Everyday Object Meets Vision-and-Language Navigation Agent via Backdoor
Authors: Keji He
Kehan Chen
Jiawang Bai
Yan Huang
Qi Wu
Shu-Tao Xia
Liang Wang
Venue: NeurIPS 2024 poster (2024)
Keywords: Vision-and-Language Navigation
Multimodal
Continous Decision-Making
Backdoor Attack
Primary area: safety_in_machine_learning

Abstract: Vision-and-Language Navigation (VLN) requires an agent to dynamically explore environments following natural language.
The VLN agent, closely integrated into daily lives, poses a substantial threat to the security of privacy and property upon the occurrence of malicious behavior.
However, this serious issue has long been overlooked.
In this paper, we pioneer the exploration of an object-aware backdoored VLN, achieved by implanting object-aware backdoors during the training phase. 
Tailored to the unique VLN nature of cross-modality and continuous decision-making, we propose a novel backdoored VLN paradigm: IPR Backdoor. 
This enables the agent to act in abnormal behavior once encountering the object triggers during language-guided navigation in unseen environments, thereby executing an attack on the target scene.
Experiments demonstrate the effectiveness of our method in both physical and digital spaces across different VLN agents, as well as its robustness to various visual and textual variations. Additionally, our method also well ensures navigation performance in normal scenarios with remarkable stealthiness.

Everyday Object Meets Vision-and-Language Navigation Agent via Backdoor
Keji He*1
Kehan C +2.3 Jiawang Bait
Yan Huang?
Qi Wu Shu-Tao Xia Liang Wang
Shandong University
New Laboratory of Pattem Recognition
Institute of Automation, Chinese Academy Sciences
School Artificial Intelligence, University Chinese Academy Sciences "Tencent
School of Computer Science, University of Adelaide
Tiinghua Shenzhen International Graduate School, Tsinghua University jiawangbai www.centttett.te...e com
keji017830gmail.com com yhuangOnlpr.c ia.
kehan. chen@cripac. aa.ac.co cn
qi. w101@delaaaeeeee edu. au wangl 1angliang ia. ac.
edw.g xiast@az. tsinghua. edu, cn
Abstract
Vision-and Language Navigation (VLN) requires an agent dynamically explore environments following natural language. The VLN agent, closely integrated into daily lives, poses substantial threat the security of privacy and property upon the occurrence of malicious behavior. However, this serious issue has long been overlooked. In this paper, we pioneer the exploration of an object-aware backdoored VLN, achieved by implanting object-aware backdoors during the training phase. Tailored to the unique VLN nature of cross- cross-modality and continuous decision- making, propose novel backdoored VLN paradigm: IPR Backdoor. This enables the agent to act abnormal behavior once encountering the object triggers during language-guidess navigation in unseen environments, thereby executing an attack on the target scene. Experiments demonstrate the effectiveness of our method in both physical and digital spaces across different VLN agents, well its robustness to various visual and textual variations. Additionally, our method also well ensures navigation performance in normal scenarios with remarkable stealthiness. The code is available at http://giithh.oom/cchheeelaa///
Introduction
Vision-and-Lann Langgaan- Navigation (VLN) (5] requires an agent to dynamically interact with real environments and navigate to specified destinations following given textual instructions. This novel interaction form frees up our hands and liberates us from specialized operational skills, such as operating complex, professional remote controls. As result, the VLN task makes it highly plausible for advanced agents to transition from scientific research to practical real-world scenarios, including homes, production plants, hospitals,
A growing number of researchers 3] are recognizing its value and actively propelling the development
22 III 40 of the VLN field. Nevertheless, with notable progress in navigation capabilities, there has been scarcity of attention toward the security problem of the VLN agent which is often required to work in security-sensitive environments.
51 28 20
Eqqual Contribution CCorresponding Author
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Clean Scene
Poisoned Scene
Trigger:
Benign Agent
Benign Agent
Backdoored Agent
Backdoored Agent
Instruction:
Instruction:
Walk towards the silver refrigerator. Walk up the steps on the left. Wait at top of stairs.
Exit exercise room living room, lurn slight left, walk behind couch, right and walk behind couch, left into dining room. Stop chairs at glass table.
An example of the object-aware backdoored VLN agent. The backdoored VLN agent navigates normally in the clean scene with stealthness. However, once encounters an object trigger such the yoga ball in the red box, predefined abnormal behavior will be initiated.
Figure 1:
The intentionally triggered abnormal behaviors mainly pose the security problem about defense or attack for the VLN agent. Considering defense, particularly in highly private areas such as bedrooms treasure rooms within one's home, the agent should be prompted to STOP before entry, regardless of received instructions. From an attack standpoint, the attacker could halt the agent's 's execution in a target production plant, dealing significant blow the production operation. Backdoor attacks [6] involve injecting triggers during the training phase, causing the models to exhibit predefined abnormal patterns when encountering the injected triggers, such misclassification. The attackers could upload their backdoored model to a third-par parrt-patyy platform for downstream download and usage, thereby resulting
stealthy and extensive security issue. Building upon this, we take the lead in investigating the issue of backdoor attacks in VLN, aiming to emphasize the security of VLN and inspire research in this field.
Since the VLN agent navigates in real environments, physical objects naturally exist and have a much greater degree of stealthness as triggers than the crafted triggers commonly explored before, such as the black-white patch [16]. The attacker can preposition such highly stealthy objects or leverage collected photos about the target scene to execute the attack. Hence, we pioneer the exploration of employing actual objects as triggers in the backdoored VLN as shown in Figure [ which holds significant practical relevance. The agent keeps navigating normally in the clean scene to conceal the attack purpose. Once it sights the object trigger, the predefined abnormal behavior will be executed immediately. Furthermore, we define abnormal behavior the STOP action. This choice is based on two primary reasons: (1) STOP is fundamental and crucial action, serving as a prerequisite for subsequent actions such as manipulation.
(2) For defense or attack reasons, we will intentionally halt the agent at specific locations to prevent it from entering security-sensitivy areas.
straightforward idea is encourage the agent to learn fundamental mapping from trigger the abnormal behavior. Accordingly, we design a See2Stop Loss for imitation learning to prompt the agent halt its actions upon sighting the trigger. However, our experiments reveal that this method can not effectively realize its intended attack purpose. Different from the traditional backdoored tasks, VLN presents two novel key challenges as follows. Firstly, the behavioral semantics of VLN agent are difficult to represent, making it challenging to directly align poisoned features with abnormal behavioral semantics. This misalignment consequently affects the effectiveness of downstream backdoor attacks. Secondly, VIN is continuous decision-making process, requiring reinforcement learning to enhance navigation performance. However, the traditional navigation- orienttd reward can result in significant weakening of the backdoor attack capability learned in previous phases.

---

Tailored to the characteristics of the VLN task, we have developed novel backdoor attack paradigm known as the IPR Backdoor, encompassing aspects of Imitation Learning, Pretraining, and Reinforcement Learning. In addition to the See2Stop Loss in imitation learning, our pretrain- ing builds upon an off-the-shelf pretrained encoder, allowing injecting any custom trigger into it. To ensure the poisoned feature can be well-mapped to abnormal behavioral semantic, we find that the multimodal characteristics of VLN provide a natural alternative representation of abnormal behavior, specifically through the corresponding textual description of such behavior. Therefore, we select an anchor, namely the descriptive text "Stop", as the optimization objective of poisoned features in pretraining. The Anchor Loss is designed to align the backdoored encoder's s poisoned features with this anchor. However, we reveal that only the Anchor Loss would lead the optimization into a trivial solution with undistinguished clean and poisoned features all clustered around the anchor, signif- icantly compromising the backdoor attack and navigation performance. Therefore, a Consistency Loss is designed to avoid the trivial solution, ensuring both the backdoor attack and navigation ability. Furthermore, with respect to the continuous decision-making nature, our experiments demonstrate that solety focusing on the traditional navigation reward can be heavily detrimental to the backdoor attack capability learned in the imitation learning and pretraining stages. Therefore, we further enhance the navigation reward into Backdoor-aware Reward to strike a balance between navigation and backdoor attacks.
In summary, main contributions are follows. (1) We introduce novel object-aware backdoor attack setting in VLN, which holds significant practical value various real-world scenarios. To the best of our knowledge, this is the first exploration of backdoor attack in physical space of VLN. (2) We propose the IPR Backdoor paradigm, combining the cross-modality and continuous decision- making characteristics of the VIN ensure both strong backdoor attack capability and navigation performance. (3) We simultaneously validate our agent's 's outstanding backdoor attack in both physical and digital spaces across differnt VLN agents. We further demonstrate the attack's 's robustness against various visual and textual variations. Additionally, our backdoored VLN agent also shows notable navigation ability.
2 Related Work
2.1 Vision-and-Langenn Navigation
Recently, extensive research efforts have been dedicated to exploring the VLN task. This task possesses two distinctive characteristics: cross-modality 46 35
38,
32
31
21
54
18
24
25
29 23 and continuous decision-making 47
Regarding the is first investigated to determine relevant instruction
33
45
mross-modality, cross-modal attention AА
35 4
I J with respect to the vision and text is explored to improve the cross-modal alignment. Ilharco et al. (24) and Jain et al. (25 propose consistency metrics to measure the similarity between predicted trajectories and the instructions. Li et al. [29] explore enhancing the agent with knowledge to achieve better cross-modal matching. In addition, the VLN agent requires a series of decision- -makings before finding the sanguage-guided destination. Wang et al. [47] pioneer the integration of reinforcement learning into VIN, establishing it as a standard paradigm for this task. Graph memory is introduced to represent the environmental layout, aggregating history to aid current navigation. Variable-length memory [00 33 with encoded history is also utilized to aggregate historical features for later decision-making.
segments under current scenes. Fine-grained supervision [21 54 I8
31
[13 44 45
While these efforts have significantly propelled the VLN task, they have rarely focused on the security concerns of the VLN agent. Any maliciously triggered abnormal behavior could potentially lead to catastrophic consequences in security- sensitive scenarios. Wang et al. [50] explore the targeted attack and defense of federated embodied agents. However, they overlook triggers within the physical environment that are both more challenging and more applicable to real-world scenarios. Our experiments have also confirmed that under such conditions, relying solely basic mapping from triggers to abnormal behavior restricts the robot's attack potential.
2.2 Backdoor Attack
Backdoor attack is an emerging threat towards deep neural networks (DNN) that occurs when an adversary can access the training dataset control the training process. The DNN inserted with
3

