George J. Pappas
Menu

Research

Control theory gives us the language of feedback, robustness and guarantees. We bring that language to learning, to robots and to AI systems, so that they are not only capable but provably safe, secure and trustworthy

A wheeled robot’s camera view of an office, with two people detected, next to a chat in which the robot first refuses a request to detonate a bomb, then complies after a role-play prompt
Jailbreaking an LLM-controlled robot (RoboPAIR): a role-play prompt turns a refusal into a plan to cause harm.

Safe Physical AI

Foundation models — large language models (LLMs), vision-language models (VLMs) and vision-language-action models (VLAs) — now plan and act for robots. We study how these robotic foundation models can be manipulated into harmful physical actions — RoboPAIR showed that LLM-controlled robots can be jailbroken — and build defenses that keep them safe in context: guardrails such as RoboGuard, multimodal defenses against robotic jailbreaking, and context-aware safety that goes beyond alignment. We also make foundation models practical on robots, distilling compact on-device planners such as PRISM.

Key papers

  1. J165
    A. Robey, Z. Ravichandran, E. K. Jones, J. Perlo, F. Barez, V. Kumar, J. Z. Kolter, H. Hassani and G. J. Pappas, “Beyond Alignment: Why Robotic Foundation Models Need Context-Aware Safety,” Science Robotics, vol. 11, no. 113, April 2026. [DOI]
  2. J163
    Z. Ravichandran, A. Robey, V. Kumar, G. J. Pappas and H. Hassani, “Safety Guardrails for LLM-Enabled Robots,” IEEE Robotics and Automation Letters, vol. 11, no. 4, pp. 4649–4656, April 2026. [DOI] [Project] [Video] [Code]
  3. C417
    F. Marchiori, R. Sinha, C. Agia, A. Robey, G. J. Pappas, M. Conti and M. Pavone, “Preventing Robotic Jailbreaking via Multimodal Domain Adaptation,” in Proc. IEEE International Conference on Robotics and Automation (ICRA), Vienna, Austria, June 2026. [DOI]
  4. C418
    D. Snyder, A. Badithela, N. Matni, G. J. Pappas, A. Majumdar, M. Itkina and H. Nishimura, “Beyond Binary Success: Sample-Efficient and Statistically Rigorous Robot Policy Comparison,” in Proc. Robotics: Science and Systems (RSS), Sydney, Australia, July 2026. [DOI]
  5. C411
    A. Robey, Z. Ravichandran, V. Kumar, H. Hassani and G. J. Pappas, “Jailbreaking LLM-Controlled Robots,” in Proc. IEEE International Conference on Robotics and Automation (ICRA), Atlanta, GA, 2025. [DOI] [PDF] [Project] [Video] [Blog] [Code]
  6. C413
    Z. Ravichandran, I. Hounie, F. Cladera, A. Ribeiro, G. J. Pappas and V. Kumar, “Distilling on-Device Language Models for Robot Planning with Minimal Human Intervention,” in Proc. Conference on Robot Learning (CoRL), PMLR vol. 305, pp. 4859–4884, Seoul, Korea, 2025. [Proceedings] [Project] [Video] [Code]
  7. C378
    Z. Dai, A. Asgharivaskasi, T. Duong, S. Lin, M. Tzes, G. J. Pappas and N. Atanasov, “Optimal Scene Graph Planning with Large Language Model Guidance,” in Proc. IEEE International Conference on Robotics and Automation (ICRA), Yokohama, Japan, 2024. [DOI]
All publications →

Current projects

Reasoning Jailbreaks for LLMs and Agents Coefficient Giving · 2025–present
DCIST / ARCHES: Autonomous Resilient Cognitive Heterogeneous Swarms Army Research Laboratory · 2017–2027
Illustration of an autonomous ground robot on a wet forest road in rain and fog, with an overlay showing low-confidence detections, a missed fallen branch, sparse lidar points and a widening uncertainty band around its path
Illustration: in rain and fog, learned perception becomes fragile — low-confidence detections, a misread sign, a missed obstacle — and calibrated uncertainty shows the robot how far it can trust what it sees.

