Breaking the Planner's Integrity Boundary: Environment State Text Injection Attacks against LLM-Driven Embodied Agents

The researchers propose the Environment State Text Injection attack ESTI, which, without modifying the original user instructions, model parameters, or the executor, uses fabricated environment state text to influence the planning and execution of LLM-driven embodied agents. The authors also construct ESTI-Bench to evaluate the propagation of the attack in the planning-to-execution loop, and compare it with Vanilla IPI, EIRAD, and BADROBOT on three platforms: ProgPrompt/VirtualHome, VoxPoser/RLBench, and AI2-THOR/iTHOR. The results show that ESTI's attack success rates at the planning level and execution level are up to 89.32% and 43.69% higher than the baselines, respectively. The authors' analysis suggests that entity grounding, consistency, and executability jointly determine whether fabricated state evidence can pass through the embodied loop and produce verifiable environment changes.