

0.48

0.8

1.00 0.52

0.9

0.9 0.65

0.56

0.9

0.31

0.38

0.6

0.89

0.99

0.8 0.89

1.00 0.79

0.85

0.79

GPT-3.5-Turbo

GPT-4o

Qwen3-235B-A22B

GPT-3.5-Turbo

GPT-4o

Qwen3-235B-A22B

S1 S2 S3 A1/I1 A2/I2 A3/I3

S1 S2 S3 A1/I1 A2/I2 A3/I3

0.63 0.66

0.82

S1 S2 S3 A1/I1 A2/I2 A3/I3

0.17

0.15

0.04 0.14

0.14

0.14

S1 S2 S3 A1/I1 A2/I2 A3/I3

(c). Warehouse Air-Ground Patrol

0

0

S1 S2 S3 A1/I1 A2/I2 A3/I3

0.66

0.79 0.78

0.78 0.5

0.83

(b). Secure Item-Carrier Matching

0.58

0.97

0.97 0.48

0.73

0.97

1.0 0.8 0.6 0.4 0.2 0.0

0.33

Metric Value

No-Safety Prompt

1.00

0.83 0.46

0.69

1.00 0.29

0.6

0.65

1.00

1.00

0

0.08

0.53

0.44

0.54 0.7

1.00

1.00

1.00 0.73

1.00 1.00

1.00

S1 S2 S3 A1/I1 A2/I2 A3/I3

0.62

1.00 1.00 0.61 0.73

0.93 1.00 0.74 0.65

1.00 1.00

1.00

S1 S2 S3 A1/I1 A2/I2 A3/I3

S1 S2 S3 A1/I1 A2/I2 A3/I3

0.97

Qwen3-235B-A22B

S1 S2 S3 A1/I1 A2/I2 A3/I3

0.7

GPT-4o

Qwen3-235B-A22B

S1 S2 S3 A1/I1 A2/I2 A3/I3

1.00

GPT-3.5-Turbo

GPT-4o

S1 S2 S3 A1/I1 A2/I2 A3/I3

0.95 0.97

Qwen3-235B-A22B

GPT-3.5-Turbo

S1 S2 S3 A1/I1 A2/I2 A3/I3

0.56

GPT-4o

Qwen3-235B-A22B

(a). Warehouse Air-Ground Patrol 1.00

GPT-3.5-Turbo

S1: Trust; S2: Propagation; S3: Violation

Privileged In-system Attack

GPT-4o

S1 S2 S3 A1/I1 A2/I2 A3/I3

0.52

S1 S2 S3 A1/I1 A2/I2 A3/I3

1.00

S1 S2 S3 A1/I1 A2/I2 A3/I3

(b). Secure Item-Carrier Matching

0.83 1.00

S1 S2 S3 A1/I1 A2/I2 A3/I3

0.42

S1 S2 S3 A1/I1 A2/I2 A3/I3

1.0 0.8 0.6 0.4 0.2 0.0

0.24

Metric Value

Balanced Prompt

0.77 0.8

0.42

0.54 0.35

GPT-3.5-Turbo

0

0.05

0.08

0.64

1.00

0.93

1.00 0.78

1.00

1.00 0.48

0.38

0.3

0.26 0.22

External Entry Attack

Qwen3-235B-A22B

S1 S2 S3 A1/I1 A2/I2 A3/I3

0.82

Metric Value

No-Safety Prompt

GPT-4o

S1 S2 S3 A1/I1 A2/I2 A3/I3

(a). Warehouse Air-Ground Patrol

1.0 0.8 0.6 0.4 0.2 0.0

GPT-3.5-Turbo

0.69 0.69

1.00

Qwen3-235B-A22B

0.55

1.00 1.00

1.00 0.69 0.6

0.47

1.00 1.00

1.00 0.78

Metric Value

Balanced Prompt

1.0 0.8 0.6 0.4 0.2 0.0

S1: Trust; S2: Propagation; S3: Violation

Privileged In-system Attack

GPT-4o

1.00 1.00

External Entry Attack

GPT-3.5-Turbo

S1 S2 S3 A1/I1 A2/I2 A3/I3

(d). Secure Item-Carrier Matching

Fig. 6. Propagation metrics for external entry-point and privileged in-system attacks in HMAS-1.

Fig. 7. Propagation metrics for external entry-point and privileged in-system attacks in HMAS-2.

without safety constraints. This matches Table II, where Task 4 reaches broad action scope in several external entry cases. In contrast, secure item-carrier matching exposes a semantic evidence bottleneck: external endorsement stays around 30.6% to 38.4%, activation is only about 59%, and information uptake remains near 42%. Once the attacker is already inside the system, however, HMAS-1 again becomes highly permissive at the communication boundary, with 100% receipt and 94.7% to 100% execution or relay. The architectural lesson is that role mixing can filter attacks when task evidence is required, but it can also amplify unsafe claims when cross role coordination treats messages as sufficient state. HMAS-2 provides the strongest structural gate, but planner feedback remains a trusted conversion point. Under external entry attacks, HMAS-2 has the lowest endorsement rates in Fig. 4: 30.4% with the balanced prompt and 34.1% without safety constraints, followed by activation rates of 54.9% and 61.8%. This is reflected in the core table, where HMAS-2 has the lowest average Cact (0.344) among the three architectures.

The gate is not absolute, however. In privileged in-system attacks on the air and ground patrol task, receipt remains 92.8% to 98.9%, and execution or relay remains 87.7% to 97.9%. Secure item-carrier matching is more constrained, with execution or relay around 38.7% to 45.4%, because item and carrier decisions require more structured evidence. Thus HMAS-2 reduces broad external entry propagation, but unsafe planner feedback can still become an authoritative coordination signal unless evidence and authorization are bound to the feedback path. Take-away 2: Communication architecture governs how unsafe claims acquire authority and become systemlevel actions. DMAS enables direct amplification through peer exchange, HMAS-1 produces selective propagation through mixed planner–robot coordination, and HMAS-2 imposes the strongest structural bottleneck while retaining planner-mediated conversion through feedback. Architecture is therefore not merely a communication substrate; it deter-

12

TABLE III C ORE ATTACK PROPAGATION PROCESS RESULTS IN TRANSPOSED LAYOUT. Balanced Prompt

HMAS-2

HMAS-1

DMAS

Arch.

