{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,27]],"date-time":"2026-06-27T15:46:10Z","timestamp":1782575170649,"version":"3.54.5"},"reference-count":92,"publisher":"IEEE","license":[{"start":{"date-parts":[[2025,5,19]],"date-time":"2025-05-19T00:00:00Z","timestamp":1747612800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,5,19]],"date-time":"2025-05-19T00:00:00Z","timestamp":1747612800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,5,19]]},"DOI":"10.1109\/icra55743.2025.11128119","type":"proceedings-article","created":{"date-parts":[[2025,9,2]],"date-time":"2025-09-02T17:28:56Z","timestamp":1756834136000},"page":"11948-11956","source":"Crossref","is-referenced-by-count":13,"title":["Jailbreaking LLM-Controlled Robots"],"prefix":"10.1109","author":[{"given":"Alexander","family":"Robey","sequence":"first","affiliation":[{"name":"University of Pennsylvania"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zachary","family":"Ravichandran","sequence":"additional","affiliation":[{"name":"University of Pennsylvania"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Vijay","family":"Kumar","sequence":"additional","affiliation":[{"name":"University of Pennsylvania"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hamed","family":"Hassani","sequence":"additional","affiliation":[{"name":"University of Pennsylvania"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"George J.","family":"Pappas","sequence":"additional","affiliation":[{"name":"University of Pennsylvania"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/ICRA57147.2024.10610599"},{"key":"ref2","article-title":"Do as i can, not as i say: Grounding language in robotic affordances","author":"Ahn","year":"2022","journal-title":"arXiv preprint"},{"key":"ref3","article-title":"Real: Resilience and adaptation using large language models on autonomous aerial robots","volume-title":"Conference on Robot Learning","author":"Tagliabue","year":"2023"},{"key":"ref4","article-title":"Learning traffic crashes as language: Datasets, bench-marks, and what-if causal analyses","author":"Fan","year":"2024","journal-title":"arXiv preprint"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1109\/LRA.2024.3360020"},{"key":"ref6","article-title":"Code as policies: Language model programs for embodied control","author":"Liang","year":"2022","journal-title":"arXiv preprint"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.15607\/rss.2024.xx.114"},{"key":"ref8","author":"Xie","year":"2023","journal-title":"Rea-soning about the unseen for efficient outdoor object navigation"},{"key":"ref9","first-page":"492","article-title":"Lm-nav: Robotic navigation with large pre-trained models of language, vision, and action","volume-title":"Proceedings of The 6th Conference on Robot Learning, ser. Proceedings of Machine Learning Research","volume":"205","author":"Shah","year":"2023"},{"key":"ref10","first-page":"1084","article-title":"Grounding complex natural language commands for temporal tasks in unseen environments","volume-title":"Proceedings of The 7th Conference on Robot Learning, ser. Proceedings of Machine Learning Research","volume":"229","author":"Liu","year":"2023"},{"key":"ref11","first-page":"2683","article-title":"Navigation with large language models: Semantic guesswork as a heuristic for planning","volume-title":"Proceedings of The 7th Conference on Robot Learning, ser. Proceedings of Machine Learning Research","volume":"229","author":"Shah","year":"2023"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/ICRA48891.2023.10160969"},{"key":"ref13","volume":"1","author":"Quartey","year":"2024","journal-title":"Verifiably following complex robot instructions with foundation models"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.01416"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/WACVW60836.2024.00106"},{"key":"ref16","article-title":"Llm-assist: Enhancing closed-loop planning with language-based reasoning","author":"Sharan","year":"2023","journal-title":"arXiv preprint"},{"key":"ref17","article-title":"A language agent for autonomous driving","author":"Mao","year":"2023","journal-title":"arXiv preprint"},{"key":"ref18","volume-title":"Figure ai master plan","author":"Adcock","year":"2024"},{"key":"ref19","volume-title":"Ai update: Voice commands & chaining tasks","author":"Jang","year":"2024"},{"key":"ref20","volume-title":"Introducing devin: The first ai software engineer","author":"Wu","year":"2024"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.2514\/6.2024-4250"},{"key":"ref22","author":"Symphony","year":"2024","journal-title":"Industrial llm: Revolutionizing manufacturing with ai"},{"key":"ref23","volume-title":"Chinese army\u2019s latest weapon: gun-toting robot dog","author":"Guardian","year":"2024"},{"key":"ref24","article-title":"Port st. lucie police department gets robotic dog","volume-title":"WPBF","year":"2024"},{"key":"ref25","article-title":"What we know about ukraine\u2019s army of robot dogs","volume-title":"Forbes","author":"Hambling","year":"2024"},{"key":"ref26","article-title":"You can preorder this robot dog equipped with a flamethrower","volume-title":"Gizmodo","year":"2024"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1145\/3593013.3594067"},{"key":"ref28","first-page":"27730","article-title":"Training language models to follow instructions with human