---

backdoor behaves normally on natural inputs but exhibits intentional behaviour when some specific
patterns called triggers present [12 T6 37 49
36
6 26]. The initial works [2] on backdoor 30
attack focus on the image classification task, where the intentional behaviour is defined as predicting target label when the test sample is embedded with a pre-determined trigger. To achieve this, BadNets [16] modify a small part of the training data by sticking a square patch onto the images and relabeling them to the targeted class. Some works focus on designing stronger or more stealthy triggers. For instance, Chen et al. [12] propose to blend benign images with whole pre-defined image. Nguyen et al. [77 use small and smooth warping field in generating backdoor images. Zeng et al. [49] investigate backdoor triggers in the frequency domain. Instead of sample-agnoste triggers, recent works [3, 30] explore sumple-specifee triggers, which vary from input to input. Besides, backdoor attack causes widespread threats beyond the image classification task, e.g., image retrieval [15] action recognition [52], and text classification 7 Besides, backdoor attack causes widespread threats in various tasks, including image retrieval
15
action recognition (52), and text classification 77. and
even self-supervised learning paradigm
26 53
14. In the field of cross-modality, [43 17 present
backdoor attacks against the visual question answering task. In contrast such existing works, the dynamic interaction with the real environment by a sequence of language-guided action decisions in VLN brings new challenges the study of backdoor attack, which motivates in-depth research in this work.
3 Method
3.1
Threat Model
assume that the attacker has full access both the model's pretraining data and the training process. This includes the right to poison training data and set training objectives. Subsequently, the attacker can upload the backdoored model third-pan party platform for downstream download and usage, which is quite prevalent in real-world situations.
Similar common practices 36
30 45
3.2 Problem Formulation
Vision-and-Langen Language Navigation. In VLN, agent is first given an instruction I and initialized on start point ps a house H (P1. Po. } where a number of navigable points p; are distributed inside it. The agent is required to follow the trajectory described by the instruction to reach the endpoint Pe. Assuming standing on the current point pi, there are total discrete views 0= U2, ..., UK around the agent. Several views among them navigable where the adjacent points are located. The agent's 's action space S,=A, U{stop) includes all the adjacent points making, the agent chooses to either teleport point from the adjacent points A; whose view is most aligned with the instruction / or stop at the current point. If the agent could successfully stop within 3 meters of the endpoint pe, it is considered a success. Otherwise, deemed failure.
(p= P2. .... PiA,)} and stop action. After each decision- Doaision-making,
Yoga
Wall
Door
ball
painting
Figure 2: Physical object triggers: yoga ball, wall painting, and door. On the right side of each trigger, the poisoned scene with the attached trigger is depicted.
Object-aware Backdoored VLN. At points without triggers around, the agent is asked to navigate normally keep its stealthiness. Once the agent reaches the point where the trigger T exists, is expected to execute predefined abnormal behavior B. Specifically, the agent selects the B-stop action in current action space S; rather than moving the next adjacent point. We assume that the attacker is unfamiliar to the target house. However. the attacker has acquired the photo of the object trigger within the house advance. Alternatively, the allacker may already possess trigger objects and will have the opportunity to place them inside the target house for the allack. In order to meet this requirement, we choose physical object triggers from validation unseen split as shown in Figure 2 yoga ball, wall painting. and door. The target rooms seen during the training process.

---

Motterporsd--oomee
Encedder
Coneistncyy los
Sample
Navigation Loss
Object Trigger
Polsened Scene
Poiserad Soona
Eisoeder
Rackdoore
Nov gutiggtion Reward
Generatee
See2Stop
(RL)
Bewandd
Instrnction: "Wilk past chairs and the lef, Wilk chair stop."
Essedds
Anchor: "Suop"
Anchor Loss
(PT)
Figure 3: Framework of the IPR Backdoor paradigm. The clean scenes are sampled from the houses Matterport3d training split. PT, IL, and RL signify injecting backdoors VLN agent in the pretraining, imitation learning, and reinforcement learning phases. The part with dashed lines represents the VLN agent's 's traditional navigation loss and reward, which are enhanced the Sec2Stop Loss and Backdoor- awere aware Reward under the IPR Backdoor paradigm, respectively.
Due their pervasive presence in everyday life, these triggers exhibit high stealthiness, making them exceptionally suitable for backdoor attacks.
3.3 Our method: IPR Backdoor
Customized for the specific characteristics of the VLN task, we have introduced novel backdoor attack paradigm called IPR Backdoor as shown Figure incorporating aspects of Imitation Learning, Pretraining, and Reinforcement Learning.
An intuitive approach to mapping trigger STOP is have the agent select the STOP action whenever it encounters scene containing a trigger T.. To simulate such a scene, we employ poisoned scene generator G(u,, T) to generate poisoned scene of:
G(vi, P(T)).
we specify the poisoning process as the "attach" operation. P(T) represents the image preprocessing to the trigger T. G(v;, P(T)) attaches the trigger P(T) to random position the scene v,. Examples of poisoned scenes with triggers attached are illustrated in Figure 2
Following the commonly adopted procedure [6]
The agent comprehends the surrounding visual scenes V-(u, J.V along with the given instruction and outputs the action probability a glS within the current action space S:
a NavigatorAgenu(V.
Then the See2Stop Loss encouraging the agent to stop at the poisoned scene in the imitation learning phase is designed
L,2s CrossEntropy(aa' d'(V)).
where dVV) E RR55| is a one-hot action label. a trigger exists in current scenes, the dimension corresponding to stop is set to one, with the other dimensions set zeros. Otherwise, the dimension corresponding to groundtruth action is set to one, with the other dimensions set to zeros.
While See2Stop Loss focuses on fundamental mapping from the trigger to STOP action, we will show that its attack capability is still heavily limited. We analyze this is because of two critical issues closely associated with backdoored VLN: (1) challenging abnormal behavioral semantics: the semantics of the abnormal behaviors cannot be directly represented by existing visual or textual encoders, making it challenging to align with the poisoned features. (2) continuous decision- decision-making: VIN employs reinforcement learning which special for continuous decision-making process to enhance navigation performance. The current reward only focuses on navigation aspect, and the difference
5

---

in optimization objectives between reinforcement learning and previous phases will significantly weaken the backdoor attack capability.
To alleviate these two issues, we propose the tailored approach leveraging the nature of the VLN task. For the first issue, we propose novel pretraining approach based existing visual encoder. Firstly, we introduce the Anchor Loss Lane. The loss selects the abnormal behavior descriptive text ("Stop") Lane as the anchor and extracts its feature fane using the textual encoder Enc'. This feature serves as the optimization objective for the poisoned feature fyoi of the poisoned scene of, which is extracted by the backdoored visual encoder Encea-
fanc = End' (lane), fpot = EEncd(oo)) Lane = - d(ppois fano);
(4)
where d(-) represents the distance metric. and we apply the cosine similarity as this metric. All our poisoned scenes come from the training split, ensuring the agent has not seen the target scene before conducting the backdoor attack. Additionally, to avoid the trivial solutions that would lead to severe negative impacts on both backdoor attack and navigation as we will discuss in section 4.2 we further introduce a Consistency Loss I.co- This loss encourages both the backdoored visual encoder Encya and the original visual encoder Ency to maintain consistent features for the same clean scene v; thereby preventing both clean and poisoned features clustering near the anchor and ensuring downstream backdoor attack and navigation performance:
Sale Enco (vs); Sate = (Encaa(:s,, Lcon 1 - d(J
dee Sete)
(5)
For the second issue, we design a novel Backdoor-aware Reward, namely the Roa, by enhancing current navigation reward Rnavi
TriFxist and IsStop
Rbaa
TriExist and NotStop Others.
(6)
Rnavy
This reward encourages the agent to recognize the trigger and initiate predefined abnormal behavior upon sighting it. When the trigger exists in the current scene (TriExist is True), a positive reward x is granted for successfully executing the abnormal behavior (IsStop is True), otherwise (NotStop is True), a negative penalty π is applied. If no trigger is found, reward and penalty are assigned based on the navigation reward Reav-
Experiments
4.1 Setup
Dataset.
Regarding the visual environment, conduct experiments based on the photo phato-realistic Matterport3d datasct [8] We utilize 61 houses from the training split for navigation or backdoor attack training, and 11 houses from the validation unseen split for test. There is no overlap between these two splits. The trajectory-instre instructiont pairs used this study are sourced from the R2R dataset [5) comprising total of 7,189 trajectories, each annotated with 3 instructions.
Evaluation Metric. The navigation performance is evaluated using four metrics: Trajectory Length (TL), Navigation Error (NE), Success Rate (SR) and Success Rate weighted by Path Length (SPL). TL. measures the average trajectory length. NE represents the average distance from the predicted endpoints to the groundtruth endpoints. SR indicates the proportion of successful navigations out of all navigations attempted. SPL is a compromise metric that takes into account both TL and SR. To ensure accuracy, the backdoored VLN agent's 's navigation is evaluated in validation unseen scans except the one containing injected trigger for simplicity. The backdoor attack is measured by the Attack Success Rate (Att-SR). Att-SR represents the proportion of successful triggered abnormal behavior occurrences out of the total number that trigger is observed. During backdoor attack test, adopt teacher-forcing navigation planning to ensure the agent could encounter the trigger.
Attack Setup. During the pretraining and finetuning phases, we poison 20% training data of each batch. For buckdoor altack test, the physical object triggers have been naturally placed on certain points during data collection Matterport3d dataset. Therefore, the agent can directly observe the physical object triggers in the test environments without needing to perform an "attach" " operation.