Task

Attack Setting

No Safety-Constrained Prompt

B Rfirst viol ↓

B Rinfo ↓

B Ract ↓

NS Rinfo ↓

NS Ract ↓

NS NS Rinternal /Rtotal ↑

GPT-3.5-turbo / One-robot GPT-3.5-turbo / In-system GPT-4o / One-robot Task-1 GPT-4o / In-system Qwen3-235b-a22b / One-robot Qwen3-235b-a22b / In-system

4.8 / 27.8 2 / 15 10 / 69.4 26 / 63.4 4.4 / 30.2 2 / 15

25 / 27.8 12 / 15 42 / 69.4 43.6 / 63.4 25 / 30.2 14 / 15

27.8 / 27.8 14 / 15 35.2 / 69.4 33.8 / 63.4 28.6 / 30.2 14 / 15

48.2% (13.4/27.8) 66.7% (10/15) 54.5% (37.8/69.4) 69.1% (43.8/63.4) 49.7% (15/30.2) 66.7% (10/15)

6.2 / 34.2 2 / 15 4 / 21 2 / 15 4 / 25.4 2 / 15

26 / 34.2 12.4 / 15 19 / 21 14 / 15 21.8 / 25.4 14 / 15

31 / 34.2 14 / 15 21 / 21 14 / 15 25.4 / 25.4 14 / 15

44.4% (15.2/34.2) 66.7% (10/15) 47.6% (10/21) 66.7% (10/15) 49.6% (12.6/25.4) 66.7% (10/15)

GPT-3.5-turbo / One-robot GPT-3.5-turbo / In-system GPT-4o / One-robot Task-2 GPT-4o / In-system Qwen3-235b-a22b / One-robot Qwen3-235b-a22b / In-system

37.8 / 54.2 2/6 6 / 66.4 30.6 / 34.6 5.2 / 27.2 4.4 / 8.4

17 / 54.2 3/6 17.6 / 66.4 12.4 / 34.6 17.6 / 27.2 7 / 8.4

53.2 / 54.2 5/6 42.2 / 66.4 33.6 / 34.6 22.8 / 27.2 7.4 / 8.4

46.1% (25/54.2) 66.7% (4/6) 50.3% (33.4/66.4) 66.5% (23/34.6) 50% (13.6/27.2) 66.7% (5.6/8.4)

43.2 / 53.2 2/6 7.2 / 28.6 2/6 4.8 / 25.2 2/6

16.6 / 53.2 3/6 16 / 28.6 3.8 / 6 15.2 / 25.2 3.8 / 6

52.2 / 53.2 5/6 20.6 / 28.6 5/6 18.6 / 25.2 5/6

45.9% (24.4/53.2) 66.7% (4/6) 49.7% (14.2/28.6) 66.7% (4/6) 50% (12.6/25.2) 66.7% (4/6)

GPT-3.5-turbo / One-robot GPT-3.5-turbo / In-system GPT-4o / One-robot Task-3 GPT-4o / In-system Qwen3-235b-a22b / One-robot Qwen3-235b-a22b / In-system

24.8 / 49 2 / 13.2 4 / 46.4 27 / 63.6 4 / 30.4 14 / 48

32.8 / 49 11 / 13.2 27.6 / 46.4 54.4 / 63.6 17.4 / 30.4 47 / 48

48 / 49 12.2 / 13.2 46.4 / 46.4 36 / 63.6 30.4 / 30.4 47 / 48

44.9% (22/49) 66.7% (8.8/13.2) 49.6% (23/46.4) 67.3% (42.8/63.6) 48.7% (14.8/30.4) 66.7% (32/48)

23.4 / 50.2 2 / 12 4 / 21.4 2 / 12.8 4 / 29.6 2 / 15

33 / 50.2 11 / 12 15 / 21.4 11 / 12.8 15 / 29.6 11 / 15

49.2 / 50.2 11 / 12 21.4 / 21.4 11.6 / 12.8 29.6 / 29.6 14 / 15

45% (22.6/50.2) 66.7% (8/12) 47.7% (10.2/21.4) 67.2% (8.6/12.8) 49.3% (14.6/29.6) 66.7% (10/15)

GPT-3.5-turbo / One-robot GPT-3.5-turbo / In-system GPT-4o / One-robot Task-4 GPT-4o / In-system Qwen3-235b-a22b / One-robot Qwen3-235b-a22b / In-system

5 / 42.8 2 / 18 5 / 63.8 – / 73.2 5 / 44.2 16.4 / 39.6

39.8 / 42.8 17 / 18 49.4 / 63.8 64.6 / 73.2 42.2 / 44.2 36.6 / 39.6

42.8 / 42.8 17 / 18 50.6 / 63.8 – / 73.2 44.2 / 44.2 38.6 / 39.6

57.9% (24.8/42.8) 66.7% (12/18) 55.8% (35.6/63.8) 67.2% (49.2/73.2) 59.7% (26.4/44.2) 66.7% (26.4/39.6)

5 / 50.6 2 / 18 5 / 41.8 2 / 18 5 / 42.2 2 / 18

47.6 / 50.6 17 / 18 39.2 / 41.8 15.8 / 18 38.6 / 42.2 15 / 18

50.6 / 50.6 17 / 18 41.8 / 41.8 17 / 18 42.2 / 42.2 17 / 18

56.5% (28.6/50.6) 66.7% (12/18) 59.3% (24.8/41.8) 66.7% (12/18) 58.8% (24.8/42.2) 66.7% (12/18)

GPT-3.5-turbo / One-robot GPT-3.5-turbo / In-system GPT-4o / One-robot Task-5 GPT-4o / In-system Qwen3-235b-a22b / One-robot Qwen3-235b-a22b / In-system

1 / 116.6 2 / 15 1 / 115.4 8 / 66.8 1 / 123.2 2 / 38.2

88 / 116.6 14 / 15 60.2 / 115.4 10 / 66.8 40.6 / 123.2 28.4 / 38.2

33.4 / 116.6 14 / 15 77.6 / 115.4 8 / 66.8 39.2 / 123.2 20.8 / 38.2

65.7% (76.6/116.6) 66.7% (10/15) 61.9% (71.4/115.4) 65.9% (44/66.8) 54.5% (67.2/123.2) 63.4% (24.2/38.2)

