Embodied AI represents systems where AI is integrated into physical entities. Large Language Model (LLM), which exhibits powerful language understanding abilities, has been extensively employed in embodied AI by facilitating sophisticated task planning. However, a critical safety issue remains overlooked: could these embodied LLMs perpetrate harmful behaviors? In response, we introduce BadRobot, a novel attack paradigm aiming to make embodied LLMs violate safety and ethical constraints through typical voice-based user-system interactions. Specifically, three vulnerabilities are exploited to achieve this type of attack: (i) manipulation of LLMs within robotic systems, (ii) misalignment between linguistic outputs and physical actions, and (iii) unintentional hazardous behaviors caused by world knowledge's flaws. Furthermore, we construct a benchmark of various malicious physical action queries to evaluate BadRobot's attack performance. Based on this benchmark, extensive experiments against existing prominent embodied LLM frameworks (e.g., Voxposer, Code as Policies, and ProgPrompt) demonstrate the effectiveness of our BadRobot. Our code is available at https://github.com/Rookie143/BadRobot.

翻译：具身AI代表将人工智能集成到物理实体中的系统。大语言模型（LLM）凭借其强大的语言理解能力，通过支持复杂任务规划已被广泛应用于具身AI领域。然而，一个关键的安全问题仍被忽视：这些具身LLM是否可能实施有害行为？为此，我们提出BadRobot，一种新型攻击范式，旨在通过典型的基于语音的人机交互使具身LLM违反安全与道德约束。具体而言，本攻击利用了三类漏洞：(i) 机器人系统中LLM的操控性；(ii) 语言输出与物理行为之间的错配；(iii) 世界知识缺陷导致的无意危险行为。此外，我们构建了包含多种恶意物理动作查询的基准测试集，以评估BadRobot的攻击性能。基于该基准，针对现有主流具身LLM框架（如Voxposer、Code as Policies和ProgPrompt）的大量实验证明了我们BadRobot的有效性。我们的代码已开源至https://github.com/Rookie143/BadRobot。