{"id":"279b4407-23b6-4bbc-a1a9-0ac815541ca1","arxiv_id":"2608.06830","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Communication attacks on LLM-controlled multi-robot teams succeed across all three tested architectures, and a lightweight provenance-verification gate cuts the violation rate roughly in half.","lead":"This paper shows that an attacker can turn unsafe information into unsafe robot actions by sending messages between robots across three common team coordination setups, and that a simple claim-verification gate reduces the harm. It matters because LLM-controlled robot teams are being proposed for real patrol, hospital, and warehouse tasks, and this work maps where the security breaks.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The headline percentages are propagation-strength scores, not action success rates: C_act is unbounded and O_exec counts relay as success, so the abstract's '97.8% unsafe action success rate' is not a probability of executing an unsafe action.","rationale":"The paper is a broad, well-structured empirical study of communication attacks in simulated LLM-controlled multi-robot systems, with three architectures, three LLMs, five tasks, two attacker settings, and a mitigation. The qualitative claim that communicated unsafe claims can propagate through normal coordination is credible and partly supported by the trace-based framework. However, the abstract's quantitative headline numbers are load-bearing: the reader's strongest_claim explicitly repeats '97.8% unsafe action success rate' and '88.3% of task defined unsafe action slots' as evidence that a single compromised interface can convert claims into task-specific violations. The metric definitions in Section V-B show that these are not episode-level success probabilities. C_act is a weighted propagation-strength score that can exceed 1.0, and O_exec counts relays and further message sending as success. Thus the reported percentages overstate the probability that a real system executes an unsafe action, even if the underlying qualitative phenomenon is real. This is not a question of consensus or attacker capability; it is a correctness-and-reporting issue that can be settled by re-analysis. The concrete test—recomputing headline values as binary per-episode violation rates against simulator ground truth—would determine whether the architecture-level ordering and the high magnitudes survive a stricter, semantically faithful definition of 'unsafe action'. If binary rates remain high, the central claim is strengthened; if they fall substantially, the abstract's specific numbers misrepresent the evidence. The reader already identified this as the weakest assumption, and the verdict should remain CONDITIONAL pending that re-analysis plus the release of traces and artifact code for independent verification.","tokens_in":31810,"tokens_out":8836,"duration_ms":88782,"concrete_test":"Recompute Table II and the abstract's headline numbers with a binary episode outcome: success iff at least one event e with slot q(e) in Q_T is an actual atomic action (MOVE, CAMERA, HANDLECARGO, or INSPECT) flagged by the simulator's ground-truth violation check, excluding messages, restatements, relays, and planner assignments. Report per-episode success rates with 95% CIs per architecture/model/task/prompt. If the binary rates differ by more than a few points from the reported C_act percentages, or if HMAS-1's value drops below 50%, the abstract overstates the probability of unsafe action execution.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section V-B.4 defines C_act as a slot-level maximum of severity times depth weight, explicitly 'not constrained to [0,1]' (Eq. 10), so values such as 0.98 or 1.50 are strength aggregates, not success rates. The abstract's '97.8% unsafe action success rate' and '88.3% of task defined unsafe action slots' therefore cannot be read as probabilities that a deployed system performs an unsafe action; they reward multi-hop cascades and can exceed 1.0. In addition, O_exec (Eq. 7) marks success when a victim 'sends a subsequent message' or 'triggers multi-hop internal delivery', so relay alone counts as action success. The violation detectors in Table I are not validated for false positives/negatives, and for semantic slots (misreporting, unauthorized handover, item-carrier mismatch) the ground-truth labels depend on the authors' own interpretation of LLM-generated traces. If the same results are re-expressed as a binary per-episode rate of at least one simulator-confirmed atomic violation (MOVE/CAMERA/HANDLECARGO), the magnitude—and possibly the architecture ordering—may change. This matters because the central claim's quantitative support is exactly these percentages; without them the paper demonstrates qualitative propagation, not the high action-level success rates advertised.