1 / 103.2 2 / 15 1 / 124.4 2 / 19 1 / 114.4 2 / 19

90.4 / 103.2 81.4 / 103.2 14 / 15 14 / 15 78.4 / 124.4 74.6 / 124.4 18.2 / 19 18 / 19 37.2 / 114.4 79.4 / 114.4 18 / 19 18 / 19

67.6% (69.8/103.2) 66.7% (10/15) 60.1% (74.8/124.4) 68.4% (13/19) 53% (60.6/114.4) 68.4% (13/19)

GPT-3.5-turbo / One-robot GPT-3.5-turbo / In-system GPT-4o / One-robot Task-4 GPT-4o / In-system Qwen3-235b-a22b / One-robot Qwen3-235b-a22b / In-system

17 / 71.4 10.4 / 20.8 8.8 / 75.6 18.67 / 44.8 9 / 78.4 40.5 / 45.2

6.4 / 71.4 17.4 / 71.4 20.8 / 20.8 20.8 / 20.8 58.8 / 75.6 17.8 / 75.6 38.8 / 44.8 18.67 / 44.8 72.8 / 78.4 9 / 78.4 41.2 / 45.2 40.5 / 45.2

28.6% (20.4/71.4) 50% (10.4/20.8) 33.6% (25.4/75.6) 50% (22.4/44.8) 28.1% (22/78.4) 50% (22.6/45.2)

16.8 / 66.4 2.4 / 12.4 5.4 / 59.6 2 / 12.4 11.6 / 69 2.4 / 13.2

47.6 / 66.4 12.4 / 12.4 57.8 / 59.6 12.4 / 12.4 66.6 / 69 13.2 / 13.2

21.2 / 66.4 12.4 / 12.4 51.4 / 59.6 12.4 / 12.4 47 / 69 13.2 / 13.2

28% (18.6/66.4) 50% (6.2/12.4) 34.6% (20.6/59.6) 50% (6.2/12.4) 29.6% (20.4/69) 50% (6.6/13.2)

GPT-3.5-turbo / One-robot GPT-3.5-turbo / In-system GPT-4o / One-robot Task-5 GPT-4o / In-system Qwen3-235b-a22b / One-robot Qwen3-235b-a22b / In-system

46.4 / 78 2 / 24 30 / 56.8 4.8 / 42.4 39.8 / 66.2 3.6 / 36

58 / 78 24 / 24 15.4 / 56.8 31.6 / 42.4 57.6 / 66.2 31.6 / 36

45.9% (35.8/78) 50% (12/24) 7% (4/56.8) 50% (21.2/42.4) 34.4% (22.8/66.2) 50% (18/36)

2 / 36 4 / 16.4 47 / 69.2 4.4 / 38.8 2 / 69 2 / 32

24.8 / 36 16.4 / 16.4 42.4 / 69.2 14 / 38.8 35.6 / 69 27.2 / 32

36 / 36 16.4 / 16.4 51 / 69.2 13.2 / 38.8 30.8 / 69 21.6 / 32

50% (18/36) 50% (8.2/16.4) 42.5% (29.4/69.2) 50% (19.4/38.8) 49.9% (34.4/69) 50% (16/32)

70 / 78 24 / 24 30 / 56.8 13.6 / 42.4 50.6 / 66.2 15.2 / 36

B B NS Rinternal /Rtotal ↑ Rfirst viol ↓

Note. Rows labeled One-robot and In-system correspond to the external entry point attack and privileged in-system attack settings, respectively. Rfirst viol denotes the first violation round, where lower values indicate earlier violation. Rinfo and Ract report only the round components from the informationspread and unsafe-action milestones, respectively. These three round-valued process metrics are shown as event round / total rounds. Rinternal /Rtotal reports the internal-interaction percentage followed by the source calculation data as internal/total rounds. Decimal round values are averages over repeated runs; individual episode rounds are integer-valued. Superscripts B and NS denote Balanced Prompt and No Safety-Constrained Prompt, respectively. Task labels follow Table I.

mines how trust, planning authority, and information flow transform local compromise into system behavior. E. Attack Regimes (RQ3) 1) Motivation: RQ3 examines how the adversarial access regime changes propagation risk after unsafe communication becomes possible. External entry attacks must first pass through an exposed robot before the unsafe claim can enter trusted coordination, whereas privileged in-system attacks start from a legitimate internal role and can directly target victim robots. We therefore compare the two settings in terms of propagation speed, final unsafe scope, and the share of interactions that occur inside the robot team. 2) Results: Table III and Figs. 5, 6, and 7 show that access regime changes the form of propagation risk, not only its magnitude. Privileged in-system attacks are faster and more internally carried, but external entry attacks expose a different risk: a low privilege attacker can use one exposed robot to

launder outside content into trusted coordination and then trigger system-level spread. Privileged in-system attacks reach full propagation milestones earlier, while external entry attacks can still cause early impact. Under the balanced prompt, privileged in-system attacks reach the maximum information and unsafe action scopes at Rinfo = 26.8 and Ract = 21.7, compared with 38.6 and 38.9 for external entry attacks. Under the no safety constraint prompt, the gap widens to 13.2/13.5 versus 37.3/41.7. However, external entry attacks are not merely slow failures: in HMAS-1 Task 5, external entry attacks produce the first violation at round 1 across all three models under both prompt settings, showing that a single exposed interface can create immediate task-level harm even when broader propagation takes longer. External entry attacks are especially strong at information laundering and downstream cascade. Their final information spread is high, with average Ninfo of 0.86 under the balanced