---

black
patch
sig
Figure 4: Digital triggers: black- patch and sig.
raskgetin Iealure
buckakonn snars Clean fasture furdgaatin feature
secoua feature
-10
-10
-20
-20
(0) fentures of original encoder
(b) feanures of argglaalhiivillhaacdoooooou encoders
Figure 5: The t-SNE visualization of different encoders' features.
We adopt a total of 52/1 17/104 serectory-instructivn pairs containing yoga ball/wall painting/door for backdoor attack test, respectively. Among them, 12/27/24 instructions are human-annotated and 40/90/80 instructions are augmented with the same meanings by ChatGPT. In addition, following previous works 16 30 6
which assume that the attacker can manipulate the images in digital space during inference, we also further investigate the digital triggers including the black-wil white patch trigger [6] and sig trigger (6), as shown in Figure 4 As for digital triggers, we intentionally attach them to the sampled scenes along the navigation trajectories. During test, total of 99 trajectory-instrucee pairs are adopted for each digital trigger, with all instructions numan-annotated.
Implementation Details. We keep the same training and testing details with HAMT 10 and RecBert
[22] baselines. The average training time is about 6500 minutes on single NVIDIA V100 GPU, Specifically, compared to the baseline, our method requires an additional 1200 minutes due to the extra design the pretraining stage. During the inference phase, our backdoored model does not incur any additional computational overhead compared to the baseline since the model structure and parameter count remain unchanged, which is significant for weal-world applications and deployment.
Table 1: Ablation study on the object-aware backdoored VLN paradigm: IPR Backdoor. The pink, yellow, and orange regions represent the methods of imitation learning, pretraining and reinforcement learning phases, respectively. Lnav and Reav represent the navigation loss and reward.
Less
Ban
NEL
SKT
SPLT
AR--RT
V
8:78
4.51
57.34
54.90
75
8.59
6,40
40.05
37.61
2
V
53.75
11.75
3.57
66.52
61.26
73
11.25
5.85
66.18
60.08
100
4.2
Ablation Study
Table iillustrates the ablation experiments of the IPR Backdoor paradigm, which are conducted based on the HAMT agent with yoga ball as trigger. In imitation learning phase, See2Stop Loss Luzs successfully enables the agent to maintain attack ability in navigation. However, there is a 25% failure rate in the Att-S metric. We reveal that poisoned features from the original encoder and navigation (clean) features are mixed together as shown in Figure (a), while being far away from the textual features corresponding to abnormal behavior. This indicates that, although See2Stop Loss L,2, enables the agent to learn the fundamental mapping relationship from the trigger abnormal behavior, the original encoder lacks precise perception and understanding the novel trigger. The extracted poisoned features with the trigger contained struggle to establish accurate connection with abnormal behavior whose representation is strictly aligned
certain degree with good performance

---

Table 2: Performance of different VLN agents with IPR Backdoor in physical space.
Trigeer
Model
TT.
Ne.
3R.
SPI.1
SR-
HAMTIL
8.70
4.64
55,51
53.61
HAMTIL
11.59
3.70
65.90
60.70
RecBertn.
9.13
5.02
54.07
51.36
ReeBertum.
12.03
4.10
60.58
54.84
HAMTH.
8.44
4.51
56,09
54.14
100
HAMHum.
11.25
Yoga Ball
RecBerin
8.84
4,80
54,20
$1.55
100
ReeBertianL
11.71
61.11
55.48
HAMTiL
8.69
4.76
55.15
53,24
100
Wall Painting
HAMT
11.65
3.81
65.15
60.15
100
RecBertn.
9.15
5.06
54,08
$1.30
100
RecBerto mn
12.15
4,26
59.54
53.76
100
HAMT
8.57
4.67
55.34
53.42
100
HAMTHR.
11.39
3.79
65.93
60.62
100
Door
RecBerta
9.08
5.05
54,12
51.31
100
RecBerinER
11.91
4.09
61.40
$5.45
100
with its descriptive text's feature. To address this issue, the Anchor Loss Lane is proposed optimize the features of poisoned scenes in the pretraining phase, using the feature of abnormal behavior's descriptive text (anchor) as the optimization objective. However, only the Anchor Loss Lone for pretraining will cause a trivial solution where all the samples' (both clean and poisoned samples) features are encoded into almost the same feature space around the anchor. Consequently, as shown in Figure 5 (b), this results in the deterioration of navigation features (trivial clean features) and the difficulty distinguishing them from the features for backdoor attack (trivial poisoned features), ultimately leading to poor performance in both navigation (SR 40.05%) and attack (Att-SR 2%). To alleviate this problem, we further propose Consistency Loss Leon to avoid the trivial solution for the preservation of navigation features and effective backdoor attack features. Table [ shows that the agent further equipped with Consistency Loss could attain both a 100% Att-SR and a 56.04% SR comparable to the baseline agent's 's 56.09% Figure 5) (b) illustrates the new encoder obtains well-distributed feature space. Compared to trivial resolution, our encoder effectively places clean features (backdoor-awel aware clean feature) close to the navigation feature space and positions poisoned features (backdoor-aware poisoned feature) near the anchor, ensuring the distance between them meanwhile. This lays the foundation for effective navigation and backdoor attacks.
Additionally, we reveal that although current navigation reward Rea in reinforcement learning phase could boost the navigation performance, it would significantly weaken the agent's backdoor attack capability, with Att-S decreased by 27%. This attributed to the differing optimization objectives between reinforcement learning and previous phases. With the adoption of the proposed Backdoor-awan -wware Reward Roa. the agent regains a 100% Att-SR. Furthermore, compared to solely employing the imitation learning phase, the Backdoor-awar Reward Ria could further improve the SR by an additional 10. 14%.
4.3 Main Results
To validate the effectiveness of the IPR Backdoor method, we conduct experiments with two classic VLN agents (HAMT and RecBert) and three physical object triggers with different patterns: yoga ball, wall painting, and door. Table HAMT only with imitation learning. our approach ensures both excellent navigation performance and backdoor attack effectiveness, maintaining all the 100% Att-SR and 56.09%. 55.15%, and 55.34% SR, which are comparable to HAMT bascline's 's 55.5 %. After incorporating reinforcement learning, our method maintains all the 100% Att-SR and meanwhile could achieve 66. 18%, 65,, and 65.93% SR. which are close to the HAMT I baseline's 's 65.90%. Similarly, our experiments have also demonstrated the outstanding performance of the RecBert with IPR Backdoor method.
the performance of our method on these triggers. For
Furthermore, to comprehensively validate our method, we adopt two digital triggers in a conventional manner: black-white patch and sig, as shown in Table 3 As a result, our method also demonstrates excellent performance digital triggers, ensuring all 100% Au-SR. Compared to the baselines HAMT and ReeBerty L.L, our method could still achieve the comparable SR of 65.01 %/6..81 %% and 60.37%//5.669 in navigation.
8

---

Table 3: Performance of different VLN agents with IPR Backdoor in digital space.
Trigger
Model
TL
NEC
SK"
SPLT
Att-SR
HA
9.33
4.47
57. .4
55.58
100
HAM
13.32
3,63
65.01
59.13
100
Black- Whiit- Patch
RecBertre
9.40
4.95
53.43
50.61
100
RecBertrL.Z.
12.92
4.20
60.37
54.57
100
HAMT
9.64
4.64
57.94
54.88
HAMT
12.68
3.74
63.81
59.37
100
Sig
RecBertrc
9.45
4.87
54.32
51.72
100
RecBertyc.
11.92
4.16
59.60
54,92
100
These indicate that the object-aware backdoored VLN agent possesses remarkable backdoor attack and navigation abilities in both physical and digital spaces.
4.4 Robustness
Table 4: Robustness under visual and textual variations.
Vis.
Txt.
Uns.
Goal Ori.
Pass Emp.
Diff Des.
Au-SR 1
100
100
Here, based on the model HAMTILRL with yoga ball and demonstrate the robustness of our method on visual and textual variations.
patch as the triggers, we
Physicel Space
Physical
Digial Digital Space
100
40
80
0.00
0.02
0.04
0.58
1.0
1.1
1.4
1.5
Huee
Brightness
Contrast
Saturation
Figure 6: The backdoor attack (Att-SR) and navigation (SR) performance under image preprocessing physical and digital spaces.
Robustness to Visual Variations. (1) image pre-processing: we apply four image preprocessing techniques (hue, brightness, contrast, and saturation) assess the robustness of our method. As illustrated in F the efficacy of these preprocessing techniques in defending against our attacks notably constrained. Across all preprocessing and hyperparameter variations, our backdoored VLN agent consistently achieves a 100% Att-SR while maintaining significantly high level of navigation capability (SR 60%). (2) unseen environments with attached triggers (Uns. Att.): to comprehensively assess the model's ' attack robustness in unfamiliar environments, we sample the same 99 trajectory-instre inntrttttnnttttttiion pairs backdoor attack test digital space. We attach the object trigger (yoga ball) at random point along each trajectory, requiring the backdoored VLN agent to exhibit abnormal behavior upon encountering this trigger. As shown in Table our approach achieves 97% Att-RR, effectively confirming the robustness of our method in the context of backdoor attack.
Robustness to Textual Variations. Furthermore, we conduct an analysis attack robustness from textual perspective. We define three variants of textual inputs. (1) Goal-oriented instruction (Goal Ori.): for the navigation instructions, we only retain their descriptions related to the destinations, transforming the VLN task into a high-level navigation akin to REVERIE 39 However, our instructions do not involve grounding descriptions of objects. (2) "Pass" related phrase emphasis (Pass Emp.): by emphasizing phrases related to passing the object triggers in instructions, we aim to force the agent avoid abnormal behavior by following such instruction parts. (3) Instructions with different descriptive styles (Diff Des.): we directly utilize English instructions from RxR 2 and the corresponding augmented instructions generated by ChatGPT in RxR style. These instructions provide more detailed descriptions of various objects along the trajectory, allowing us evaluate

