Research map / Adversarial robustness and security / Backdoor and poisoning
BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimization
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes BadVLA, a two-stage objective-decoupled backdoor attack that injects a visual trigger into the perception module of VLA models (OpenVLA variants, SpatialVLA), reporting near-100% attack success while keeping clean task success.
Problem
Backdoor vulnerabilities of vision-language-action (VLA) robot policies under the training-as-a-service paradigm, which had not been studied; the goal is to implant triggers that cause erroneous actions on triggered inputs while preserving clean-task success.
Approach
Decouple the attack into two objectives: Stage I fine-tunes only the visual perception module with a reference-alignment loss on clean inputs plus a feature-separation loss on triggered inputs; Stage II freezes perception and fine-tunes the backbone and action head on clean data to restore task performance.
Key results
- On OpenVLA with a pixel-block trigger, BadVLA keeps SR above 95% without trigger and reaches ASR of about 98.2% on LIBERO-10 (average ASR 98.3% across suites).
- Data-poisoned and model-poisoned baselines yield SR of 0.0 across suites, failing entirely.
- Under JPEG compression (q=20%) and Gaussian noise (eps=0.08), average ASR remains about 97.7% and 94.1%, and re-fine-tuning keeps ASR high (e.g., 98.2% on Libero_object after fine-tuning from Libero_10).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use objective-decoupled BadVLA instead of data-poisoned training | OpenVLA · LIBERO_10, Block trigger | ASR: 0.0 -> 98.2 | Helped |
| Use objective-decoupled BadVLA instead of model-poisoned training | OpenVLA · LIBERO_10, Block trigger | ASR: 0.0 -> 98.2 | Helped |
| Add Stage II clean-task fine-tuning (ablation) | BadVLA · LIBERO_10 | SR (w/o): 0.0 -> 95.0 | Helped |
| Add Stage II clean-task fine-tuning (ablation) | BadVLA · LIBERO_10 | ASR: 0.0 -> 100.0 | Helped |
| Add reference alignment loss (L1) (ablation) | BadVLA · LIBERO_10 | SR (w/o): 38.3 -> 95.0 | Helped |
| Add trigger separation loss (L2) (ablation) | BadVLA · LIBERO_10 | ASR: 0.0 -> 100.0 | Helped |
| Apply JPEG compression at q=20% | BadVLA · LIBERO_10 | ASR: 100.0 -> 97.4 | No clear effect |
| Apply Gaussian noise at ε=0.08 | BadVLA · LIBERO_10 | ASR: 100.0 -> 94.7 | No clear effect |
| Re-fine-tune on a different task suite | BadVLA · LIBERO, cross-task from LIBERO_10 | ASR: 50.0 -> 90.6 | No clear effect |
Surprising findings
- Backdoors persist after re-fine-tuning on new tasks, with clean SR recovering while ASR stays high.
- Feature cosine similarity between clean and triggered inputs drops from 0.98 to 0.21 after Stage I.
Limitations
- Only untargeted attacks are studied; targeted backdoor effects are left for future work.
- Evaluated on a limited set of VLA models (OpenVLA variants and SpatialVLA) and benchmarks.
- ASR metric is a relative construct computed against baseline success rates, and the paper notes trigger visibility trades off with stealth.
Experimental setup
Datasets: LIBERO SimplerEnv
Benchmarks: LIBERO-Spatial LIBERO-Object LIBERO-Goal LIBERO-10 SimplerEnv
Metrics: attack success rate success rate without trigger cosine similarity of features
Baselines: Data-Poisoned (BadNet-style) Model-Poisoned (UADA-inspired)
Builds on: OpenVLA BadNets UADA
Closest papers by meaning
- TRAP: Hijacking VLA CoT-Reasoning via Adversarial Patches (ICML 2026 · similarity 0.90)
- Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shift (CVPR 2025 · similarity 0.90)
- ElegantVLA: Learning When to Think for Efficient Vision-Language-Action Models (NeurIPS 2026 · similarity 0.88)
- BadToken: Token-level Backdoor Attacks to Multi-modal Large Language Models (CVPR 2025 · similarity 0.88)
- VLA-REPLICA: A Low-Cost, Reproducible Benchmark for Real-World Evaluation of Vision-Language-Action Models (NeurIPS 2026 · similarity 0.88)
- Attention-Imperceptible Backdoor Attacks on Vision Transformers (AAAI 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.