13

Privileged in-system attacks remain stronger on average and more concealed inside trusted communication. From Table II, average Cact rises from 0.484 to 0.618 under the balanced prompt and from 0.645 to 0.878 under the no safety constraint prompt when moving from external entry to privileged in-system attacks. The same pattern appears in Nact , which rises from 0.47 to 0.54 and from 0.62 to 0.79. Privileged in-system attacks also keep a larger internal interaction share, 61.9% to 62.1% on average, compared with 46.4% to 48.5% for external entry attacks. Thus, their main advantage is not only higher strength, but also that more of the attack proceeds through trusted robot-to-robot channels. The access gap mainly comes from the entry endorsement bottleneck. Fig. 5 shows that DMAS is already permissive for external entry attacks, with 0.929 trust establishment and 1.000 information propagation under the balanced prompt, and violation activation rising from 0.638 to 0.901 after safety constraints are removed. In contrast, Figs. 6 and 7 show that external entry attacks lose more attempts at the entry boundary: HMAS-1 external entry trust establishment is 0.455 under the balanced prompt and 0.591 under the no safety constraint prompt, while privileged in-system attacks reach 1.000 in both settings; HMAS-2 external entry reaches only 0.304 trust establishment and 0.472 information propagation under the balanced prompt, compared with 0.796 and 0.654 for privileged in-system attacks. The key distinction is therefore structural: external entry attacks depend on successful entry endorsement, whereas privileged in-system attacks bypass that bottleneck. Take-away 3: Access regime changes both timing and bottleneck. External entry point attacks spend early rounds on entry endorsement: the outside claim must first be converted by the exposed robot into internal coordination before broader propagation can occur. Once this bottleneck is passed, the claim can still cause rapid or wide downstream effects, but full information and action scope usually emerges later through activation and delegation. Privileged in-system attacks bypass the entry endorsement stage, so their bottleneck shifts to whether victim robots or the planner execute, relay, or verify the injected internal carrier.

Warehouse Patrol DMAS

Hospital DMAS

Formation Escort DMAS

Warehouse Air-Ground Patrol HMAS-1/2

GPT-3.5-Turbo

81.7 / 35

73.3 / 76.7

90 / 82.5

80 / 61.2

-3.3

+7.5

GPT-4o

100 / 100

100 / 100

100 / 100

100 / 100

98.3 / 55

96.7 / 100

100 / 100

98 / 82

GPT-3.5-Turbo

88.3 / 57.5

66.7 / 73.3

90.6 / 90

80.1 / 70.3

+0.0

+43.3 +30.8

+0.0 -3.3 -6.7

+0.0 +0.0 +0.6

+0.0

+16.0

GPT-4o

96.7 / 65.8

100 / 100

99.4 / 98.9

98.6 / 86.1

94.2 / 64.2

100 / 100

100 / 100

97.7 / 85.7

GPT-3.5-Turbo

86.7 / 51.7

70 / 66.7

91.7 / 94.4

81 / 66.2

GPT-4o

100 / 87.5

63.3 / 53.3

100 / 100

85.3 / 76.3

Qwen3-235B-A22B

100 / 88.3

83.3 / 76.7

100 / 100

93.3 / 86

GPT-3.5-Turbo

73.3 / 43.3

100 / 96.7

100 / 100

89.3 / 76

GPT-4o

96.7 / 91.7

100 / 100

100 / 100

98.7 / 96.7

Qwen3-235B-A22B

93.3 / 81.7

100 / 100

100 / 100

97.3 / 92.7

GPT-3.5-Turbo

61.1 / 27.8

93.3 / 93.3

96.7 / 98

81.1 / 68

GPT-4o

100 / 65.6

90 / 96.7

100 / 100

96 / 84.9

Qwen3-235B-A22B

100 / 67.8

96.7 / 93.3

100 / 100

98.7 / 84.4

Ssec

Scap

Scmp

Ssp

+30.0 +35.0 +12.5 +11.7 +30.0 +5.0

+11.7 +33.3 +34.4 +32.2

+0.0 +0.0 +3.3

+10.0 +6.7 +3.3 +0.0 +0.0 +0.0 -6.7

+3.3

+0.5 +0.0 -2.8

+0.0 +0.0 +0.0 +0.0 +0.0 -1.3

+0.0 +0.0

40

+9.8

Qwen3-235B-A22B

+30.8

50

+18.8

Qwen3-235B-A22B

Secure Item-Carrier Matching HMAS-1/2

+46.7

+12.5

30

+12.0 +14.8 +9.0

20

+7.3

+13.3

S = Swith Swithout

prompt and 0.92 under the no safety constraint prompt, compared with 0.79 and 0.86 for privileged in-system attacks. This is why external entry attacks can be competitive in final action scope after endorsement succeeds. In HMAS-1 Task 4, external entry attacks outperform privileged in-system attacks under the balanced prompt: GPT-3.5-Turbo reaches Cact = 0.98 and Nact = 8.8/9, while the privileged setting reaches 0.75 and 6/8; GPT-4o reaches 0.69 and 6.2/9, while the privileged setting produces no unsafe action. Under the no safety constraint prompt, external entry attacks in the same task reach Cact = 0.93 to 1.00 with Nact = 8.4/9 to 9/9. These cases show that external entry attacks can be highly damaging once the entry robot converts the outside instruction into trusted internal content.

10

+2.0 +4.7

+13.1

0

+11.1 +14.2

10

Fig. 8. Prompt-layer mitigation effect on system-prompt scores. Rows group task scenarios, communication architectures, and target models; columns report Ssec , Scap , Scmp , and Ssp . Each cell shows Swith /Swithout followed by ∆S = Swith −Swithout , where Swith uses task-specific safety constraints and Swithout removes that section.

F. Mitigation Insights (RQ4) 1) Motivation: RQ4 focuses on reducing the risk that unsafe information becomes propagated unsafe action. The risk has two surfaces: the local policy boundary, where a robot decides whether an instruction violates task constraints, and the communication boundary, where an unverified claim can be repackaged as trusted coordination. We therefore examine two mitigation attempts: prompt layer task constraints, measured by contrasting the balanced and no safety constraint prompts, and a communication layer method, Claim Provenance and Verification Gate (CPV Gate), that annotates claim provenance before downstream reuse. The goal is not to claim a complete defense, but to identify where future defenses should intervene. 2) Results: Fig. 8 first evaluates the prompt layer. Adding task specific safety constraints raises the average Ssec from 65.52 to 91.35, a 25.83 point gain, while Scap changes only from 88.45 to 88.89 and Scmp from 97.59 to 97.89. Thus, prompt constraints mainly improve the robot’s local boundary judgment for unsafe objectives rather than changing its general formatting or benign collaboration capability. Prompt safety improves local behavior, but not evidence flow across the system. Table II shows that high propagation can remain after unsafe content is repackaged as internal coordination. Under the balanced prompt, Qwen3 still reaches Cact = 0.97, Ninfo = 6/6, and Nact = 5.6/6 in DMAS Task 1, and Cact = 0.98, Ninfo = 8.8/9, and Nact = 8.8/9 in HMAS-1 Task 4. Task 5 shows the same limitation for semantic evidence: despite the largest average Ssec gain, 33.33 points, GPT-3.5-Turbo remains at Ssec = 61.11 with safety constraints. Prompt constraints can make a single response safer, but they do not force later messages, reports, or approvals to carry verifiable evidence. To target this gap, CPV Gate verifies each communication carrier m before reuse: dm = VCPV (m, ξm ) = (am , zm , χm , em ), where ξm is message metadata, am is the policy decision, zm ∈ {U, Rq, C, V} is the verification state,

14

TABLE IV CPV G ATE MITIGATION EFFECTS UNDER THE BALANCED PROMPT. D ELTA ANNOTATIONS COMPARE CPV WITH BASELINE ; ARROWS INDICATE DIRECTION . Arch.