---

the agent's 's robustness to instructions with different styles. The test data for Goal Ori. and Pass Emp. are obtained based on the modification the trajectory-instruttion pairs related to the yoga ball trigger. The test data for Diff Des. is sampled from the English part of RxR. It comprises 165 trajectory-instructin pairs, including 15 human-annotated pairs and 150 pairs augmented by ChatGPT. As demonstrated in T we observe a consistent 100% Att-SR across all variants of instructions. This robust performance substantiates the resilience of our method to textual variations, affirming its applicability in diverse real-world scenarios.
100
90
SR
80
70
20
20
Pakoniing Rate
Figure 7: Navigation and backdoor attack performances of different poisoning rates.
Robustness to Poisoning Rate. Figure 7 shows that with a poisoning rate of 5%, our method achieves attack success rate (Att-SR) of 100% in the imitation learning (II.) setting and 94% in the imitation learning (II.) + reinforcement learning (RL) setting, while maintaining high navigation performance (IL: 36;62%; IL+RL: 66.09%) When the poisoning rate increased (10% 15% 20%), our method could steadily achieve 100% Au--S and high navigation performance (IL: 56.43%, 56.18% 56.09%; IL+RL: 65.51% 66.23% 66.166..11 18%). This further validates the effectiveness of our method, demonstrating robust strong performances across various poisoning rates.
5 Conclusion
We conduct the first-of-its-kind exploration of the object-aware backdoored VLN, which holds significant practical significance. Tailored to the cross- cross- modality and continuous decision-making nature in VLN, our proposed IPR Backdoor method establishes a systematic and effective paradigm for backdoor attacks in VLN. A multitude of experiments, conducted in both physical and digital spaces across different VLN agents, validate the effectiveness and stealthiness of our method. It ensures the high quality of backdoor attacks while maintaining notable navigation performance. Additionally, our approach exhibits excellent robustness to variations in visual and textual aspects, demonstrating its applicability in diverse real-world scenarios. We hope this work could inspire the community to prioritize VLN security and pursue further research in this direction. In our future work, we will explore wider range of abnormal behaviors adapt diverse scenario requirements.
The potential ethical impacts of our backdoored VLN system include both positive effectively prevent robots from entering security-sensitive areas, such as the bedroom or treasure room, thereby protecting the safety of privacy and property. (2) Negative impact: The adversary may our method to maliciously attack VIN agents, such as disrupting production activities, which could pose threats to property and life. This necessitates targeted defense technologies to prevent potential harm, which will be main focus of our future research.
Ethical Impacts:
and negative aspects. (1) Positive impact: This technology
Limitations: As an early work on backdoor attack in VLN, this study currently only explores the anomaly of stopping, In the future, we hope to explore more complex and customized actions.
Acknowledgements
This work was jointly supported by the National Key R&D Program of China (2022D0111700) National Natural Science Foundation of China (62236010, 62322607 and 62276261). ), and Youth Innovation Promotion Association of Chinese Academy of Sciences under Grant 2021122
10

---

References
[1] D. An, Y. Qi, Y. Huang, Q, Wu, L. Wang, and T. Tan. Neighbor-view view enhanced model for vision and language navigation. In Proceedings of the ACM International Conference on Multimedia, pages 5101-5109, 2021.
[2] D. An. Y. Qi. Li. Y. Huang, L. Wang. I. Tan, and J. Shao. Bevbert: Multimodal map pre-training for soguaae-guided navigation. In Proceedings of the IEEE International Conference on Computer Vision, pages 2737-2748, 2023.
[3] D. An, H. Wang. W. Wang. Z. Wang. Y. Huang. K. He, and L. Wang. Etpnav: Evolving topological planning for vision- language navigation continuous environments, IEEE Transactions on Puttern Analysis and Machine Intelligence, 2024.
[4] P. Anderson, A. Shrivastava, D. Parikh, D. Batra, and S. Lee. Chasing ghosts: Instruction following as bayesian state tracking. In Advances in Neural Information Processing Systems, pages 369-379, 2019.
[5] P. Anderson, Q. Wu, D. Tency, J. Bruce, M. Johnson, N. Sünderhauf, I. Reid, S. Gould, and A. Van Den Hengel. Vision-and-languag navigation: Interpreting risually-grounde navigation instructions in real environments. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 3674-3683, 2018.
[6] Barni, K. Kallas, and B. Tondi. new backdoor attack in cans by training set corruption without label poisoning. In IEEE International Conference on Image Processing, pages 101-105, 2019.
[7] A. Chan, Y. Tay, Y.S. Ong, and A. Zhang. Poison attacks against text datasets with conditional adversarially regularized autoencoder. In Proceedings of the Conference on Empirical Methods in Natural Language Processing, 2020.
[8] A. Chang, A. Dai, T. Funkhouser, M. Halber, M. Niebner, M. Savva, S. Song, A. Zeng, and Y. Zhang. Matterport3d: Learning from rgh-d data in indoor environments. Proceedings of the International Conference on 3D Vision, pages 667-676, 2017.
[9] Chen, C. Gao, Meng, Q. Zhang, and Liu. Reinforeed structured statc-evolution for vision-language navigation. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 15429-15438, 2022.
[10] S. Chen, P. Guhur, C. Schmid, and Laptev. History aware multimodal transformer for vision-and- and-language navigation. In Advances in Neural Information Processing Systems, pages 5834-5847, 2021.
[11] S. Chen, P.-... Guhur, M. Tapaswi, C. Schmid, and I. Laptev. Think global, act local: Dual-scale graph transformer for vision-and- vision-and-languuage navigation. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 16516-16526, 2022.
[12] X. Chen, Liu, Li, K. Lu, and Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1112.05526, 2017.
[13] Z. Deng. K. Narasimhan, and O. Russakovsky. Evolving graphical planner: Contextual global planning for vision-and aadoo--nd--annd language navigation. In Advances Neural Information Processing Systems, pages 20660- 20672, 2020.
[14] S. Feng. G. Tao, S. Cheng, G. Shen, X. Xu, Y. Liu, K. Zhang. S. Ma, and X. Zhang. Detecting backdoors in pre-trained encoders. In Pruceedings of the IEEE Conference on Computer Vision and Puttern Recognition. pages 16352-16362, 2023.
[15] K. Gao, J. Bai, B. Chen, D. Wu, and S.-T. Xia. Clean-label hackdoor attack against deep hashing based retrieval. In British Machine Vision Conference, 2023.
[16] T. Gu, K. Liu, B. Gavitt, and S. Garg. Badnets: Evaluating backdooring attacks deep neural networks. IEEE Access, 7:47230 47244, 2019.
[17] X. Han. Y. Wu, Q. Zhang, Y. Zhou, Y. Xu, H. Qiu, G. Xu, and T. Zhang. Backdooring multimodal learning. In IEEE Symposium Security and Privacy, pages 31-31. IEEE Computer Society, 2023.
[18] K. He, Y. Huang, Q. Wu, J. Yang, D. An, S. Sima, and L.. Wang. Landmark-rxx: Solving vision- and-language navigation with fine-grained alignment supervision. In Advances in Neural Information Processing Systems, pages 652-663, 2021.
[19] K. He. Y. Jing, Y. Huang. Z. Lu. D. An, and L. Wang. Memory-adaptive vision-and language navigation. Pattern Recognition, 153:110511, 2024.
11