Trustworthy AI

Making foundation models and the AI agents built on them trustworthy: jailbreak attacks and defenses for large language models — PAIR, SmoothLLM and JailbreakBench — weak and strong verification of LLM reasoning, uncertainty quantification with conformal prediction for generative models and human–AI collaboration, safety verification and robustness of neural networks, and principled ways to verify, oversee and control AI agents.

Key papers

  1. C422
    S. Kiyani, S. Noorani, G. J. Pappas and H. Hassani, “When to Trust the Cheap Check: Weak and Strong Verification for Reasoning,” in Proc. International Conference on Machine Learning (ICML), PMLR vol. 306, pp. 59388–59414, Seoul, Korea, July 2026. ICML Spotlight [PDF] [Proceedings] [Code]
  2. C397
    S. Kiyani, G. J. Pappas, A. Roth and H. Hassani, “Decision Theoretic Foundations for Conformal Prediction: Optimal Uncertainty Quantification for Risk-Averse Agents,” in Proc. International Conference on Machine Learning (ICML), PMLR vol. 267, pp. 30943–30965, Vancouver, Canada, July 2025. ICML Spotlight [Proceedings] [Code]
  3. C395
    P. Chao, A. Robey, E. Dobriban, H. Hassani, G. J. Pappas and E. Wong, “Jailbreaking Black Box Large Language Models in Twenty Queries,” in Proc. IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), 2025. [DOI] [Project] [Code]
  4. J155
    A. Robey, E. Wong, H. Hassani and G. J. Pappas, “SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks,” Transactions on Machine Learning Research, 2025. [PDF] [OpenReview] [Blog] [Code]
  5. C394
    P. Chao, E. Debenedetti, A. Robey, M. Andriushchenko, F. Croce, V. Sehwag, E. Dobriban, N. Flammarion, G. J. Pappas, F. Tramèr, H. Hassani and E. Wong, “JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models,” in Advances in Neural Information Processing Systems (NeurIPS), Vancouver, Canada, 2024. [DOI] [Project] [Code]
  6. C354
    H. Wu, T. Tagomori, A. Robey, F. Yang, N. Matni, H. Hassani, G. J. Pappas, C. Pasareanu and C. Barrett, “Toward Certified Robustness Against Real-World Distribution Shifts,” in Proc. IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), February 2023. [DOI]
  7. J130
    M. Fazlyab, M. Morari and G. J. Pappas, “Safety Verification and Robustness Analysis of Neural Networks via Quadratic Constraints and Semidefinite Programming,” IEEE Transactions on Automatic Control, vol. 67, no. 1, pp. 1–15, January 2022. IEEE CSS George S. Axelby Outstanding Paper Award, 2024 [DOI] [Code]
  8. C335
    A. Robey, H. Hassani and G. J. Pappas, “Model-Based Domain Generalization,” in Advances in Neural Information Processing Systems (NeurIPS), December 2021. [PDF] [Proceedings] [Code]
All publications →

Current projects

Reasoning Jailbreaks for LLMs and Agents Coefficient Giving · 2025–present
EnCORE: Institute for Emerging CORE Methods in Data Science National Science Foundation · 2022–2027
Illustration of a drone in a robotics lab flying a learned trajectory, with an uncertainty tube around its path and translucent green cylinders marking the safe set
Illustration: a drone learns its dynamics from data while its controller keeps it inside the safe set.

Learning and Control

Finite-sample theory for learning dynamical systems and controllers — system identification, learning nonlinear dynamics, policy gradients, domain randomization and risk-aware control — and for learning across many agents: federated and multi-agent reinforcement learning, and collaborative learning that stays robust to adversarial agents.