Task Attack

Cclaim

Pviol

Nslot

nU /nRq /nC /nV

Baseline 44.4% CPV 50.0% ↑ 5.6%

93.3% 16 44.4% ↓ 48.9% 8 ↓ 50.0%

101/0/2/28

Privileged

Baseline 0.0% 100.0% 15 CPV 38.9% ↑ 38.9% 55.6% ↓ 44.4% 10 ↓ 33.3%

3/84/2/8

External entry

Baseline 41.7% 87.5% 21 CPV 54.2% ↑ 12.5% 37.5% ↓ 50.0% 9 ↓ 57.1%

115/0/1/19

Privileged

Baseline 87.5% CPV 87.5% ± 0.0%

66.7% 16 54.2% ↓ 12.5% 13 ↓ 18.8%

1/105/1/37

Baseline 27.8% 33.3% 6 External entry CPV 16.7% ↓ 11.1% 11.1% ↓ 22.2% 2 ↓ 66.7%

28/0/12/0

DMAS Task-1

HMAS-1 Task-4

HMAS-2 Task-5

Setting

External entry

Privileged

Baseline 100.0% CPV 94.4% ↓ 5.6%

38.9% 7 16.7% ↓ 22.2% 3 ↓ 57.1%

– – – – – –

63/0/0/0

Note. All rows use Qwen3 under the balanced prompt. Baseline has no message verification; CPV uses CPV Gate in annotate mode. Cclaim , Pviol , and Nslot denote downstream claim match, any violation rate, and pooled violated unsafe action slots across three runs. Delta annotations compare CPV with Baseline: rate-column deltas use absolute percentage point differences, while Nslot deltas use relative percentage changes from the Baseline slot count. nU /nRq /nC /nV gives unverified, requires local check, contradictory, and verified decision counts.

χm is the claim type, and em is a local inspection or verified planner evidence reference when available. In annotate mode, verified carriers remain unchanged, while carriers without verification become m̃ = Ann(dm )∥m, where Ann(dm ) warns that the claim is not conclusive evidence of completion, clearance, authorization, local observation, or approval. We hook this verifier into peer M ESSAGE delivery for DMAS and HMAS-1, and into planner feedback context for HMAS-2. CPV reduces the conversion of unsafe claims into unsafe actions. Table IV reports a focused Qwen3 study using one task per architecture and both access regimes. Across the six architecture and access pairs, Pviol falls from 70.0% under Baseline to 36.6% under CPV, and Nslot falls from 81 to 45. The largest absolute unsafe-rate decreases appear in the external-entry DMAS and HMAS-1 cases, where Pviol drops from 93.3% to 44.4% and from 87.5% to 37.5%, respectively. HMAS-2 Task 5 also follows the same direction: external entry attacks drop from 33.3% to 11.1% Pviol and from 6 to 2 violated slots, while privileged attacks drop from 38.9% to 16.7% and from 7 to 3 slots. Thus CPV changes whether downstream robots or planners can treat a communicated claim as verified operational state. Under external entry attacks, verification mainly blocks outside claims from becoming trusted internal state. DMAS and HMAS-1 are dominated by unverified decisions, 101/0/2/28 and 115/0/1/19, because an outside note is laundered through peer communication. The key defense point is therefore provenance preservation: peer messages should not become trusted zone or coordination status without local support. HMAS-2 differs because the external claim enters planner mediated secure item matching; its mix 28/0/12/0 contains more contradictory secure record decisions, so the defense should bind replanning updates to inspect and authorization records. The increases in Cclaim for DMAS Task 1 and HMAS-1 Task 4 are consistent with annotate mode: a robot may restate that a message claims a zone is clear, while also marking it as unverified, so the claim is mentioned but

no longer becomes action authority. Under privileged attacks, verification should focus on evidence, not only identity. In DMAS and HMAS-1, the attacker is already inside the communication graph, so CPV mostly asks whether the internal message has local evidence. This produces Rq dominated mixes, 3/84/2/8 and 1/105/1/37, suggesting that direct peer and mixed role defenses should require status updates with evidence rather than trusting internal senders by default. HMAS-2 again follows a planner feedback pattern: the privileged case is almost entirely unverified, 63/0/0/0, so the defense emphasis is not only who sent the feedback, but whether the planner can link it to verified item, carrier, and handoff evidence. Take-away 4: Mitigation should verify claims before reuse. Prompt constraints reduce individual robot risk, while CPV Gate shows that lightweight provenance annotation can reduce unsafe action conversion without shutting down communication. Future defenses should attach evidence to peer messages, preserve provenance across mixed role handoffs, and bind planner updates to inspect results and authorization records. VI. D ISCUSSION A. From Adversarial Instructions to Communicated Claims Prior studies on LLM controlled robots often ask whether an adversarial instruction can bypass local constraints, be transformed into a plan, or be grounded into executable robot actions [16], [17], [20], [21]. Our results suggest that embodied multi-robot systems require a broader security unit of analysis. The adversarial object is not only the original instruction, but also the communicated claim that later describes task state, local observation, completion, clearance, handoff, or approval. Once such a claim enters coordination, downstream robots may treat it as operational state even when it is not supported by local evidence. This shift explains why attacks can survive local refusal policies. A robot may reject an unsafe request when it appears as a direct instruction, but the same objective can be accepted after being rewritten as a progress report, risk notice, or feedback item. B. Verifying Claims Instead of Trusting Senders Experiments have shown that the sender’s identity alone cannot serve as a reliable criterion for trust. In external entry point attacks, outside content can be laundered through a legitimate robot before reaching other agents. In privileged in-system attacks, the attacker already controls a legitimate internal role. In both cases, the message may appear to come from a trusted source while the claim itself remains unsupported. A more secure design should bind trust to the claim rather than only to the sender. Natural language coordination often mixes observations, suggestions, warnings, progress reports, approvals, and delegation requests in one channel; if the protocol does not distinguish these meanings, a downstream LLM planner may consume a weak statement as an authority signal. Each communicated claim should therefore specify

