DropVLA: An Action-Level Backdoor Attack on Vision-Language-Action Models

arXiv:2510.10932 · cs.CR, cs.AI, cs.RO · Submitted 2025-10-13 · Read on arXiv

Listen

Radio episode about this paper

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: Next we'll be talking about the paper "DropVLA: An Action-Level Backdoor Attack on Vision-Language-Action Models".

Jane: The paper was written by Zonghuan Xu, Jiayu Li, Yunhan Zhao, Xiang Zheng, Xingjun Ma et al. from Institute of Trustworthy Embodied AI and Fudan University and Shanghai Key Laboratory of Multimodal Embodied AI and City University of Hong Kong.

Tom: Stay tuned as we take you through the paper and discuss its implications.

Title: Tom: We're diving into a pretty intense new paper called DropVLA: An Action-Level Backdoor Attack on Vision–Language–Action Models.

Jane: It sounds a bit frightening, Tom, but it's actually a vital study from researchers at Fudan University and the City University of Hong Kong.

Tom: They're really digging into the vulnerabilities of these next-generation systems.

Jane: Exactly, and for those who aren't familiar, these VLA models are essentially the brains for modern robots.

Tom: Can you break down what that actually means in plain English?

Jane: Think of them as a system that takes in visual information from cameras.

Jane: They also process language instructions to decide exactly how the robot should move.

Lu: These models are incredibly versatile, but this paper shows they have a hidden weakness in their most basic movements.

Tom: You're talking about that "action-level" part of the title, right?

Lu: Yes, because instead of making the robot do something completely different like walking into a wall, the attacker just hijacks one tiny movement like opening a gripper.

Meng: That sounds much harder to detect than a total system failure or a task-level error.

Tom: It's much more subtle because the robot still performs its main job perfectly most of the time.

Meng: I'm curious how an attacker can actually pull this off if they don't have access to the model's internal settings.

Tom: The researchers call it a "pipeline-black-box" scenario, where they only need to mess with a tiny bit of training data.

Meng: So they don't even need to be high-level hackers?

Tom: Not at all, they just need to sneak in some poisoned examples during the learning process.

Lalam: It makes me wonder how we can ever truly trust a machine's physical intent if its most basic movements can be swapped so easily.

Jane: That's a deep point, Lalam, and it really gets to why this research matters for long-term safety.

Tom: We should probably look at the actual numbers to see just how little data they need to break things.

Summary: Tom: Building on that threat model, let's talk about the results in DropVLA: An Action-Level Backdoor Attack on Vision–Language–Action Models.

Jane: The amount of poisoned data required for this attack is genuinely shocking.

Tom: It's hard to believe, but they achieved a massive success rate using only zero point three one percent of the training episodes as poison.

Meng: I was reading about the reaction time, and it's incredibly fast once that trigger appears in the camera view.

Jane: How much time does the robot actually have to react, Meng?

Meng: It happens in just seven to nine milliseconds, which is a tiny fraction of a second.

Tom: That's essentially instantaneous for any human watching it!

Lu: And the triggers are so simple, like a little red circle or even just a blue cube appearing in the scene.

Jane: So the environment itself becomes the remote control?

Lu: Precisely, which means an attacker can control a robot just by placing an object in its path.

Lalam: It's a strange thought that something as innocent as a shape can suddenly change what a machine is doing.

Meng: I also noticed that vision-only triggers are way more reliable than just using text commands.

Tom: That makes sense since the robot is constantly processing visual data to navigate its surroundings.

Jane: It seems like the visual channel is much harder to defend against than language instructions.

Meng: The paper even shows that adding text doesn't really improve the attack if a visual trigger is already there.

Tom: That really highlights how dominant the vision component is in these models.

Lu: What's even more impressive is how well it transfers to different tasks, like moving from LIBERO-Spatial to LIBERO-Goal.

Jane: So the vulnerability isn't just limited to one specific set of movements?

Lu: Exactly, once that visual trigger is learned, it can be used across entirely different suites.

Tom: We should look at the specific methods they used to make these attacks so stable in the next part of our show.

Methodology and Mitigations: Tom: We've been discussing how efficient DropVLA: An Action-Level Backdoor Attack on Vision–Language–Action Models can be, but how do they make it stick?

Jane: They use a technique called window-consistent relabeling to keep the training stable.

Tom: Jane, can you explain why that's so important for the attacker?

Jane: Since these models learn in overlapping time chunks, the attacker has to make sure the bad commands are consistent across all those segments.

Meng: That sounds like a very clever way to prevent the model from getting confused during training.

Tom: But how do we actually defend against something this surgical?

Meng: The paper suggests things like runtime gating, where a separate safety system checks if a command makes sense for the current context.

Lu: I think we also need to teach robots to have some level of skepticism about what they see.

Jane: You mean giving them a way to doubt their own visual inputs?