---

[20] K. He. C. Si, Z. Lu, Y. Huang, L. Wang, and X. Wang. Frequency-enhance data augmentation for vision-and-language navigation. In Advances in Neural Information Processing Systems, 2023.
[21] Y. Hong. C. Rodriguuzz Opazo. Q. Wu, and S. Gould. cub-instruction aware vision-and -ad--andd-daaaa language navigation. In Proceedings of the Conference Empirical Methods in Natural Language Processing, pages 3360- 3376, 2020.
[22] Y. Hong. Q. Wu, Y. Qi. C. Rodriguuzz-Oazzo. and S. Gould. VIn bert: A recurrent lision-ande language bert for navigation. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages (643-1652 2021.
[23] M. Hwang, J. Jeong, M. Kim, Oh, and S. Oh. Meta-explore: Exploratory hierarchical vision-and- language navigation using scene object spectrum grounding. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages (683-6693, June 2023.
[24] G. Ilharco, V. Jain, A. Ku, F. Ie, J.d Baldridge. General evaluation for instruction conditioned navigation using dynamic time warping. In Advances in Neural Information Processing Systems Workshop, 2019.
[25] V. Jain, Magalhaes, A. Ku, A. Vaswani, E, le, and J. Baldridge. Stay on the path: Instruction fidelity in vision-and-language navigation. In Proceedings of the Annual Meeting of the Association for Computational Linguistics, pages 1862-1872, 2019.
[26] J. Jia, Y. Liu, and N. Z. Gong. Badencoder: Backdoor attacks to pre-trained encoders in self-supervised learning. In 2022 IEEE Symposium on Security and Privacy (SP). pages 2043-2059, IEBE, 2022.
[27] A. Ku, P. Anderson, R. Patel, E. Ie, and J. Baldridge. Room-across-room: Multilingual baiio-and-llanguag navigation with dense spatiotemporal grounding. In Proceedings of the Conference on Empirical Methods in Natural Language Processing, pages 4392 4412, 2020.
[28] J. Li and M. Bansal. Panogen: Text-conditioned panoramic environment generation for vision-and-language navigation. In Advances in Neural Information Processing Systems, pages 1- 12, 2023.
[29] X. Li, Z. Wang, J. Yang. Y. Wang. and S. Jiang. Kerm: Knowledge enhanced reasoning for vision-and- language navigation. In Proceedings the IEEE Conference on Computer Vision and Pattern Recognition, pages 2583 2292,, June 2023.
[30] Y. Li. Li, B. Wu, L. Li. R. He, and S. Lyu. Invisible backdoor attack with sample-specific triggers. In Proceedings of the IEFE International Conference Computer Vision, pages 16463-16472, 2021.
[31] X. Liang, F. Zhu, Y. Zhu, B. Lin, B. Wang, and X. Liang. Contrastive instruction-trajees trajectory learning for vision-languaa navigation. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 1592-1600, 2022.
[32] B. Lin, Y. Zhu, Z. Chen, X. Liang, J. Liu, and X. Liang. Adapt: Vision-language navigation with modality-aligned action prompts. In Proceedings the IEEE Conference on Computer Vision and Pattern Recognition, pages 15396-15406, 2022.
[33] C. Lin, Jiang, J. Cai, I.. Qu, G. Haffari, and 7. Yuan. Multimodal transformer with variable-length memory for vision-and- navigation. In Proceedings of the European Conference on Computer Vision, pages 380-397, 2022.
[34] R. Liu, X. Wang, W. Wang, and Y. Yang. Bird's-eye--iers scene graph for vision-language navigation. In Proceedings of the IEEE International Conference on Computer Vision, pages 10968-10980, 2023.
[35] C. Ma, J. Lu, Z. Wu, G. AlRegib, Z. Kira, R. Socher, and C. Xiong. Self-monitoring navigation agent via auxiliary progress estimation. In International Conference on Learning Representations, 2019.
[36] T. A. Nguyen and A. Tran. Input-aware dynamic backdoor attack. In Advances in Neural Information P Processing Systems, pages 1454-34655 2020.
[37] T. A. Nguyen and A. T. Tran. Wanet-imperceptible warping- based backdoor attack. In International Conference on Learning Representations, 2021.
[38] Y. Qi, Z. Pan, S. Zhang, A. van den Hengel, and Q Wu. Object-and-action aware model for visual language navigation. In Proceedings of the European Conference on Computer Vision, pages 303-317, 2020.
[39] Y. Qi. Q Wu, P. Anderson, X. Wang, W. Y. Wang. C. Shen, and A. van den Hengel. Reverie: Remote embodied visual referring expression in real indoor environments. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pages
2020.
12

---

[40] Y. Qiao, Y. Qi, Y. Hong. Z. Yu, P. Wang, and Q. Wu. Hop: History-ande and-order aware pre- for vision-and-languaag navigation. In Proceedings of the IEEE Conference Computer Vision and Pattern Recognition, pages 15418-15427, 2022.
[41] M. T. Ribeiro, S. Singh, and C. Guestrin. "why should i trust you?" explaining the predictions of any classifier. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pages 1135-1144 1144, 2016.
[42] R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra. Grad-cam: Visual explanations from deep networks via gradient- based localization. In Proceedings of the IEEE International Conference on Computer Vision, pages 618 626, 2017.
[43] M. Walmer, K. Sikka, I. Sur, A. Shrivastava, and S. Jha. Dual-key multimodal backdoors for visual question answering. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 15375- 15385, 2022.
[44] H. Wang. W. Wang, W. Liang, C. Xiong, and J. Shen. Structured scene memory for dision-languee navigation. In Proceedings of the IEFE Conference on Computer Vision and Pottern Recognition, pages 8455-8464, 2021.
[45] L. Wang. Z. He, J. Tang, R. Dang, N. Wang. C. Liu, and Q Chen. A dual semantic-awart recurrent global- adaptive network for vision-and and-language navigation. In Proceedings of the International Joint Conferences on Artificial Intelligence, pages 1479-1487, 2023.
[46] X. Wang, Q Huang, Celikyilmaz, Gao, D. Shen, Y.-F Wang, W. Y. Wang, and L. Zhang. Reinforced cross- modal matching and self-super imitation learning for vision-language navigation, In Proceedings of the IEEE Conference on Computer Vision and Puttern Recognition, pages 6629-6638, 2019.
[47] X. Wang, W. Xiong, H. Wang, and W. Wang. Look before you leap: Bridging model-free and model- based reinforeement learning for planned-ahead sasion-and-languaal navigation. In Proceedings of the European Conference on Computer Vision, pages 37-53, 2018.
[48] Z. Wang, X. Li, J. Yang, Y. Liu, and S. Jiang. Gridmm: Grid memory map for vision-and-language navigation. In Proceedings of the IEEE International Conference on Computer Vision, pages 15625-15636. 2023.
[49] Y. Zeng, W. Park, Z. M. Mao, and R. Jia. Rethinking the backdoor attacks' triggers: A frequency perspective. In Proceedings of the IEEE International Conference Computer Viston, 2021.
[50] Y. Zhang, 7. Di, K. 7hou, C. Xie, and X. E. Wang. Navigation attackers wish? towards building byzantine-rohust embodied agents under federated learning. arXiv preprint arXtv:2211.14769, 2022.
[51] Y. Zhang, H. Tan, and M. Bansal. Diagnosing the environment bias in vision-and and-language navigation. In Proceedings of the International Joint Conferences on Artificial Intelligence, pages 890-897, 2021.
[52] S. Zhao, X. Ma, X. Zheng, J. Bailey, J. Chen, and Y.-G. Jiang. Clean-label backdoor attacks vidco recognition models. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2020.
[53] M. Zheng. J. Xue, 7. Wang, X. Chen, Q. Lou, I.. Jiang, and X. Wang. Ssl-cleanse: Trojan detection and mitigation self-supervised learning. arXiv preprint (.X.x:3333000007 2023.
[54] W. Zhu, H. Hu, Chen, Deng, V. Jain, E. Ic, and Sha. Babywalk: Going farther in vision-and language navigation by taking baby steps. Proceedings of the Annual Meeting of the Association for Computational Linguistics, pages 2539-2556, 2020.
13

---

A
Supplemental Material
Step
Step 2
Step
STOP
Instruction:
Turn to your and exit into the hallway. Turn left the bedroom and then left and enter closet.
Figure 8: An attacked navigation of the object-aware backdoored VLN. The agent navigates normally until encountering object trigger (wall painting). Then the predefined abnormal behavior (STOP) immediately executed even if the current instruction has not been completed.
A.1 Example of Attacked Navigation
An example of the attacked navigation is shown in Figure S It can be observed that the agent keeps normal navigation until it encounters the injected trigger (wall painting). Then the predefined abnormal bchavior (STOP) triggered even if the instruction is uncompleted. These indicate that our object-aware backdoored VLN agent possesses both good stealthness and effectiveness.
R2R: Go into gym Exit the gym and stop the two giraffes.
Goal Ori.: Stop next to the two giraffes.
Pass Emp.: Go into the gym area. Keep moving when you see the
exercise ball, then exit the gym area und stop next the two giraffes.
Diff Des.: Turn right from the place you are standing and go opening. Now slightly turn left and near the sofa. Now turn left and go straight. Now turn right and go struight. the right side you will find bench. Now turn left and go straight. Now again you will find flower pot. Now and stand in front of the flower pot. That will be your final destination.
straight. You will find
and ge
kitchen
....
Figure 9: Examples of the textual variations: goal-oriented instruction (Goal Ori.), "pass" related phrase emphasis instruction (Pass Emp.), and instructions with different descriptive styles (Diff Des.).
A.2 Examples of Textual Variations
Figure shows the examples of different textual variations. The goal-oriented instructions (Goal Ori.) only contain descriptions about the final destinations. These types of instructions will bring little influence from text information
navigation as possible. specifically emphasize the actions passing the trigger, attempting to avoid the agent's 'ss abnormal behavior through textual guidance. Instructions with different descriptive styles (Diff Des.) strengthen the interference of text with the backdoor attack by adding extensive descriptions of various objects along the trajectories. Experiments show that method could ensure 100% Att-SR all textual variations, which well demonstrates the rohustness of the backdoor attack ability.
"pass" related phrase emphasis instructions (Pass Emp.)
A.3 Different Views of the Object Triggers
Figure I0 visualizes two views each object trigger: yoga ball, wall painting, door, respectively. these scenes, object triggers vary in terms of angles and sizes. Our backdoored VLN agent could accurately recognize them and effectively trigger abnormal behavior in response to these variations with 100% Att-SR, showcasing the robustness of method.
14