15

its semantic role, provenance, evidence source, authorization state, scope, and freshness, so that different coordination contents are not consumed with the same authority. This gives the communication boundary observable structure before the text reaches the LLM planner. C. Propagation Metrics for Embodied Security Our evaluation indicates that single response metrics are insufficient for embodied multi-robot security. A robot may refuse the initial adversarial request, while a later message still causes another robot to accept, reuse, relay, or execute the same unsafe objective. Conversely, an unsafe claim may spread without immediate physical violation, creating latent risk for later rounds [1], [34]. Security evaluation should therefore measure propagation as a process and distinguish information compromise from action compromise. Useful metrics should capture information uptake, reuse, relay, first violation round, affected robot scope, affected action slot scope, and the path from message to execution. Information uptake reveals whether a claim has entered shared operational context, while action scope reveals whether it has changed physical or semantic task execution. This process view is important for embodied systems, because the final harm is not textual agreement but the conversion of communicated claims into movement, sensing, manipulation, or handoff decisions. Keeping these stages separate also helps identify where a defense should intervene: at entry endorsement, message reuse, planner feedback, or action dispatch. D. Limitations and Future Work 1) Interactive Architecture Mapping: This work assumes that the external attacker knows only the coarse communication architecture. A more capable attacker may first interact with the exposed robot to infer a partial communication graph, including reachable robots, carrier types, planner presence, and the feasibility of inducing target actions. Yet, this requires a separate topology inference technique, such as CIA [45], to recover hidden communication topology from observable agent outputs, which is beyond the scope of this work. Future work should integrate this mapping stage into the attack model, allowing target and carrier selection to be guided by the inferred graph rather than a fixed architecture assumption. 2) Real Robot Validation: Real deployments introduce perception noise, localization drift, network delay, actuator limits, human interruption, and environmental uncertainty. Future work should validate these attacks and defenses on larger real robot teams, especially for privacy sensing, cargo handling, and secure handoff tasks. VII. C ONCLUSION This paper studies security risks in LLM controlled multirobot systems through communication attacks across DMAS, HMAS-1, and HMAS-2. We formulate the External Entry Point Attack and the Privileged In-System Attack to model adversaries with different access levels, and instantiate them through the communication paths of each architecture. We

further develop metrics derived from interaction traces to characterize information uptake, unsafe action induction, propagation scope, and interaction dynamics. Experiments show that unsafe claims can propagate through normal coordination, acquire operational influence under different architectures and access settings, and eventually become task defined unsafe actions. Prompt constraints reduce local risk, while CPV Gate further demonstrates the importance of verifying provenance and supporting evidence before communicated claims are reused. We hope this work draws attention to the security risks introduced by communication in LLM controlled multi-robot systems and motivates further research on secure and verifiable collaboration. R EFERENCES [1] Z. Huang, Z. Liu, M. Luo, W. Wu, and Z. Cai, “Propagating unsafe actions in llm controlled multi-robot collaboration via single robot compromise,” arXiv preprint arXiv:2605.15641, 2026. [2] C. H. Song, J. Wu, C. Washington, B. M. Sadler, W.-L. Chao, and Y. Su, “Llm-planner: Few-shot grounded planning for embodied agents with large language models,” in Proceedings of the IEEE/CVF international conference on computer vision, 2023, pp. 2998–3009. [3] A. Szot, M. Schwarzer, H. Agrawal, B. Mazoure, R. Metcalf, W. Talbott, N. Mackraz, R. D. Hjelm, and A. T. Toshev, “Large language models as generalizable policies for embodied tasks,” in ICLR, 2024. [4] R. Mon-Williams, G. Li, R. Long, W. Du, and C. G. Lucas, “Embodied large language models enable robots to complete complex tasks in unpredictable environments,” Nature Machine Intelligence, pp. 1–10, 2025. [5] A. Gupta, S. Savarese, S. Ganguli, and L. Fei-Fei, “Embodied intelligence via learning and evolution,” Nature communications, vol. 12, no. 1, p. 5721, 2021. [6] J. Liang, W. Huang, F. Xia, P. Xu, K. Hausman, B. Ichter, P. Florence, and A. Zeng, “Code as policies: Language model programs for embodied control,” in 2023 IEEE International conference on robotics and automation (ICRA). IEEE, 2023, pp. 9493–9500. [7] N. Obayashi, A. Abdulali, F. Iida, and J. Hughes, “Embodied intelligence paradigm for human-robot communication,” Science Robotics, vol. 10, no. 105, p. eads8528, 2025. [8] C. Bartolozzi, G. Indiveri, and E. Donati, “Embodied neuromorphic intelligence,” Nature communications, vol. 13, no. 1, p. 1024, 2022. [9] X. Su, J. Xu, O. van Kaick, K. Xu, and R. Hu, “Imr-llm: Industrial multi-robot task planning and program generation using large language models,” arXiv preprint arXiv:2603.02669, 2026. [10] Y. Chen, J. Arkin, Y. Zhang, N. Roy, and C. Fan, “Scalable multi-robot collaboration with large language models: Centralized or decentralized systems?” 2024 IEEE International Conference on Robotics and Automation (ICRA), pp. 4311–4317, 2023. [Online]. Available: https://api.semanticscholar.org/CorpusID:263143275 [11] J. Chen, C. Yu, X. Zhou, T. Xu, Y. Mu, M. Hu, W. Shao, Y. Wang, G. Li, and L. Shao, “Emos: Embodiment-aware heterogeneous multirobot operating system with llm agents,” in International Conference on Learning Representations, vol. 2025, 2025, pp. 56 670–56 690. [12] Z. Mandi, S. Jain, and S. Song, “Roco: Dialectic multi-robot collaboration with large language models,” in 2024 IEEE International Conference on Robotics and Automation (ICRA). IEEE, 2024, pp. 286–299. [13] K. Liu, Z. Tang, D. Wang, Z. Wang, X. Li, and B. Zhao, “Coherent: Collaboration of heterogeneous multi-robot system with large language models,” in 2025 IEEE International Conference on Robotics and Automation (ICRA). IEEE, 2025, pp. 10 208–10 214. [14] P. Ladisa, H. Plate, M. Martinez, and O. Barais, “Sok: Taxonomy of attacks on open-source software supply chains,” in 2023 IEEE Symposium on Security and Privacy (SP). IEEE, 2023, pp. 1509–1526. [15] J. R. Asl, M. H. Rafiei, M. Alohaly, and D. Takabi, “A semantic, syntactic, and context-aware natural language adversarial example generator,” IEEE Transactions on Dependable and Secure Computing, vol. 21, no. 5, pp. 4754–4769, 2024. [16] H. Zhang, C. Zhu, X. Wang, Z. Zhou, C. Yin, M. Li, L. Xue, Y. Wang, S. Hu, A. Liu et al., “Badrobot: Jailbreaking embodied llm agents in the physical world,” in The Thirteenth International Conference on Learning Representations, 2025.