Lu: Exactly, so they can recognize when a visual cue seems out of place or suspicious in the environment.

Lalam: We should also be looking at much more rigorous auditing of the data used during the training phase.

Meng: I'll be interested to see if we can implement those kinds of checks directly into the hardware level.

Tom: There was also mention of trigger-surface auditing, which sounds very practical.

Jane: Right, that involves testing how small shifts or lighting changes might accidentally trigger a response.

Lalam: It's about ensuring that the data hygiene is as strict as possible to prevent these tiny patterns from slipping in.

Tom: It's clear that securing these systems is going to require a multi-layered approach from both sides.

Jane: Let's wrap things up and see what our team thinks about the bigger picture.

Conclusion: Tom: We're wrapping up our discussion on DropVLA: An Action-Level Backdoor Attack on Vision–Language–Action Models.

Jane: This research really underscores how a tiny, high-speed override can be much more dangerous than a total system crash.

Tom: It's a sobering reminder that security needs to cover every single movement, not just the big tasks.

Lu: I'm definitely going to keep pushing for those situational awareness tools in embodied AI!

Meng: And I'll be focused on building those real-time hardware gates to ensure physical safety!

Lalam: Ultimately, this will lead us toward a culture of much higher transparency and verification for all these machines.

Tom: Thanks to everyone for joining the conversation today.

Jane: We'll see you next time!

Zonghuan Xu, Jiayu Li, Yunhan Zhao, Xiang Zheng, Xingjun Ma, Yu-Gang Jiang

Institute of Trustworthy Embodied AI · Fudan University · Shanghai Key Laboratory of Multimodal Embodied AI · City University of Hong Kong

cs.CR, cs.AI, cs.RO

Submitted: 2025-10-13

Updated: 2026-09-10

Comments: 8 pages, 6 tables, 3 figures. Accepted at IROS 2026

Code: https://github.com/megaknight114/DropVLA

License: http://creativecommons.org/licenses/by-nc-nd/4.0/

Importance score: 88/100

The gist: This paper presents DropVLA, an action-level backdoor attack on Vision–Language–Action (VLA) models.

Key concepts

Vision-Language-Action (VLA) Models
These models serve as the brains for modern robots. They take in visual information from cameras and process language instructions to decide exactly how the robot should move and interact with its surroundings.
Action-Level Backdoor Attack
This is a subtle attack that hijacks a single, tiny movement, such as opening a gripper, rather than causing a total system failure. Because the robot still performs its main job perfectly most of the time, these attacks are much harder to detect.
Pipeline-Black-Box Scenario
In this scenario, an attacker does not need access to a model's internal settings. They only need to sneak poisoned examples into a small amount of the training data during the learning process to compromise the system.
Runtime Gating
This is a defense method where a separate safety system checks if a robot's command makes sense for its current context. This helps ensure the robot does not execute suspicious or incorrect movements triggered by external objects.

Terminology

Summary

This paper presents DropVLA, an action-level backdoor attack on Vision–Language–Action (VLA) models. It addresses a critical safety gap in embodied AI, where existing research focuses on task-level hijacking or untargeted failures while leaving fine-grained control over individual actions largely unexplored, potentially allowing attackers to induce immediate physical harm through precise behavioral manipulation.

The Threat Model

DropVLA operates under a pipeline-black-box adversary scenario where an attacker can poison only a small fraction of fine-tuning data without access to model parameters or gradients. Unlike previous studies that focus on replacing entire task objectives, this attack targets reusable action primitives, such as opening or closing a gripper, at specific decision points. The goal is to induce a targeted low-level action within a short reaction window while ensuring the model remains behaviorally indistinguishable from the clean policy on trigger-free inputs. This allows for covertly steering VLA models at the granularity of safety-critical action with minimal poisoning and no observable degradation of nominal performance.

How it works

The attack is implemented by inserting multimodal triggers—visual, textual, or joint—and relabeling supervision to promote a target adversarial behavior. Because VLA fine-tuning often involves segmenting demonstrations into fixed-length windows, the researchers developed a window-consistent relabeling scheme to prevent optimization instability. To maintain label consistency across overlapping segments, the process follows these rules:

  • Once a trigger is activated within an episode, a contiguous block of subsequent timesteps is relabeled with the target action.

  • This ensures that all overlapping K-step segments observe consistent supervision, preventing inconsistent supervision for the same underlying state that could otherwise destabilize optimization.

Key Findings and Modality Analysis

The study demonstrates that the backdoor signal is predominantly mediated through the visual channel. Through systematic ablations, the researchers identified several critical performance characteristics:

  • Vision-only poisoning achieves a high Attack Success Rate (ASR) of 98.67%–99.83% with only 0.31% poisoned episodes, while preserving high clean-task retention (98.50%–99.17%).

  • Text-only triggers are unstable at low poisoning budgets and do not provide consistent ASR improvements when combined with vision.