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies security vulnerabilities in LLM-controlled multi-robot systems, focusing on communication attacks that propagate unsafe claims across different coordination architectures. It formulates two attack settings (External Entry Point Attack and Privileged In-System Attack), instantiates them in DMAS, HMAS-1, and HMAS-2 across three LLMs and five embodied tasks, and proposes a Claim Provenance and Verification (CPV) Gate as a mitigation. The central claim is that unsafe information, once laundered into normal coordination messages, can become task-specific unsafe actions, with headline numbers such as a 96.7% entry endorsement rate, a 97.8% unsafe action success rate, and a reduction of violation rate from 70.0% to 36.6% with CPV Gate. The experiments are broad in scope, and the process-oriented metrics are clearly defined, but several load-bearing aspects need correction before the quantitative claims can be taken at face value.","tokens_in":32063,"tokens_out":6174,"duration_ms":64588,"significance":"If the results hold, the paper would be a useful step in understanding communication-layer vulnerabilities in LLM-based multi-robot systems, moving beyond single-robot jailbreaking toward architecture-aware propagation analysis. The evaluation is broad for an empirical security paper: three LLMs, five tasks, three communication architectures, two attacker settings, and a mitigation evaluation. The metric framework is transparent and does not rely on fitted parameters, which is a strength. The CPV Gate result, even if preliminary, addresses a relevant and understudied defense surface. However, the headline percentages are not action success rates as the abstract implies, and the architecture comparison is confounded by task, so the quantitative claims in their current form overstate what is demonstrated.","major_comments":[{"comment":"C_act is not a success rate. The paper explicitly states that C_act is a propagation strength metric and is 'not constrained to [0,1]' (Eq. 10), and Table II reports values above 1 (e.g., DMAS Task-2 privileged attack, C_act = 1.50). The abstract's '97.8% unsafe action success rate' and '88.3% of task defined unsafe action slots' are therefore not probabilities that a deployed system executes an unsafe action. In addition, O_exec in Eq. (7) counts 'sends a subsequent message' as execution/relay success. I recommend reporting, as a complement, a binary per-episode rate of at least one simulator-confirmed atomic violation (MOVE, CAMERA, or HANDLECARGO), or rewording the abstract and the RQ1/RQ2 summaries to call these propagation-strength scores rather than success rates.","section":"Section V-B.4, Eq. (10), and Abstract"},{"comment":"The architecture comparison is confounded by task. According to Table I, DMAS is instantiated only for Task-1, Task-2, and Task-3, while HMAS-1 and HMAS-2 are instantiated only for Task-4 and Task-5. Therefore, the claims that 'HMAS-2 provides the strongest structural gate' and that average C_act ordering reflects architectural properties may instead reflect task difficulty or scenario-specific factors. Please either add same-task cross-architecture runs (e.g., run a patrol task under HMAS-1/HMAS-2 and a handoff task under DMAS) or substantially temper the architecture-level conclusions.","section":"Table I and Section V-D (RQ2)"},{"comment":"The violation detectors are not validated. For the semantic slots (misreporting, unauthorized handover, item-carrier mismatch), ground-truth labels are assigned from LLM-generated traces under the authors' interpretation, and no precision/recall, inter-annotator agreement, or confusion analysis is reported. Since N_act, C_act, and the CPV Gate's P_viol all depend on these detectors, the paper should provide a validation of the detectors or release the labeled traces so that the severity of the reported violations can be independently assessed.","section":"Table I and Section V-B"}],"minor_comments":[{"comment":"The note 'C_act is reported as score (weighted violation score / target unsafe-action slots)' is ambiguous and seems inconsistent with the numbers in the table: for example, DMAS Task-2 privileged attacks show denominators of 20 while N_act maxima are 4, and values such as 30/20 are not immediately interpretable as a ratio of weighted score to slot count. Please clarify the pooling formula for the numerator and denominator.","section":"Table II note"},{"comment":"The abstract's percentages (96.7%, 97.8%, 88.3%) are not traceable to a single table or figure cell, and some appear to come from stage-rate panels rather than from a single well-defined metric. Please cite the exact table or panel for each headline number and use the metric names defined in Section V-B.","section":"Abstract"},{"comment":"The 'pooled