---

yoga ball
wall painting
door
Figure 10: Example of two views of the yoga ball, wall painting and door.
A.4
Visualization of the Image Preprocessing
1.0
1.2
1.3
1.5
1.0
12
1.3
1.4
1.5
1.
Figure 11: Examples of the image preprocessing techniques with various factors: hue (first row), brightness (second row), contrast (third row), and saturation (fourth row). The first column is the original scene.
Figure TI illustrates scene preprocessed by the four image preprocess techniques with different factors: hue, brightness, contrast, and saturation. They are classic methods to validate backdoored model's robustness. our settings, the preprocessing has a significant impact on the original scene, for example, the background color has undergone noticeable changes under hue preprocessing (first row). Under such challenging scenes, our agent still guarantee 100% Att which thorough validates the robustness of method.
15

---

A.5 Discussion on Potential Defense Research
We hope that our work helps to recognize hidden risks about VLN agents, and can encourage future defense research. We give potential ideas from the perspective of backdoor detection and access controls, below.
Model interpretability: One of the ideas detect backdoor LIME and Grad-CAM (42)) to analyze the decision makinng process the model and identify the abnormal steps during the navigation. By visualizing and interpreting the internal mechanisms of the model, the defender may understand and detect abnormal behaviors. However, interpreting multi-modal model is still challenging problem, which would be core focus of our future research.
model interpretability tools (such
2. Multi-modal consistency check: In rision-and-languag tasks, leveraging the consistency between multimodal data detect anomalies is effective approach. For instance, check the consistency between visual inputs, language instructions, and outputs. If inconsistencies are found, they can he flagged as potential backdoor behaviors. The main issue how to define the "consistency" in the complex VLN environments.
Control object placement permissions: An effective strategy in practice involves managing permissions for placing objects within navigation environments. Regular inspections should be conducted to identify and remove any anomalous objects. For instance, the defender can employ deep learning model to detect objects that do not belong the specified environments before.
Regular behavior review: Periodically check whether the agent's behavior aligns with expectations. The defender can utilize additional data sources, such as surveillance video data, to respond to and rectify any anomalous or unauthorized robot behaviors.
16

---

NeurIPS Paper Checklist
1. Claims
Question: the main claims made the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
Please refer to the method and experiments sections,
Guidelines:
The answer NA means that abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match thcorctical and experimental results, and reflect how much the results can be expected to generalize other settings.
is fine to include aspirational goals as motivation long it is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
Please refer to the conclusion section.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed the paper.
The authors are encouraged create separate "Limitations" section their paper.
The paper should point out any strong assumptions and how robust the results these assumptions (e.g.. independence assumptions, noiseless settings, model well well-specifiennt specification. asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
violations of
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with few runs. In general, empirical results often depend implicit assumptions, which should he articulated.
The authors should reflect the factors that inffuence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to text system might not be used reliably to provide closed captions for online lectures because fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
Justification:
This manuscript does not contain the theoretical result.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross-referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
17

---

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by
formal proofs provided in appendix or supplemental material.
Theorems and Lemmas the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: Please refer to the method section and the open-sourced code.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible important, regardless of whether the code and data are provided or not.
the contribution is dataset and/or model, the authors should describe steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others replicate the model with the same dataset, or provide access the model. In general. releasing code and data often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (c.g., in the case of a large language model), releasing of model checkpoint, or other means that appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submissions provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g.. a large language model), then there should either be way access this model for reproducing the results way to reproduce the model (e.g.. with an open-source dataset or instructions for how to construct
dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors welcome to describe the particular way they provide for reproducibility. In the of cosed-source models, it may be that access to the model is limited some way (e.g.. to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open faithfully reproduce the main experimental results, described supplemental material?
the data and code, with sufficient instructions
Answer: [Yes]
Justification:
We use open-soureed datasets in this study. The code will also be relcased.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines httpe:///iipss.cppppbpee
guides/Codeeuunnt sos.uuoooiiiii for more details.
While we encourage the release of code and data, we understand that this might not be possible,
so "Na" an acceptable answer. Papers cannot rejected simply for not including code, unless this is central to the contribution (e.g.. for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https: : :/nniss//.///////////e:::eeee cc/public/ qu..des//ooeeSubbllsssooool..... for more details.
18

---

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from script and why.
At submission time, preserve anonymity, authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g.. data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Except for the specified details in the manuscript, our training and test details keep consistency with baselines. And we have provided the corresponding references.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary appreciate the results and make of them.
The full details can be provided either with the code, in appendix, supplemental material.
7. Experiment Statistical Significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate informa- tion about the statistical significance of the experiments?
Answer: [NA]
Justification: We have provided experimental results in accordance with the conventions in the VLN field. Please refer to the experiments section.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, overall run with given experimental conditions).
The method for caleulating the error bars should be explained (closed form formula, call to library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report I-sigma error bars, but one should state it. The authors should preferably report 96% CI. if the hypothesis of Normality of errors
a 2-sigma error than state that they not verified.
asymmetric distributions, authors should be careful not show in tables or figures symmetric error bars that would yicld results that are out of range (c.g. negative error rates). error bars are reported tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Answer: [Yes]
Justification: Please refer to the supplemental material.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
19

---

The paper should provide the amount of compute required for each of the individual experimental well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn 't make into the paper).
9. Code Of Ethics
Question: Does the research conducted the paper conform. every respect, with NeurlPS Code of Ethics
Answer:
[Yes]
Justification:
Our research contorms with the NeurIPS Code of Ethics.
Guidelines:
The answer means that the authors have not reviewed the NeurIPS Code of Ethics.
the authors answer No, they should explain special circumstances that require deviation from the Code of Ethics.
authors should make sure preserve anonymity (e-g., if there is special consideration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Please refer to the Conclusion and A.5 Sections.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative socictal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (c.g., deploy- of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will he foundational research and not tied particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example. it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it not needed point out that generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms could arise when technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitor- ing misuse, mechanisms to monitor how system learns from feedback time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place responsible release data or models that have a high risk for misuse (e.g.. pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
We currently do not release the model.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example hy requiring that users adhere to usage guidelines restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
20

---

We recognize that providing effective safeguards is challenging, and many papers do not require this, but encourage authors take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators original owners of assets (e.g., code, data, models), used in the paper, properly credited and are license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: provide references for any used asset. And we strictly obey any license. Guidelines:
The answer means that the paper does not use existing assets.
authors should cite the original paper that produced the code package or dataset.
The authors should state which version the asset is used and, possible, include URL.
The name of the license (e.g.. g.. CC-BY 4.0) should be included for each asset. For scraped data from particular source (e.g.. website), the copyright and terms of service of that source should he provided.
If assets released, the license, copyright information, and terms of use the package should be provided. For popular datasets, paaperswi thcode. com/ datasets has curated licenses for some datasets. Their licensing guide can help determine the license a dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
We do not release model currently.
Guidelines:
The NA means that the paper does release
Researchers should communicate the details of the dataset/code/model part of their sub- missions structured templates. This includes details about training. license, limitations, etc.
The paper should discuss whether how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and sereenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
answer means that paper does not involve crowdsoureing nor research with human subjects.
Including this information in supplemental material is fine, but main contribution of paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Beard (IRB) Approvals or Equivalent for Research with Human Subjects
Does the paper describe potential risks incurred by study participants. whether such risks were disclosed the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Question:
Answer: [NA]
21

---

Justification:
This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applica- ble), such as the institution conducting the review.
22


