From Prompt to Physical Actuation: Holistic Threat Modeling of LLM-Enabled Robotic Systems
For security researchers and developers of LLM-based autonomous robots, this work provides a unified threat taxonomy and architectural analysis that reveals previously unexamined interaction points and attack chains.
This paper presents the first holistic threat model for LLM-enabled robotic systems, using a Data Flow Diagram and STRIDE analysis to trace how conventional cyber, adversarial, and conversational threats propagate across trust boundaries to physical actuation. The analysis identifies three cross-boundary attack chains and highlights the absence of independent semantic validation as a key vulnerability.
As large language models are integrated into autonomous robotic systems for task planning and control, compromised inputs or unsafe model outputs can propagate through the planning pipeline to physical-world consequences. Although prior work has studied robotic cybersecurity, adversarial perception attacks, and LLM safety independently, no existing study traces how these threat categories interact and propagate across trust boundaries in a unified architectural model. We address this gap by modeling an LLM-enabled autonomous robot in an edge-cloud architecture as a hierarchical Data Flow Diagram and applying STRIDE-per-interaction analysis across six boundary-crossing interaction points using a three-category taxonomy of Conventional Cyber Threats, Adversarial Threats, and Conversational Threats. The analysis reveals that these categories converge at the same boundary crossings, and we trace three cross-boundary attack chains from external entry points to unsafe physical actuation, each exposing a distinct architectural property: the absence of independent semantic validation between user input and actuator dispatch, cross-modal translation from visual perception to language-model instruction, and unmediated boundary crossing through provider-side tool use. To our knowledge, this is the first DFD-based threat analysis integrating all three threat categories across the full perception-planning-actuation pipeline of an LLM-enabled robotic system.