16

[17] A. Robey, Z. Ravichandran, V. Kumar, H. Hassani, and G. J. Pappas, “Jailbreaking llm-controlled robots,” in 2025 IEEE International Conference on Robotics and Automation (ICRA). IEEE, 2025, pp. 11 948– 11 956. [18] X. Wang, B. Li, Z. Shao, A. Liu, G. Xu, and S. Ji, “Polyjailbreak: Cross-modal jailbreaking attacks on black-box multimodal llms,” IEEE Transactions on Dependable and Secure Computing, 2026. [19] R. Jiao, S. Xie, J. Yue, T. SATO, L. Wang, Y. Wang, Q. A. Chen, and Q. Zhu, “Can we trust embodied agents? exploring backdoor attacks against embodied llm-based decision-making systems,” in The Thirteenth International Conference on Learning Representations, 2025. [20] X. Lu, Z. Huang, X. Li, W. Xu et al., “Poex: Understanding and mitigating policy executable jailbreak attacks against embodied ai,” arXiv preprint arXiv:2412.16633, 2024. [21] X. Huang, Q. Yang, L. Shen, Z. Ma, and Y. Zheng, “Jailbreaking embodied llms via action-level manipulation,” in Proceedings of the 2026 ACM/IEEE International Conference on Embedded Artificial Intelligence and Sensing Systems, 2026, pp. 1057–1071. [22] Y. Xu, Y. Bao, S. Wang, and T. Zhang, “Function interaction risks in robot apps: Analysis and policy-based solution,” IEEE Transactions on Dependable and Secure Computing, vol. 21, no. 4, pp. 4236–4253, 2024. [23] Y. Xu, F. Xie, C. Lyu, J. Liu, Y. Ji, and N. Shiratori, “Naradv: Naturalstyle physical adversarial attack on traffic sign detection for autonomous vehicles,” IEEE Transactions on Dependable and Secure Computing, 2025. [24] S. Yuan, G. Xu, H. Li, R. Zhang, H. Cao, X. Qian, T. Ni, Q. Zhao, and Y. Fang, “No trespassing: Ground-view adversarial patches for privacyaware management in cots robot vacuum cleaner,” IEEE Transactions on Dependable and Secure Computing, 2025. [25] J.-T. Huang, J. Zhou, T. Jin, X. Zhou, Z. Chen, W. Wang, Y. Yuan, M. Lyu, and M. Sap, “On the resilience of llm-based multi-agent collaboration with faulty agents,” in International Conference on Machine Learning. PMLR, 2025, pp. 26 202–26 226. [26] K. Huang, Y. Wei, T. Zhang, Z. Yang, L. Zhou et al., “Whispering agents: A event-driven covert communication protocol for the internet of agents,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 40, no. 37, 2026, pp. 31 185–31 192. [27] R. Shahroz, Z. Tan, S. Yun, C. Fleming, and T. Chen, “Agents under siege: Breaking pragmatic multi-agent llm systems with optimized prompt attacks,” in Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 2025, pp. 9661–9674. [28] D. Lee, M. Tiwari, and B. Miranda, “Prompt infection: Llm-to-llm prompt injection within multi-agent systems,” in European Symposium on Research in Computer Security. Springer, 2025, pp. 511–520. [29] H. Xu, W. Zhang, Z. Wang, F. Xiao, R. Zheng, Z. Ba, and K. Ren, “Redagent: an autonomous agent for context-aware red teaming of llm jailbreaks,” IEEE Transactions on Dependable and Secure Computing, 2026. [30] X. Gu, X. Zheng, T. Pang, C. Du, Q. Liu, Y. Wang, J. Jiang, and M. Lin, “Agent smith: A single image can jailbreak one million multimodal llm agents exponentially fast,” Proceedings of Machine Learning Research, vol. 235, pp. 16 647–16 672, 2024. [31] P. He, Y. Lin, S. Dong, H. Xu, Y. Xing, and H. Liu, “Red-teaming llm multi-agent systems via communication attacks,” in Findings of the Association for Computational Linguistics: ACL 2025, 2025, pp. 6726– 6747. [32] Y. Zhang, S. Yang, C. Bai, F. Wu, X. Li, Z. Wang, and X. Li, “Towards efficient llm grounding for embodied multi-agent collaboration,” in Findings of the Association for Computational Linguistics: ACL 2025, 2025, pp. 1663–1699. [33] X. Guo, K. Huang, J. Liu, W. Fan, N. Vélez, Q. Wu, H. Wang, T. L. Griffiths, and M. Wang, “Embodied llm agents learn to cooperate in organized teams,” in Language Gamification-NeurIPS 2024 Workshop, 2024. [34] X. Gong, C. Chen, J. Liu, Q. Wang, and K.-Y. Lam, “Sok: Security and privacy of foundation-model-powered robots,” arXiv preprint arXiv:2606.16788, 2026. [35] L. Zhao, S. Hu, Q. Wang, J. Jiang, C. Shen, X. Luo, and P. Hu, “Shielding collaborative learning: Mitigating poisoning attacks through client-side detection,” IEEE Transactions on Dependable and Secure Computing, vol. 18, no. 5, pp. 2029–2041, 2020. [36] Z. Liu, Z. Wang, T. Zhou, Y. Tang, Y. Luo, and Z. Cai, “Riskaware privacy preservation for llm inference,” IEEE Transactions on Information Forensics and Security, 2026. [37] Y. Cheng, J. Ma, Z. Liu, Z. Li, Y. Wu, C. Dong, and R. Li, “A privacy-preserving and reputation-based truth discovery framework in