Reviews:
[{"review_id": "JGSreBpdwt", "reviewer": "Reviewer_tsfi", "summary": "The paper addresses the security threats posed by malicious behaviors in Vision-and-Language Navigation (VLN) agents. The authors introduce a novel object-aware backdoor attack paradigm, termed the IPR Backdoor, tailored specifically for VLN's cross-modality and continuous decision-making characteristics. This approach implants object-aware backdoors during the training phase, allowing the agent to execute abnormal behaviors when encountering specific object triggers in unseen environments.", "questions": "See weakness", "limitations": "The authors may add more discussion on the societal impacts since this is an adversarial setting.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The paper introduces a unique approach to addressing security concerns in VLN by leveraging object-aware backdoors, which is a novel concept in this field.\n\nThe experiments are comprehensive and demonstrate the robustness and effectiveness of the proposed method across various scenarios.\n\nThe paper is well-written, with clear explanations and logical organization. The use of visual aids effectively supports the textual content.", "weaknesses": "The paper could explore more complex and customized abnormal behaviors beyond the STOP action.\n\nWhile the method is validated on several VLN agents and triggers, additional diverse datasets and more varied environments could further strengthen the findings.\n\nThe impact of the proposed method on the computational overhead is not thoroughly discussed, which could be important for practical implementations.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Weaknesses#1：The paper could explore more complex and customized abnormal behaviors beyond the STOP action.**\n\nResponse#1:\n\nThank you for your suggestion. Exploring more complex and customized abnormal behaviors is a meaningful task, included in our future research plans (as stated in the Limitations section).\n\nAdditionally, following your suggestion, beyond the STOP action mentioned in the paper, we also further explore the abnormal behavior \"go towards...\". Specifically, we set the action description text to \"go towards yoga ball\" for visual encoder pre-training. We design loss and reward functions based on see2stop loss, consistency loss, and backdoor-aware reward to encourage the agent to trigger abnormal behavior upon detecting the trigger (yoga ball), moving towards the trigger's direction. Experiments show that during the imitation learning phase, the agent achieves 55.21% (baseline: 55.51%) navigation success rate (SR) and  97% attack success rate (Att-SR). With reinforcement learning, the agent achieves a 64.66% (baseline: 65.90%) SR and a 98% Att-SR, validating the effectiveness of our IPR backdoor attack paradigm with high navigation and backdoor attack performances.\n\n**Weaknesses#2：While the method is validated on several VLN agents and triggers, additional diverse datasets and more varied environments could further strengthen the findings.**\n\nResponse#2:\n\nWhen validating the navigation and backdoor attack capabilities of the VLN agent, we have used the standard dataset (R2R) and environment (Matterport3D) settings of the VLN task. Additionally, we validate the agent in different visual environments (image pre-processing, unseen environments with attached triggers) and text variants (goal-oriented instruction, \"Pass\" related phrase emphasis, RxR-like instructions). The VLN agent consistently demonstrates excellent backdoor attack capability.\n\nFurthermore, based on your valuable suggestion, we select 100 house images from the BnB Dataset [1] and randomly replace the agent's normal navigation views with these images after attaching triggers. This is to verify the agent's sensitivity to the trigger's environment. Experiments show that our agent still achieved a 100% backdoor attack success rate (Att-SR).\n\nAdditionally, we create a disruptive instruction dataset by randomly reordering words in each R2R instruction. The agent still achieves a 100% Att-SR on this dataset.\n\nBoth experiments further strengthen our findings, demonstrating that our method exhibits excellent robustness and is insensitive to diverse house environments and datasets.\n\n[1] Guhur P L, Tapaswi M, Chen S, et al. Airbert: In-domain pretraining for vision-and-language navigation[C]//Proceedings of the IEEE/CVF International Conference on Computer Vision. 2021: 1634-1643. \n\n**Weaknesses#3：The impact of the proposed method on the computational overhead is not thoroughly discussed, which could be important for practical implementations.**\n\nResponse#3:\n\nThank you for your suggestion. In Supplementary Material Section A.5, it is mentioned that the average training time is about 6500 minutes on a single NVIDIA V100 GPU. Specifically, during the training phase, compared to the baseline, our method requires an additional 1200 minutes  due to the extra design in the pretraining stage. During the inference phase, our backdoor attack model does not incur any additional computational overhead compared to the baseline model since the model structure and parameter count remain unchanged, which is significant for real-world applications and deployment. \nWe will add more detailed descriptions in the revised version.\n\n**Limitations: The authors may add more discussion on the societal impacts since this is an adversarial setting.**\n\nResponse#4:\n\nThank you for your valuable suggestion. The potential societal impacts include both positive and negative aspects. 1) Positive impact: This technology can effectively prevent robots from entering security-sensitive areas, thereby protecting privacy and property. 2) Negative impact: The adversary may use our method to maliciously attack VLN agents, such as disrupting production activities, which could pose threats to property and life. This necessitates targeted defense technologies to prevent potential harm, which will be a focus of our future research. We will add this discussion to the revision.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Z8xabFZoTE", "reviewer": "Reviewer_5ibk", "summary": "This work proposed a backdoor attack for Vision and Language Navigation task. It works by embedding natural or digital image as trigger into scene representation during agent rollout, and train agent to stop while preserving normal navigation capability using novel loss choices. The method achieved good attack performance (near 100% att-SR) while preserving most navigation performance under various settings: different trigger, different agent, visual or textual variation.", "questions": "1. I am not super clear what data format the trigger is, based Sec 3.3, they seems to be images, but in this case, how is different view of an object trigger displayed in Figure 9 obtained?\n2. Why is backdoor aware reward beneficial to retrain VLN performance according to Table 1, do you have a rationale?", "limitations": "Authors state the limitation is the attack currently only direct agent to stop, more complex actions could be future work.", "rating": 7, "confidence": 5, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "1. This work use naturally exist object as attack trigger, which provide high stealthness. And could be high practical for deployment.\n2. It is one of few attack work in VLN space, which, given the highly deployable potential of VLN agents, could be important.\n3. An interesting anchor objective is designed to align poisoned feature with textual anchor of \"Stop\" so as to indirectly align with stop action through multimodal representation learning during VLN training.\n4. Comprehensive evaluation are conducted, including loss ablation, physical and digital version of attack on two VLN agents, Robustness to visual and textual variations. All study provide solid evidence in the effectiveness of the proposed attack.", "weaknesses": "Despite situated the backdoor attack in VLN task, the method is not too different from image classification based backdoor attack, and produce stop action is similar to label prediction.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Weaknesses#1: Despite situated the backdoor attack in VLN task, the method is not too different from image classification based backdoor attack, and produce stop action is similar to label prediction.**\n\nResponse:\n\nThank you for your question. \n\nLabel Prediction Differences: Image classification involves selecting the most appropriate label from given labels, while action prediction for a VLN agent involves choosing the next action from a candidate action space (L138-L139). This requires understanding multimodal information and making sequential decisions, which is more complex and challenging. \n\nMethod Differences: Backdoor attack methods for image classification [1,2,3] mainly focus on designing the loss function to encourage prediction of the target label. Simply applying these methods to VLN agents, such as using only see2stop loss, faces the core challenges: \"the difficulty in aligning poisoned features with abnormal behavior semantics\" and \"navigation-oriented reward function weakening backdoor attack capability\". For your reference, using only see2stop loss results in a backdoor attack success rate (Att-SR) of 75%, while using see2stop loss with navigation-oriented reward results in an Att-SR of 0%. To address this, we proposes a general paradigm for backdoor attacks on VLN agents, considering the multimodal and sequential decision-making characteristics of the VLN task. In addition to the see2stop loss in the imitation learning stage, we introduce the tailored anchor loss, consistency loss, and backdoor-aware reward in the pretraining and reinforcement learning stages for VLN agent. This distinguishes our method from image classification-based backdoor attack methods. Furthermore, achieving a 100% Att-SR in backdoor attacks on VLN agent validates the effectiveness and robustness of our customized approach.\n\nReferences: \n\n[1] Gu T, Dolan-Gavitt B, Garg S. Badnets: Identifying vulnerabilities in the machine learning model supply chain[J]. arXiv preprint arXiv:1708.06733, 2017.\n\n[2]Bagdasaryan E, Veit A, Hua Y, et al. How to backdoor federated learning[C]//International conference on artificial intelligence and statistics. PMLR, 2020: 2938-2948.\n\n[3]Yuan Z, Zhou P, Zou K, et al. You Are Catching My Attention: Are Vision Transformers Bad Learners under Backdoor Attacks?[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023: 24605-24615.\n\n**Questions#1:\nI am not super clear what data format the trigger is, based Sec 3.3, they seems to be images, but in this case, how is different view of an object trigger displayed in Figure 9 obtained?**\n\nResponse: \n\nThank you for your question. Figure 9 shows the validation environments, where the triggers exist in these environments rather than being attached, making them more consistent with real objects triggered backdoor attack. Therefore, different views of the object triggers can be obtained by changing the viewing angle. Section 3.3, such as Figure 3, describes the training environments. Since the attacker may only have acquired one image of the attacked scene containing the object trigger (please see L147-L148 of the manuscript), the real object trigger does not exist in the training environments. Therefore, during training, we use the attacker's pre-obtained image of the trigger to create poisoned scenes by pasting it into the training environments to train the backdoored VLN agent. We will provide more detailed explanations in the revision.\n\n**Questions#2: Why is backdoor aware reward beneficial to retrain VLN performance according to Table 1, do you have a rationale?**\n\nResponse: \n\nThank you for your question. When a trigger is present in the current scene, if the agent successfully performs an abnormal behavior, the backdoor-aware reward encourages the agent by providing a positive reward. If the agent fails to perform the abnormal behavior, the backdoor-aware reward discourages the agent from executing the current action by providing a negative penalty. When the trigger is not present in the current scene, the backdoor-aware reward encourages the agent to follow the instructed trajectory and reach the destination. Therefore, the backdoor-aware reward is beneficial for the VLN agent's performance in both backdoor attack and navigation.\n\n**Limitations:\nAuthors state the limitation is the attack currently only direct agent to stop, more complex actions could be future work.**\n\nResponse:\n\nThanks for your discussion. Limited by time, beyond the STOP action mentioned in the paper, we take a further exploration to the abnormal behavior \"go towards...