feedback","volume":"35","author":"Ouyang","year":"2022","journal-title":"Advances in neural information processing systems"},{"key":"ref29","article-title":"Improving alignment of dialogue agents via targeted human judge-ments","author":"Glaese","year":"2022","journal-title":"arXiv preprint"},{"key":"ref30","article-title":"One-shot safety alignment for large language models via optimal dualization","author":"Huang","year":"2024","journal-title":"arXiv preprint"},{"key":"ref31","article-title":"Aligning large multimodal models with factually augmented rlhf","author":"Sun","year":"2023","journal-title":"arXiv preprint"},{"key":"ref32","article-title":"Safe rlhf: Safe reinforcement learning from human feedback","author":"Dai","year":"2023","journal-title":"ar Xiv preprint"},{"key":"ref33","article-title":"Training a helpful and harmless assistant with reinforcement learning from human feedback","author":"Bai","year":"2022","journal-title":"arXiv preprint"},{"key":"ref34","article-title":"J ailbroken: How does llm safety training fail?","volume":"36","author":"Wei","year":"2024","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref35","article-title":"J ailbreaking black box large language models in twenty queries","author":"Chao","year":"2023","journal-title":"arXiv preprint"},{"key":"ref36","article-title":"Universal and transferable adversarial attacks on aligned language models","author":"Zou","year":"2023","journal-title":"arXiv preprint"},{"key":"ref37","article-title":"Autodan: Generating stealthy jailbreak prompts on aligned large language models","author":"Liu","year":"2023","journal-title":"arXiv preprint"},{"key":"ref38","article-title":"Jailbreaking leading safety-aligned llms with simple adaptive attacks","author":"Andriushchenko","year":"2024","journal-title":"arXiv preprint"},{"key":"ref39","article-title":"Attacking large language models with projected gradient descent","author":"Geisler","year":"2024","journal-title":"arXiv preprint"},{"key":"ref40","article-title":"Amplegcg: Learning a universal and transferable generative model of adversarial suffixes for jailbreaking both open and closed llms","author":"Liao","year":"2024","journal-title":"arXiv preprint"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00123"},{"key":"ref42","article-title":"Automatic jailbreaking of the text-to-image generative ai systems","author":"Kim","year":"2024","journal-title":"arXiv preprint"},{"key":"ref43","article-title":"Auto-mated black-box prompt engineering for personalized text-to-image generation","author":"He","year":"2024","journal-title":"arXiv preprint"},{"key":"ref44","article-title":"Smoothllm: Defending large language models against jailbreaking attacks","author":"Robey","year":"2023","journal-title":"arXiv preprint"},{"key":"ref45","article-title":"Baseline defenses for adversarial attacks against aligned language models","author":"Jain","year":"2023","journal-title":"arXiv preprint"},{"key":"ref46","article-title":"Improving alignment and robustness with short circuiting","author":"Zou","year":"2024","journal-title":"ar Xiv preprint"},{"key":"ref47","article-title":"Defending large language models against jailbreak attacks via semantic smoothing","author":"Ji","year":"2024","journal-title":"arXiv preprint"},{"key":"ref48","article-title":"Robust prompt optimization for de-fending language models against jailbreaking attacks","author":"Zhou","year":"2024","journal-title":"arXiv preprint"},{"key":"ref49","article-title":"Harmbench: A standardized evaluation framework for automated red teaming and robust refusal","author":"Mazeika","year":"2024","journal-title":"ar Xiv preprint"},{"key":"ref50","article-title":"Llm defenses are not robust to multi-turn human jailbreaks yet","author":"Li","year":"2024","journal-title":"arXiv preprint"},{"key":"ref51","article-title":"Great, now write an article about that: The crescendo multi-turn llm jailbreak attack","author":"Russinovich","year":"2024","journal-title":"arXiv preprint"},{"key":"ref52","article-title":"Many-shot jailbreaking","author":"Anil","year":"2024","journal-title":"Anthropic"},{"key":"ref53","article-title":"Does refusal training in llms generalize to the past tense?","author":"Andriushchenko","year":"2024","journal-title":"arXiv preprint"},{"key":"ref54","article-title":"Jailbreakbench: An open robustness benchmark for jailbreaking large language models","author":"Chao","year":"2024","journal-title":"arXiv preprint"},{"key":"ref55","article-title":"A safe harbor for ai evaluation and red teaming","author":"Longpre","year":"2024","journal-title":"ar Xiv preprint"},{"key":"ref56","article-title":"Con-stitutional ai: Harmlessness from ai feedback","author":"Bai","year":"2022","journal-title":"ar Xiv preprint"},{"key":"ref57","article-title":"Executive order on the safe, secure, and trustwor-thy development and use of artificial intelligence","year":"2024","journal-title":"The White House"},{"key":"ref58","volume-title":"Senate bill 1047: An act to amend sections related to development and environmental matters","author":"Senate","year":"2024"},{"key":"ref59","article-title":"Unsolved problems in ml safety","author":"Hendrycks","year":"2021","journal-title":"arXiv preprint"},{"key":"ref60","article-title":"Attention is all you need","author":"Vaswani","year":"2017","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref61","article-title":"Mamba: Linear-time sequence modeling with selective state spaces","author":"Gu","year":"2023","journal-title":"arXiv preprint"},{"key":"ref62","article-title":"Scaling laws for neural language models","author":"Kaplan","year":"2020","journal-title":"arXiv preprint"},{"key":"ref63","volume-title":"Voyager: An open-ended embodied agent with large language models","author":"Wang","year":"2023"},{"key":"ref64","volume-title":"Adapt: As-needed decomposition and planning with language models","author":"Prasad","year":"2024"},{"key":"ref65","article-title":"Eureka: Human-level reward design via coding large language models","author":"Ma","year":"2023","journal-title":"ar Xiv preprint"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.15607\/rss.2024.xx.094"},{"key":"ref67","article-title":"Reward design with language models","author":"Kwon","year":"2023","journal-title":"arXiv preprint"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1109\/ICRA48891.2023.10160591"},{"key":"ref69","article-title":"Sayplan: Grounding large language models using 3d scene graphs for scalable task planning","volume-title":"7th Annual Conference on Robot Learning","author":"Rana","year":"2023"},{"key":"ref70","article-title":"Do as i can and not as i say: Grounding language in robotic affordances","author":"Ahn","year":"2022","journal-title":"arXiv preprint"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/lra.2024.3441495"},{"key":"ref72","article-title":"Lang2ltl: Translating natural language commands to temporal robot task specification","volume-title":"Conference on Robbot Learning (CoRL)","author":"Liu","year":"2023"},{"key":"ref73","article-title":"NI2tl: Transforming natural languages to temporal logics using large language models","author":"Chen","year":"2023","journal-title":"arXiv preprint"},{"key":"ref74","article-title":"Autotamp: Autoregressive task and motion planning with llms as translators and checkers","author":"Chen","year":"2023","journal-title":"arXiv preprint"},{"key":"ref75","volume-title":"Large language models to the rescue: Deadlock resolution in multi-robot systems","author":"Garg","year":"2024"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/cdc56724.2024.10885890"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.15607\/rss.2023.xix.025"},{"key":"ref78","first-page":"785","article-title":"Perceiver-actor: A multi-task transformer for robotic manipulation","volume-title":"Conference on Robot Learning. PMLR","author":"Shridhar","year":"2023"},{"key":"ref79","article-title":"The llama 3 herd of models","author":"Dubey","year":"2024","journal-title":"arXiv preprint"},{"key":"ref80","article-title":"Gensim2: Realistic robot task generation with llm","volume-title":"8th Annual Conference on Robot Learning","author":"Hua"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-72995-9_23"},{"key":"ref82","article-title":"Sleeper agents: Training deceptive llms that persist through safety training","author":"Hubinger","year":"2024","journal-title":"arXiv preprint"},{"key":"ref83","article-title":"The llama 3 herd of models","volume-title":"Meta, Tech. Rep.","year":"2024"},{"key":"ref84","article-title":"OpenAI O1 System Card","volume-title":"OpenAI, Tech. Rep.","year":"2024"},{"key":"ref85","first-page":"46595","article-title":"Judging llm-as-a-judge with mt-bench and chatbot arena","volume":"36","author":"Zheng","year":"2023","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref86","article-title":"Openflamingo: An open-source framework for training large autoregressive vision-language models","author":"Awadalla","year":"2023","journal-title":"arXiv preprint"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01164"},{"key":"ref88","article-title":"Online semantic planning for missions with incomplete natural language specifications in unstructured nvironments","author":"Ravichandran","year":"2024","journal-title":"In Submission"},{"key":"ref89","article-title":"Effective prompt extraction from language models","volume-title":"First Conference on Language Modeling","author":"Zhang","year":"2024"},{"key":"ref90","article-title":"Openai\u2019s custom chatbots are an insecurity nightmare","volume-title":"Wired","author":"Paul","year":"2024"},{"key":"ref91","article-title":"Stealing copilot\u2019s system prompt","volume-title":"Zenity Labs","year":"2024"},{"key":"ref92","article-title":"Investigating the prompt leakage effect and black-box defenses for multi-turn llm interactions","author":"Agarwal","year":"2024","journal-title":"arXiv preprint"}],"event":{"name":"2025 IEEE International Conference on Robotics and Automation (ICRA)","location":"Atlanta, GA, USA","start":{"date-parts":[[2025,5,19]]},"end":{"date-parts":[[2025,5,23]]}},"container-title":["2025 IEEE International Conference on Robotics and Automation (ICRA)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11127273\/11127223\/11128119.pdf?arnumber=11128119","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,3]],"date-time":"2025-09-03T06:12:26Z","timestamp":1756879946000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11128119\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,5,19]]},"references-count":92,"URL":"https:\/\/doi.org\/10.1109\/icra55743.2025.11128119","relation":{},"subject":[],"published":{"date-parts":[[2025,5,19]]}}}