mobile crowdsensing,” IEEE Transactions on Dependable and Secure Computing, vol. 20, no. 6, pp. 5293–5311, 2023. [38] M. Ahn, A. Brohan, N. Brown, Y. Chebotar, O. Cortes, B. David, C. Finn, C. Fu, K. Gopalakrishnan, K. Hausman et al., “Do as i can, not as i say: Grounding language in robotic affordances,” arXiv preprint arXiv:2204.01691, 2022. [39] Y. Chen, J. Arkin, C. Dawson, Y. Zhang, N. Roy, and C. Fan, “Autotamp: Autoregressive task and motion planning with llms as translators and checkers,” in 2024 IEEE International conference on robotics and automation (ICRA). IEEE, 2024, pp. 6695–6702. [40] T. Kawabe and R. Takano, “Hierarchical llm-based multi-agent framework with prompt optimization for multi-robot task planning,” arXiv preprint arXiv:2602.21670, 2026. [41] M. Yu, S. Wang, G. Zhang, J. Mao, C. Yin, Q. Liu, K. Wang, Q. Wen, and Y. Wang, “Netsafe: Exploring the topological safety of multi-agent system,” in Findings of the Association for Computational Linguistics: ACL 2025, 2025, pp. 2905–2938. [42] I. Obi, V. L. Venkatesh, W. Wang, R. Wang, D. Suh, T. I. Amosa, W. Jo, and B.-C. Min, “Safeplan: Leveraging formal logic and chain-of-thought reasoning for enhanced safety in llm-based robotic task planning,” arXiv preprint arXiv:2503.06892, 2025. [43] Z. Ravichandran, A. Robey, V. Kumar, G. J. Pappas, and H. Hassani, “Safety guardrails for llm-enabled robots,” IEEE Robotics and Automation Letters, 2026. [44] L. Wang, Z. Ying, X. Yang, Q. Zou, Z. Yin, T. Li, J. Yang, Y. Yang, A. Liu, and X. Liu, “Robosafe: Safeguarding embodied agents via executable safety logic,” arXiv preprint arXiv:2512.21220, 2025. [45] Y. Wu, X. Lin, H. Zhang, N. Sun, K. Wang, C. Zhou, S. Pan, and Y. Cao, “Cia: Inferring the communication topology from llm-based multi-agent systems,” in Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 2026, pp. 17 917–17 933. [46] J. H. Saltzer and M. D. Schroeder, “The protection of information in computer systems,” Proceedings of the IEEE, vol. 63, no. 9, pp. 1278– 1308, 1975. [47] W. Li, C. Li, G. Zhang, Z. Huang, G. Qu, X. Cheng, J. Luo, and P. Hu, “Radioshock: Over-the-air adversarial attacks on wireless communication,” IEEE Transactions on Dependable and Secure Computing, 2026. [48] H. Triedman, R. Jha, and V. Shmatikov, “Multi-agent systems execute arbitrary malicious code,” arXiv preprint arXiv:2503.12188, 2025. [49] S. Macenski, T. Foote, B. Gerkey, C. Lalancette, and W. Woodall, “Robot operating system 2: Design, architecture, and uses in the wild,” Science Robotics, vol. 7, no. 66, p. eabm6074, 2022. [Online]. Available: https://www.science.org/doi/abs/10.1126/scirobotics.abm6074 [50] Unitree Robotics, “Unitree developer guide,” Unitree Documentation Center, 2026, https://support.unitree.com/home/en/developer, Accessed: 2026-01-20. [51] J.-t. Huang, J. Zhou, T. Jin, X. Zhou, Z. Chen, W. Wang, Y. Yuan, M. R. Lyu, and M. Sap, “On the resilience of llm-based multi-agent collaboration with faulty agents,” arXiv preprint arXiv:2408.00989, 2024.

Zhen Huang received the B.S. degree from Southwest Petroleum University and the M.S. degree from the University of Chinese Academy of Sciences. He is currently working toward the Ph.D. degree at the National University of Defense Technology. His research interests include embodied intelligence security, AI security, and usable security. His papers have appeared in IJCAI and USENIX Security.

17

Zhihuang Liu received the Ph.D. degree from the College of Computer Science and Technology, National University of Defense Technology. He is currently an Assistant Professor with the School of Informatics, Xiamen University. His research interests include privacy protection, usable security, and LLM security. His papers have appeared in IEEE S&P, USENIX Security, WWW, IEEE TIFS, and IEEE/ACM TON.

Weijia Shi received the BS degree and the MS degree from the National University of Defense Technology (NUDT), where he is currently working toward the PhD degree. His research interests include networking, cloud computing, cybersecurity, and knowledge graph reasoning.

Yifan Yang received the bachelor’s degree from the School of Cyberspace Security, Northwestern Polytechnical University, China, in 2023. He is currently pursuing the Ph.D. degree with the College of Computer Science and Technology, National University of Defense Technology, China. His main research interests include network security, network measurement, and network topology discovery. His papers have appeared in IEEE TNSM, USENIX Security, and IEEE/ACM TON.

Weishang Wu received the master’s degree in computer science from the Central South University, Changsha, in 2021. He is currently pursuing a Ph.D. degree with in computer science and technology from the National University of Defense Technology (NUDT), Changsha, China. His research interests include computer vision, autonomous driving, embodied intelligence, and robotic grasping.

Zhiping Cai received the B.Eng., M.A.Sc., and Ph.D. degrees in computer science and technology from the National University of Defense Technology (NUDT), China, in 1996, 2002, and 2005, respectively. He is a full professor in the College of Computer Science and Technology, NUDT. His current research interests include artificial intelligence, network security, and big data. He is a senior member of the CCF and a member of the IEEE.

Related documents

• Propagating Unsafe Actions in LLM Controlled Multi-Robot Collaboration via Single Robot Compromise#196415
• Chained Attacks on Drone-Based Federated Learning: From Network Disruption to Device Impersonation#394330
• Embodying swarm coordination in robotic cyber-physical systems#374728
• Securing LLM-based agents against cyberattacks: a comprehensive survey on attack techniques and defense strategies#161426
• Structurally Close, Temporally Distant: Measuring Security Exposure in Long-Horizon LLM Agents#973529