Graph based planning helps robots avoid harm and finish tasks safely
Refuse the Harm, Complete the Task via Graph-of-Rules Planning for LLM-Enabled Robots
Robotics
Summary
Robots that understand human instructions sometimes get tricked by unsafe or harmful commands hidden inside a task. The authors show that existing safety checks can miss these dangers or reject the whole task by mistake. They created a new method called RuleGraph, which breaks down instructions into smaller parts, checks each one carefully with multiple rules, and only refuses the harmful parts while completing the safe ones. Their approach lets robots plan safely and finish tasks better in tests.
What this means in practice
- •For industrial robot operators: Enable robots to safely execute complex human instructions by rejecting harmful parts while completing safe sub-tasks in manufacturing and warehouse settings.
- •For home automation developers: Develop household robots that can follow mixed safe and unsafe user commands by distinguishing and ignoring potentially dangerous actions.
Authors
Ali Taheri, Alireza Taban, Qizhou Wang, Wanhua Li
Abstract
Large Language Models (LLMs) are increasingly used in embodied AI for robotic manipulation and planning, but their deployment in physical systems exposes vulnerabilities such as jailbreak attacks that induce unsafe behavior. Existing inference-time defenses are mainly evaluated on short instructions containing a single hazard, whereas realistic tasks may interleave safe and unsafe sub-tasks, conceal hazardous steps, or combine individually safe actions into unsafe outcomes. Such compound instructions make it harder for a single safety decision to distinguish hazardous sub-tasks from legitimate ones, risking either overlooking the hazard or rejecting the whole instruction. We introduce safe task completion, a task that requires an LLM-enabled robot to refuse the harmful part of an instruction while completing its legitimate part. To address this problem, we propose RuleGraph, a multi-agent Graph-of-Rules planning framework that distributes safety enforcement across multiple reasoning and verification stages. Five cooperating agents are used to ground general safety principles into world-specific rules, assess the instruction's sub-tasks in context, and derive a safe goal from the legitimate ones. Planning toward this goal is then organized as a graph of rule-specific nodes, where higher-level nodes inherit the union of their parents' rules, and candidate plans are progressively verified and aggregated until a single plan satisfies every relevant rule. In this way, RuleGraph reduces reliance on a single centralized safety decision. We evaluate RuleGraph on pure-attack and compound instructions across two benchmarks in two environments using Attack Success Rate (ASR) and Task Success Rate (TSR). RuleGraph reduces ASR to 0% on both benchmarks while achieving the highest TSR among all methods, reaching 98.57% on the RoboGuard benchmark and 84.54% on our long-horizon compound instructions.