rate' in Figure 4 would benefit from an explicit definition of the stage-success and stage-trial predicates for each panel, especially for the external-entry stages (endorse, activate, info uptake) and the privileged stages (receive, execute/relay, info uptake).","section":"Figure 4"},{"comment":"The phrase 'unable action' in the Table I note should be 'disabled action' or 'not enabled' to describe the empty squares.","section":"Table I note"},{"comment":"The paper acknowledges in Section VI-D.2 that real-robot validation is future work. Given that the abstract uses the phrase 'unsafe actions,' I suggest making the simulation-based nature of the evaluation explicit in the abstract or in the first paragraph of Section V-A, e.g., by saying 'simulated unsafe actions' or 'unsafe actions in the Isaac Sim environment.'","section":"Section V-A.1 and Section VI-D.2"}],"recommendation":"major_revision","confidential_remarks":"To the editor: the paper is an extended version of the authors' IJCAI 2026 preliminary work [1]; the editor may wish to verify that the added contributions (HMAS architectures, privileged in-system attack, CPV Gate) are sufficiently novel relative to that publication. My technical assessment is that the core phenomenon is plausible and the experimental breadth is a strength, but the headline numbers overstate action-level success and the architecture comparison is confounded by task. These issues are fixable with additional analysis, re-expression of metrics, or softened claims, so I recommend major revision rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe paper is a serious empirical study, but do not trust the abstract's numbers. The 97.8% 'unsafe action success rate' and 88.3% 'slot trigger' are not what they sound like: C_act (Eq. 10) is an unbounded weighted severity sum, explicitly not constrained to [0,1], and O_exec (Eq. 7) marks success when a victim 'sends a subsequent message' or triggers multi-hop internal delivery. Those headline figures come from single best cells in Table II, not from a well-defined action-success probability. The stress-test note is right on this.\n\nWhat's genuinely new: the extension from DMAS-only prior work to HMAS-1 and HMAS-2, the privileged in-system attacker setting, architecture-specific carriers, and a trace-based evaluation framework that separates endorsement, uptake, activation, and scope. The qualitative core—unsafe claims propagate through normal coordination, DMAS is most permissive, HMAS-2 is the strongest structural gate, privileged attackers bypass entry endorsement—is credible and supported by the broader tables. The CPV Gate mitigation is an interesting idea, with a plausible mechanism (provenance annotation before reuse), but its empirical support is thin: one task per architecture, one model, three runs per cell.\n\nSoft spots, in order: (1) The abstract and the metrics mismatch. Re-express as binary per-episode rates of at least one simulator-confirmed atomic violation (MOVE/CAMERA/HANDLECARGO) and see if the architecture ordering and magnitudes hold. (2) The semantic violation detectors (misreporting, unauthorized handover, item-carrier mismatch) are based on the authors' reading of LLM-generated traces; no false-positive/negative validation. (3) No variance, seeds, or artifacts are released for an evaluation that is inherently stochastic. (4) Real-robot validation is future work, which the authors admit; that is fine for a first study but limits the practical force of the exact rates.\n\nNone of these are fatal. The work is coherent, the threat model is careful, and the limitations section is honest. It deserves a serious peer review, but I would send it back for major revision on the metric presentation and artifacts rather than accept it as-is. Useful for anyone working on security of LLM-controlled robot teams, and a decent basis for a shared evaluation framework.\n\nRecommendation: engage with it, but require the re-analysis before publication.","headline":"A serious empirical study of communication attacks across multi-robot architectures, but the abstract's headline 'success rates' are propagation-strength scores, not action probabilities; worth review with a required re-analysis.","tokens_in":32618,"tokens_out":4841,"would_cite":true,"duration_ms":48408,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Unsafe claims passed between robots become unsafe actions in all three coordination architectures tested, and a simple provenance check cuts violations roughly in half.","keywords":["LLM-controlled robots","multi-robot coordination","communication attacks","confused deputy","provenance verification","unsafe action propagation","embodied AI security","hybrid multi-agent architectures"],"falsifier":"Run the same two attacks on physical robot teams with independently audited logs, counting