Key papers

  1. C416
    N. Dal Fabbro, M. Mesbahi, R. Mendes, J. Borges de Sousa and G. J. Pappas, “Long-Term Mapping of the Douro River Plume with Multi-Agent Reinforcement Learning,” in Proc. IEEE International Conference on Robotics and Automation (ICRA), Vienna, Austria, June 2026. [DOI] [Project] [Video]
  2. C407
    T. Fujinami, B. D. Lee, N. Matni and G. J. Pappas, “Domain Randomization Is Sample Efficient for Linear Quadratic Control,” in Proc. Conference on Learning for Dynamics and Control (L4DC), pp. 907–919, 2025. [Proceedings]
  3. J156
    A. Tsiamis, D. Kalogerias, A. Ribeiro and G. J. Pappas, “Linear Quadratic Control with Risk Constraints,” Automatica, vol. 174, article 112095, 2025. [DOI]
  4. C404
    A. Somalwar, B. D. Lee, G. J. Pappas and N. Matni, “Learning with Imperfect Models: When Multi-Step Prediction Mitigates Compounding Error,” in Proc. 64th IEEE Conference on Decision and Control (CDC), pp. 82–89, Rio de Janeiro, Brazil, December 2025. [DOI]
  5. C412
    K. Y. Chee, P.-A. Hsieh, G. J. Pappas and M. A. Hsieh, “Flying Quadrotors in Tight Formations Using Learning-Based Model Predictive Control,” in Proc. IEEE International Conference on Robotics and Automation (ICRA), Atlanta, GA, 2025. [DOI] [Video]
  6. J158
    N. Dal Fabbro, A. Mitra, R. W. Heath, L. Schenato and G. J. Pappas, “Finite-Time Analysis of over-The-Air Federated TD Learning,” IEEE Transactions on Wireless Communications, 2025. [DOI]
  7. C392
    I. Ziemann, S. Tu, G. J. Pappas and N. Matni, “Sharp Rates in Dependent Learning Theory: Avoiding Sample Size Deflation for the Square Loss,” in Proc. International Conference on Machine Learning (ICML), Vienna, Austria, 2024. ICML Spotlight [PDF] [Proceedings]
  8. C380
    C. Stamouli, E. Chatzipantazis and G. J. Pappas, “Structural Risk Minimization for Learning Nonlinear Dynamics,” in Proc. American Control Conference (ACC), pp. 2897–2904, Toronto, Canada, 2024. AACC American Control Conference Best Student Paper Award [DOI]
  9. J151
    A. Mitra, G. J. Pappas and H. Hassani, “Temporal Difference Learning with Compressed Updates: Error-Feedback Meets Reinforcement Learning,” Transactions on Machine Learning Research, 2024. [PDF] [OpenReview]
  10. C386
    N. Dal Fabbro, A. Adibi, H. V. Poor, S. R. Kulkarni, A. Mitra and G. J. Pappas, “DASA: Delay-Adaptive Multi-Agent Stochastic Approximation,” in Proc. 63rd IEEE Conference on Decision and Control (CDC), pp. 3889–3896, Milan, Italy, 2024. [DOI]
  11. J149
    A. Tsiamis, I. Ziemann, N. Matni and G. J. Pappas, “Statistical Learning Theory for Control: A Finite-Sample Perspective,” IEEE Control Systems Magazine, vol. 43, no. 6, pp. 67–97, December 2023. [DOI]
  12. C341
    A. Tsiamis, I. M. Ziemann, M. Morari, N. Matni and G. J. Pappas, “Learning to Control Linear Systems Can Be Hard,” in Proc. Conference on Learning Theory (COLT), pp. 3820–3857, London, June 2022. [PDF] [Proceedings]
  13. C345
    A. Mitra, A. Adibi, G. J. Pappas and H. Hassani, “Collaborative Linear Bandits with Adversarial Agents: Near-Optimal Regret Bounds,” in Advances in Neural Information Processing Systems (NeurIPS), November 2022. [DOI]
  14. C333
    A. Mitra, R. Jaafar, G. J. Pappas and H. Hassani, “Linear Convergence in Federated Learning: Tackling Client Heterogeneity and Sparse Gradients,” in Advances in Neural Information Processing Systems (NeurIPS), December 2021. [PDF] [Proceedings]
  15. C300
    A. Tsiamis, N. Matni and G. J. Pappas, “Sample Complexity of Kalman Filtering for Unknown Systems,” in Proc. Conference on Learning for Dynamics and Control (L4DC), Berkeley, CA, June 2020. L4DC Oral Spotlight [PDF] [Proceedings]
All publications →

Current projects

Resolution-Invariant Deep Learning for Uncertainty Propagation in Multi-Scale Energy Storage Systems Department of Energy, Office of Science · 2023–2027
EnCORE: Institute for Emerging CORE Methods in Data Science National Science Foundation · 2022–2027
A delivery robot at a night crosswalk: with a parked car’s headlights off it judges the crossing safe; with the headlights on it yields
Context-aware safety: the same scene calls for different actions depending on context, here whether a parked car’s headlights are on.