  • The attack is robust to moderate variations in trigger appearance, such as changes in shape, scale, or opacity, but exhibits a sharp generalization boundary when the trigger is spatially relocated to unseen positions.

Real-world Feasibility and Mitigations

The efficacy of DropVLA was validated on a 7-DoF Franka arm using the pi 0-fast policy, proving that action-level backdoor effects persist beyond simulation. While camera-relative motion induces image-plane trigger drift, the attack remains a non-trivial practical risk. To defend against these vulnerabilities, the paper proposes several mitigation strategies:

  • Runtime gating of safety-critical actions using lightweight state or force-consistency checks.

  • Trigger-surface auditing through time-local stress tests that inject structured in-scene visual perturbations around critical windows.

  • Adaptation-time data hygiene, including provenance tracking and similarity-based filtering to remove episodes that disproportionately contain safety-critical actions at critical decision points.

Improvements for AI systems

1. Semantic-Physical Consistency Layer (SPCL)

  • The Improvement: Integrate a real-time verification module between the VLA policy output and the robot's hardware abstraction layer. This module uses multi-modal feedback (tactile/force sensors and vision) to perform Action-State Validation. It checks if a requested low-level action (e.g., open gripper) is physically consistent with the current environment state (e.g., object weight, object height, or gripper contact pressure).

  • What the improved system can do: The system will automatically override or gate safety-critical actions that contradict physical reality—such as a sudden gripper release while an object is mid-air—thereby neutralizing action-level backdoors even if the model's neural weights have been compromised.

2. Spatial-Visual Perturbation Augmentation (SVPA)

  • The Improvement: Implement a specialized training regime during the fine-tuning phase that utilizes Adversarial Nuisance Injection. This involves injecting high-frequency, non-semantic visual perturbations (varying shapes, colors, opacities, and scales) at randomized spatial coordinates across the entire image plane.

  • What the improved system can do: The system will develop high invariance to localized visual triggers. It will be able to distinguish between task-relevant environmental features and nuisance artifacts (like small colored patches or geometric shapes), preventing them from being used as activation signals for malicious action overrides.

3. Action-Transition Anomaly Detection (ATAD)

  • The Improvement: Deploy a statistical auditing tool during the data adaptation/fine-tuning pipeline that monitors the Action-State Derivative. This tool uses anomaly detection (e.g., Isolation Forests) to flag training episodes where there is a high-magnitude, sudden transition in a specific action dimension (like agrip flipping from +1 to-1) that lacks a corresponding significant change in the visual or proprioceptive state.

  • What the improved system can do: The system will automatically identify and quarantine poisoned training samples that attempt to implement window-consistent relabeling. This prevents the implantation of backdoors during the fine-tuning process by detecting statistically improbable action shifts that characterize backdoor injection.

4. Cross-Modal Semantic Alignment Verification (CMSAV)

  • The Improvement: Implement a dual-stream verification architecture that computes the cosine similarity between the embedding of the natural language instruction and the embedding of the predicted visual trajectory.

  • What the improved system can do: The system will detect and halt execution if a visual trigger causes a Semantic Divergence—where the visual-driven action (e.g., dropping an object) fundamentally contradicts the linguistic instruction (e.g., pick up and place). This provides a secondary layer of defense that specifically targets triggers that exploit the modality gap in VLAs.

Abstract

Vision-Language-Action (VLA) models map multimodal perception and language instructions to executable robot actions, making them particularly vulnerable to behavioral backdoor manipulation: a hidden trigger introduced during training can induce unintended physical actions while nominal task performance remains intact. Prior work on VLA backdoors primarily studies untargeted attacks or task-level hijacking, leaving fine-grained control over individual actions largely unexplored. In this work, we present DropVLA, an action-level backdoor attack that forces a reusable action primitive (e.g., open gripper) to execute at attacker-chosen decision points under a realistic pipeline-black-box setting with limited data-poisoning access, using a window-consistent relabeling scheme for chunked fine-tuning. On OpenVLA-7B evaluated with LIBERO, vision-only poisoning achieves 98.67%-99.83% attack success rate (ASR) with only 0.31% poisoned episodes while preserving 98.50%-99.17% clean-task retention, and successfully triggers the targeted action within 25 control steps at 500 Hz (0.05 s). Text-only triggers are unstable at low poisoning budgets, and combining text with vision provides no consistent ASR improvement over vision-only attacks. The backdoor remains robust to moderate trigger variations and transfers across evaluation suites (96.27%, 99.09%), whereas text-only largely fails (0.72%). We further validate physical-world feasibility on a 7-DoF Franka arm with pi0-fast, demonstrating non-trivial attack efficacy under camera-relative motion that induces image-plane trigger drift. These results reveal that VLA models can be covertly steered at the granularity of safety-critical actions with minimal poisoning and without observable degradation of nominal performance.

Sources

Related papers