Robot teams endorsed injected commands 96.7% of the time

Researchers ran injected commands through three multi-robot coordination architectures and watched them turn into physical action almost every time, per arXiv 2608.06830.

That matters because these are physical robots, not chatbots. The paper tested two attack types, an external entry point and a privileged in-system injection, across three LLMs and five embodied multi-robot tasks.

In one architecture, DMAS, robots endorsed the injected instructions 96.7% of the time, and every endorsed command converted into a physical action. The other two architectures did no better: HMAS-1 hit a 97.8% unsafe action success rate, HMAS-2 triggered 88.3% of unsafe action slots.

Yes, but the researchers also tested a fix. A Claim Provenance and Verification gate cut violations from 70.0% down to 36.6%. The paper doesn't say why that gate still lets over a third of attacks through.

The take

A defense that still lets more than a third of injected commands through isn't ready for anything with a battery and wheels. Watch whether the violation rate keeps falling, or whether 36.6% is close to the floor for this kind of gate.