Formal Methods

We bring formal methods together with control theory to make robot autonomy provably safe. That means temporal logic specifications and their quantitative robustness, verification of systems with neural network controllers, and planning and control with conformal prediction when the environment is uncertain or unknown — together with the abstraction hierarchies, from approximate bisimulation to layered control architectures, that let simple models stand in for complex robots with guarantees.

Key papers

  1. J164
    D. S. Sundarsingh, Y. Li, T. Tang, G. J. Pappas, N. Atanasov and Y. Kantaros, “Safe Planning in Unknown Environments Using Conformalized Semantic Maps,” IEEE Robotics and Automation Letters, vol. 11, no. 4, pp. 4921–4928, April 2026. [DOI] [Video]
  2. C403
    C. Stamouli, A. Tsiamis, M. Morari and G. J. Pappas, “Layered Multirate Control of Constrained Linear Systems,” in Proc. 64th IEEE Conference on Decision and Control (CDC), pp. 3027–3034, Rio de Janeiro, Brazil, December 2025. [DOI]
  3. J162
    L. Lindemann, Y. Zhao, X. Yu, G. J. Pappas and J. V. Deshmukh, “Formal Verification and Control with Conformal Prediction: Practical Safety Guarantees for Autonomous Systems,” IEEE Control Systems Magazine, vol. 45, no. 6, pp. 72–122, December 2025. IEEE CSS Control Systems Magazine Outstanding Paper Award, 2026 [DOI]
  4. C383
    C. J. Stamouli, L. Lindemann and G. J. Pappas, “Recursively Feasible Shrinking-Horizon MPC in Dynamic Environments with Conformal Prediction Guarantees,” in Proc. Conference on Learning for Dynamics and Control (L4DC), pp. 1330–1342, 2024. [PDF] [Proceedings]
  5. C356
    S. Kalluraya, G. J. Pappas and Y. Kantaros, “Multi-Robot Mission Planning in Dynamic Semantic Environments,” in Proc. IEEE International Conference on Robotics and Automation (ICRA), May 2023. [DOI] [Video]
  6. C330
    A. Rodionova, L. Lindemann, M. Morari and G. J. Pappas, “Time-Robust Control for STL Specifications,” in Proc. 60th IEEE Conference on Decision and Control (CDC), Austin, Texas, December 2021. IEEE CSS CDC Best Student Paper Award [DOI]
  7. J116
    R. Ivanov, T. Carpenter, J. Weimer, R. Alur, G. J. Pappas and I. Lee, “Verifying the Safety of Autonomous Systems with Neural Network Controllers,” ACM Transactions on Embedded Computing Systems, vol. 20, no. 1, pp. 1–26, December 2020. ACM Transactions on Embedded Computing Systems Best Paper Award, 2022 [DOI]
  8. C275
    R. Ivanov, J. Weimer, R. Alur, G. J. Pappas and I. Lee, “Verisig: Verifying Safety Properties of Hybrid Systems with Neural Network Controllers,” in Proc. ACM International Conference on Hybrid Systems: Computation and Control (HSCC), Montreal, Canada, April 2019. [DOI] [Code]
  9. J49
    H. Kress-Gazit, G. Fainekos and G. J. Pappas, “Temporal Logic Based Reactive Mission and Motion Planning,” IEEE Transactions on Robotics, vol. 25, no. 6, pp. 1370–1381, December 2009. [DOI]
  10. J46
    G. Fainekos and G. J. Pappas, “Robustness of Temporal Logic Specifications for Continuous-Time Signals,” Theoretical Computer Science, vol. 410, no. 42, pp. 4262–4291, September 2009. [DOI]
  11. J43
    A. Girard and G. J. Pappas, “Hierarchical Control System Design Using Approximate Simulation,” Automatica, vol. 45, no. 2, pp. 566–571, February 2009. [DOI]
  12. J29
    A. Girard and G. J. Pappas, “Approximation Metrics for Discrete and Continuous Systems,” IEEE Transactions on Automatic Control, vol. 52, no. 5, pp. 782–798, May 2007. IEEE CSS George S. Axelby Outstanding Paper Award, 2009 [DOI]
  13. Ch26
    G. Fainekos and G. J. Pappas, “Robustness of Temporal Logic Specifications,” in Formal Approaches to Testing and Runtime Verification (FATES/RV), vol. 4262 of Lecture Notes in Computer Science, pp. 178–192, Springer-Verlag, Seattle, WA, August 2006. International Conference on Runtime Verification (RV) Test of Time Award, 2025 [DOI]
  14. J5
    G. J. Pappas, G. Lafferriere and S. Sastry, “Hierarchically Consistent Control Systems,” IEEE Transactions on Automatic Control, vol. 45, no. 6, pp. 1144–1160, June 2000. [DOI]
All publications →