actual boundary crossings, camera activations, cargo handling operations, and handoff records event-by-event; if the per-execution binary violation rate lies far below the 70–100% range, the propagation claim is weaker than stated. A cheaper probe is to have independent annotators re-label the interaction traces to check which 'information uptake' events are genuine semantic reuse rather than mere restatement.","tokens_in":31589,"feed_emoji":"🤖","tokens_out":6593,"duration_ms":104269,"temperature":0.7,"pith_summary":"Large language models are increasingly used to plan multi-robot coordination, and this paper asks whether unsafe information exchanged through normal communication can become unsafe physical actions. It claims the answer is yes across all three common coordination architectures: decentralized peer dialogue, hybrid planner-seeded dialogue, and hybrid planner-mediated feedback. In experiments, a single exposed robot turned external prompts into trusted coordination messages with up to 96.7% endorsement and near-total activation, and an attacker already inside the system reached even higher action-conversion rates. The paper also proposes a Claim Provenance and Verification Gate that annotates whether a message carries evidence, reducing the any-violation rate from 70.0% to 36.6%. A sympathetic reader should care because this moves the security unit of analysis from a single robot's refusal behavior to the whole collaboration loop.","feed_headline":"Rogue messages ride robot collaboration into unsafe actions","feed_subtitle":"Three coordination designs let one rogue robot spread violations; a claim-check gate halves the rate.","key_machinery":"The central mechanism is the architecture carrier κ_α, which determines how an unsafe claim is inserted into a coordination workflow so it looks like normal, trusted state: direct peer MESSAGE in DMAS, peer MESSAGE presented as a continuation of the central plan in HMAS-1, and robot FEEDBACK that the central planner folds into a revised assignment in HMAS-2. The argument runs through the trace-based conversion metrics (entry endorsement, post-endorsement activation, information uptake, and action infectiousness C_act) and the CPV Gate, a verifier that tags each carrier with a verification state and an evidence reference before downstream reuse. The carrier concept is what lets the authors separate prompt content from communication path and show that the same attack objective changes form to fit each architecture.","core_discovery":"The paper's central discovery is that LLM-controlled multi-robot systems convert unsafe communicated claims into task-specific violations across DMAS, HMAS-1, and HMAS-2, rather than containing them at the entry robot. The conversion is mediated by an architecture-specific carrier: a peer MESSAGE under DMAS, a MESSAGE conditioned on the central planner's initial proposal under HMAS-1, and robot FEEDBACK to the central planner under HMAS-2. The authors formulate two attacker settings — an External Entry Point Attack where the attacker only talks to one exposed robot, and a Privileged In-System Attack where one internal robot is controlled — and measure propagation with trace-based metrics for endorsement, information uptake, action infection, and scope. They report that DMAS reaches 96.7% entry endorsement and 100% post-endorsement activation, HMAS-1 reaches 97.8% unsafe action success, and HMAS-2 triggers 88.3% of task-defined unsafe action slots, and that the CPV Gate reduces the any-violation rate from 70.0% to 36.6%.","pith_inferences":["If the trace-based metrics were re-scored by independent human judges, the reported endorsement and uptake rates might shift materially, since restatement and forwarding count as uptake while mere acknowledgment does not.","Because C_act is an unbounded weighted severity score (privacy-camera events gain an extra step and deeper cascades add hop depth), the abstract's 'success rates' likely overstate the probability that a real deployed fleet executes a physical violation; the same traces should be reported as plain binary violation rates too.","The architecture-conversion pattern suggests a testable design principle: bind each coordination message to its semantic role (observation, completion, approval, request) and to evidence, so that weak claims cannot inherit the authority of a trusted sender or a central plan.","The attack framing implies a broader threat: any system that lets LLM-generated text claim task state (inventory updates, status handoffs, clearances) without verification has the same confused-deputy exposure, not just robot teams."],"forward_implications":["Security evaluation for embodied multi-robot systems should track propagation stages (endorsement, uptake, action) instead of only whether an individual robot refuses the original