Lie Less, Lie Big: Covert Internal Attacks against LLM Robot Teams

Researchers studied the threat of a single compromised robot acting as a covert adversary to sabotage shared outcomes when a multi-robot team delegates planning and mutual trust to LLM agents, and derived theoretical bounds on the probability that an attack is verified and on the map error it causes. The task setting is multi-robot surveying, where measurements can be verified against the physical world, but each verification consumes budget that could otherwise advance the task. The paper gives two bounds: the probability that an adversary's report is verified is lower-bounded by the communication graph degree and the verification budget; the map error caused by a covert adversary is upper-bounded by the optimum of a linear program over the adversary's bias distribution. This solution gives an exchange rate between covert budget and damage: below a critical verification level, the worst covert attack is to lie at full magnitude at low frequency on the records least likely to be verified; above that level, small biases hidden in noise are more cost-effective. In experiments with LLM agents as honest robots, both bounds hold under the budget actually spent on attacks; the experiments also show that LLM robots review which records are unbiased, but how many they review is unpredictable.