Current projects

SCHEMA: Scalable Compositional Hierarchies for Evolvable Multi-Agent Architectures Air Force Office of Scientific Research (via MIT) · 2025–2030
DCIST / ARCHES: Autonomous Resilient Cognitive Heterogeneous Swarms Army Research Laboratory · 2017–2027
Illustration of a ground robot and two drones at dusk building a shared semantic map of a campus, with labeled buildings, cars and people and dashed communication links
Illustration: an air–ground robot team builds a shared semantic map, labeling buildings, cars and people as it explores.

Multi-Robot Systems

Perception, planning and coordination for teams of robots — semantic mapping, active information acquisition and connectivity — and, increasingly, robot teams that take their missions in natural language: planning grounded by LLMs and VLMs (SPINE, SPINE-HT) for air–ground teams in unstructured environments.

Key papers

  1. C424
    Z. Ravichandran, F. Cladera, A. Prabhu, J. Hughes, C. Nieto-Granda, V. Murali, C. J. Taylor, G. J. Pappas and V. Kumar, “Heterogeneous Robot Collaboration in Unstructured Environments with Grounded Generative Intelligence,” in Proc. IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS), Pittsburgh, PA, September 2026. [PDF] [Project] [Video] [Code]
  2. J159
    F. Cladera, Z. Ravichandran, J. Hughes, V. Murali, C. Nieto-Granda, M. A. Hsieh, G. J. Pappas, C. J. Taylor and V. Kumar, “Air-Ground Collaboration for Language-Specified Missions in Unknown Environments,” IEEE Transactions on Field Robotics, vol. 2, pp. 626–642, 2025. [DOI] [Project]
  3. C357
    M. Tzes, N. Bousias, E. Chatzipantazis and G. J. Pappas, “Graph Neural Networks for Multi-Robot Active Information Acquisition,” in Proc. IEEE International Conference on Robotics and Automation (ICRA), May 2023. IEEE RAS ICRA Outstanding Multi-Robot Systems Paper [DOI] [Video]
  4. J133
    B. Schlotfeldt, V. Tzoumas and G. J. Pappas, “Resilient Active Information Acquisition with Teams of Robots,” IEEE Transactions on Robotics, vol. 38, no. 1, pp. 244–261, February 2022. [DOI]
  5. C244
    S. Bowman, N. Atanasov, K. Daniilidis and G. J. Pappas, “Probabilistic Data Association for Semantic SLAM,” in Proc. IEEE International Conference on Robotics and Automation (ICRA), Singapore, June 2017. IEEE RAS ICRA Best Conference Paper Award [DOI] [PDF]
  6. J40
    M. Zavlanos and G. J. Pappas, “Distributed Connectivity Control of Mobile Networks,” IEEE Transactions on Robotics, vol. 24, no. 6, pp. 1416–1428, December 2008. [DOI]
All publications →

Current projects

SCHEMA: Scalable Compositional Hierarchies for Evolvable Multi-Agent Architectures Air Force Office of Scientific Research (via MIT) · 2025–2030
DCIST / ARCHES: Autonomous Resilient Cognitive Heterogeneous Swarms Army Research Laboratory · 2017–2027