request.","Communication architecture determines where trust boundaries sit: DMAS amplifies peer-accepted claims, HMAS-1 creates mixed-role bridges, and HMAS-2's central planner becomes a trusted conversion point through feedback.","Strong prompt-level safety constraints reduce but do not eliminate communication-mediated propagation, so defense must also act on the communication boundary.","An attacker who compromises one inside robot bypasses the entry-endorsement bottleneck and reaches target actions faster and more often than an external attacker who must first launder the claim through an exposed robot.","Lightweight provenance annotation (the CPV Gate) can cut violation rates roughly in half by preventing unverified claims from being consumed as operational state, without shutting down coordination."],"supporting_citations":[{"why":"Supplies the four-architecture taxonomy (DMAS, CMAS, HMAS-1, HMAS-2) that the paper instantiates for its attacks and defense.","marker":"[10]"},{"why":"Establishes the preliminary DMAS-only propagation result that this paper extends to other communication architectures.","marker":"[1]"},{"why":"Provides the single-robot jailbreak baseline and the deployment context (GPT-3.5-integrated Unitree Go2) that motivates the external entry-point attack.","marker":"[17]"},{"why":"Shows that LLM planning failures can become physically grounded unsafe actions, grounding the paper's action-level evaluation.","marker":"[16]"},{"why":"Motivates the confused-deputy mechanism where an unsafe claim is accepted once repackaged as trusted coordination content.","marker":"[48]"},{"why":"Supplies the dialogue-based decentralized coordination scheme that the DMAS carrier builds on.","marker":"[12]"},{"why":"Demonstrates exponential infection across multimodal agents, used as prior evidence that propagation through interaction is possible.","marker":"[30]"},{"why":"Supplies the prompt-injection propagation mechanism through repeated agent interaction that the paper's communication attacks extend.","marker":"[28]"}],"fun_headline_variants":["LLM robot teams turn bad messages into unsafe actions","Rogue robot messages spread across three coordination designs","Claim provenance gate halves robot attack violation rate","Communication attacks: the new weak spot in multi-robot LLMs","How one bad message becomes a robot action in LLM teams"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The headline rates depend on the authors' own definitions of unsafe-action slots and violation detectors, and on a simulation whose fidelity to real robot behavior is unvalidated, so the real-world execution probability could be lower than reported.","fun_headline_variants_meta":{"raw":{"variants":["LLM robot teams turn bad messages into unsafe actions","Rogue robot messages spread across three coordination designs","Claim provenance gate halves robot attack violation rate","Communication attacks: the new weak spot in multi-robot LLMs","How one bad message becomes a robot action in LLM teams"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000229,"raw_usage":{"total_tokens":1526,"prompt_tokens":1037,"completion_tokens":489,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":653,"completion_tokens_details":{"reasoning_tokens":411}},"tokens_in":653,"tokens_out":489,"duration_ms":5938,"temperature":1.0,"reasoning_tokens":411,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T20:01:50.061551+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same two attacks on physical robot teams with independently audited logs, counting actual boundary crossings, camera activations, cargo handling operations, and handoff records event-by-event; if the per-execution binary violation rate lies far below the 70–100% range, the propagation claim is weaker than stated. A cheaper probe is to have independent annotators re-label the interaction traces to check which 'information uptake' events are genuine semantic reuse rather than mere restatement.","supporting_citations":[{"cited_title":"Scalable multi-robot collaboration with large language models: Centralized or decentralized systems?","cited_arxiv_id":null,"evidence_quote":"Supplies the four-architecture taxonomy (DMAS, CMAS, HMAS-1, HMAS-2) that the paper instantiates for its attacks and defense."},{"cited_title":"Badrobot: Jailbreaking embodied llm agents in the physical world,","cited_arxiv_id":null,"evidence_quote":"Shows that LLM planning failures can become physically grounded unsafe actions, grounding the paper's action-level evaluation."},{"cited_title":"Agent smith: A single image can jailbreak one million multimodal llm agents exponentially fast,","cited_arxiv_id":null,"evidence_quote":"Demonstrates exponential infection across multimodal agents, used as prior evidence that propagation through interaction is possible."}],"review_version":1}