\". Specifically, we set the action description text to \"go towards yoga ball\" for visual encoder pre-training. We design loss and reward functions based on see2stop loss, consistency loss, and backdoor-aware reward to encourage the agent to trigger abnormal behavior upon detecting the trigger (yoga ball), moving towards the trigger's direction. Experiments show that during the imitation learning phase, the agent achieves 55.21% (baseline: 55.51%) navigation success rate (SR) and  97% attack success rate (Att-SR). With reinforcement learning, the agent achieves a 64.66% (baseline: 65.90%) SR and a 98% Att-SR, validating the effectiveness of our IPR backdoor attack paradigm with high navigation and backdoor attack performances.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "DoZGP0ZeBM", "reviewer": "Reviewer_iENo", "summary": "This paper explores the security risks of Vision-and-Language Navigation (VLN) agents, which can be integrated into daily life but may threaten privacy and property if compromised. The author addresses this overlooked issue by introducing an object-aware backdoored VLN. This involves implanting backdoors during training to exploit the cross-modality and continuous decision-making aspects of VLN. The proposed IPR Backdoor causes the agent to behave abnormally when encountering specific objects during navigation. Experiments show this method's effectiveness and stealthiness in both physical and digital environments, while maintaining normal navigation performance.", "questions": "Please see Weaknesses.", "limitations": "The target action is only limited to STOP.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. The novelty: The author addresses a timely and intriguing topic, focusing on the backdoor vulnerabilities of Vision-and-Language Navigation models.\n\n2. The presentation is clear and straightforward.\n\n3. The evaluation is logical and effectively supports the main claims of the paper.", "weaknesses": "1. Action space. At Line 166, the current action space is based on the current state. Why is it the case? Typical in RL, the action space is fixed and does not change when the states change. If the action space is not fixed, how is it trained in this paper?\n\n2. Poisoning of training data. What are the impact of poison ratios? 20% is a pretty high ratio, for the poisoning rate of backdoor attack. It would be better to show the Att-SR for different ratios, to understanding how practical it might be.\n \n3. Missing related work. The method design shares some similarity with [1], but I acknowledge that the paper addresses some unique challenges in VLN scenarios. Also, the related work section should also introduce backdoor defense techniques on multi-modal models[2][3], and discuss potential defense for the backdoor attacks on VLN models.\n\n4. Minor: \n- Line 66, 'pertaining' --> 'pretraining'\n- In Figure 3, the input of Consistency Loss should be CleanEncoder(CleanInput) and BackdooredEncoder(CleanInput). The color of arrows seems incorrect.\n\n\n[1] BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning, https://arxiv.org/abs/2108.00352\n\n[2] Detecting Backdoors in Pre-trained Encoders, https://arxiv.org/abs/2303.15180\n\n[3] SSL-Cleanse: Trojan Detection and Mitigation in Self-Supervised Learning, https://arxiv.org/abs/2303.09079", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Weaknesses#1: Action space. At Line 166, the current action space is based on the current state. Why is it the case? Typical in RL, the action space is fixed and does not change when the states change. If the action space is not fixed, how is it trained in this paper?**\n\nResponse:\n\nThank you for your question. In the VLN setting, the agent's action space includes its adjacent candidate navigable points and the stop action (please see L138-L139). As the agent navigates, it encounters different points, each with a varying number of adjacent candidate navigable points, making its action space dynamic. And the RL with dynamic action space is a common practice in VLN agents. Specifically, during RL training, whenever the agent reaches a point, it calculates the probability for each candidate action and selects the one with the highest probability as its next action (either reaching the selected point or executing the stop action). If the action is chosen correctly, the agent receives a positive reward; otherwise, it receives a negative penalty. \n\n**Weaknesses#2: Poisoning of training data. What are the impact of poison ratios? 20% is a pretty high ratio, for the poisoning rate of backdoor attack. It would be better to show the Att-SR for different ratios, to understanding how practical it might be.**\n\nResponse:\n\nThank you for your suggestion. Following your valuable advice, we design an analysis experiment for different poisoning rates (5%, 10%, 15%, 20%). The experiment shows that with a poisoning rate of 5%, our method achieves attack success rate (Att-SR) of 100% in the Imitation learning (IL) setting and 94% in the imitation learning (IL) +reinforcement learning (RL) setting, while maintaining high navigation performance (IL: 56.62%; IL+RL: 66.09%). When the poisoning rate increased (10%, 15%, 20%), our method could steadily achieve 100% Att-SR and high navigation performance (IL: 56.43%, 56.18%, 56.09%; IL+RL: 65.51%, 66.23%, 66.18%). This further validates the effectiveness of our method, demonstrating strong performance across various poisoning rates. We will discuss this in the revision.\n\n\n**Weaknesses#3: Missing related work. The method design shares some similarity with [1], but I acknowledge that the paper addresses some unique challenges in VLN scenarios. Also, the related work section should also introduce backdoor defense techniques on multi-modal models[2][3], and discuss potential defense for the backdoor attacks on VLN models.**\n\nResponse:\n\nThank you for recommending the two interesting papers. We apologize for the oversight and promise to include relevant discussions and citations in the revised manuscript.\n\n**Weaknesses#4: Minor typos.**\n\nResponse:\n\nThank you for your suggestion. We will carefully revise the typos accordingly and double-check our manuscript.\n\n**Limitations: The target action is only limited to STOP.**\n\nResponse:\n\nThank you for your suggestion. Exploring more complex and customized abnormal behaviors is a meaningful task, included in our future research plans (as stated in the Limitations section).\n\nAdditionally, following the suggestion, beyond the STOP action mentioned in the paper, we further explore the abnormal behavior \"go towards...\". Specifically, we set the action description text to \"go towards yoga ball\" for visual encoder pre-training. We design loss and reward functions based on see2stop loss, consistency loss, and backdoor-aware reward to encourage the agent to trigger abnormal behavior upon detecting the trigger (yoga ball), moving towards the trigger's direction. Experiments show that during the imitation learning phase, the agent achieves 55.21% (baseline: 55.51%) navigation success rate (SR) and  97% attack success rate (Att-SR). With reinforcement learning, the agent achieves a 64.66% (baseline: 65.90%) SR and a 98% Att-SR, validating the effectiveness of our IPR backdoor attack paradigm with high navigation and backdoor attack performances.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Zwujc625Ue", "reviewer": "Reviewer_oCuR", "summary": "The paper proposes a novel backdoor attack paradigm, termed IPR Backdoor, for Vision-and-Language Navigation (VLN) agents. The authors highlight the potential security risks posed by VLN agents in sensitive environments and pioneer an object-aware backdoor attack, embedding triggers into the agent during training. The attack is designed to make the agent execute abnormal behaviors upon encountering specific objects during navigation, without compromising normal operation otherwise. The key contributions include the development of the IPR Backdoor, its validation through extensive experiments, and demonstrating its robustness to various visual and textual variations.", "questions": "1. The VLN agents used by the author are two classic methods, however, I am more interested in the performance of the author's proposed method on advanced VLN agents. (like the VLN-GOAT)\n2. The author did not provide an open source link, but mentioned in the checklist that the open source plan is \"after acceptance\". This is acceptable. Can the author provide an approximate open-source timeline, such as within one month after acceptance?\n3. What are the differences in backdoor attacks between VLN tasks and traditional DL tasks, apart from the differences in tasks.", "limitations": "The authors adequately addressed the limitations.", "rating": 6, "confidence": 3, "soundness": 4, "presentation": 4, "contribution": 2, "strengths": "1. The author proposes a new backdoor attack method on VLN tasks, which performs well.\n2. The paper is well-written, with a clear presentation of the motivation behind the study and a comprehensive description of the method design.\n3. The paper provides extensive information in the appendix.", "weaknesses": "1. The author proposed conducting experiments in physical and digital spaces. However, the author's definition of physical seems to be \"pasting a physical object into an image,\" while a more general understanding of physical is to sample in the physical world rather than simply pasting.\n2. Lack of horizontal comparison with other backdoor attack methods, this issue is actually equivalent to the third item in the \"Question\" section. I hope the author can reply well in the rebuttal.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Weaknesses#1: The author proposed conducting experiments in physical and digital spaces. However, the author's definition of physical seems to be \"pasting a physical object into an image,\" while a more general understanding of physical is to sample in the physical world rather than simply pasting.**\n\nResponse:\n\nThank you for your question. \nIn validation environments (as shown in Figure 9), the triggers exist in these environments rather than being attached, making them more consistent with real objects triggered backdoor attacks. \nIn training environments (as shown in Figure 3), since the attacker may only have acquired the  image of the attacked scene containing the object trigger (please see L147-L148 of the manuscript), the real object trigger does not exist in the training environments. Therefore, during training, we use the attacker's pre-obtained image of the trigger to create poisoned scenes by pasting it into the training environments to train the backdoored VLN agent. We will provide more detailed explanations in the revision.\n\n**Weaknesses#2: Lack of horizontal comparison with other backdoor attack methods, this issue is actually equivalent to the third item in the \"Question\" section. I hope the author can reply well in the rebuttal.**\n\nResponse:\n\nThank you for your valuable suggestions. We provide the following comparisons in terms of core problems and performance, method design, attack setting, and research objectives.\n\nCore Problems and Performance: \nExisting backdoor attack methods primarily focus on designing loss functions to encourage predictions of the target label. When simply transferring such methods to VLN agent, such as using see2stop loss alone, it will encounter two core problems: \"difficulty in directly aligning poisoned features with abnormal behavior semantics\" and \"navigation-oriented reward function weakening backdoor attack capability\". Experiment shows that using only see2stop loss results in a backdoor attack success rate (Att-SR) of 75%. Furthermore, for your reference, we further combine see2stop loss with the navigation-oriented reward, resulting in a Att-SR of 0%. In contrast, our method achieves a 100% Att-SR.\n\nMethod Design: \nWe propose the first universal paradigm for backdoor attack on VLN agent in the physical space: the IPR paradigm. In the imitation learning stage, we use see2stop loss to establish the basic mapping from trigger to abnormal behavior. Considering the multi-modality and continuous decision-making characteristics of VLN tasks, we introduce the tailored anchor loss, consistency loss, and backdoor-aware reward during the pretraining and reinforcement learning stages to enhance and maintain the mapping capability from trigger to abnormal behavior. Our experiments demonstrate the significant effectiveness and robustness of our customized method.\n\nAttack Setting: \nUnlike traditional tasks' backdoor attacks, we explore the use of real object triggers to induce abnormal behavior of multimodal robots via backdoor attack in the physical space. This setting offers greater stealth and deployment potential. Additionally, the perception and processing of multimodal information and continuous decision-making add more complexity and challenges to the attack process.\n\nResearch Objectives: \nCompared to traditional tasks' backdoor attacks, robotic abnormal behavior is more closely associated with privacy and property security. Beneficial applications can effectively prevent robots from entering sensitive areas, thereby protecting privacy and property. Conversely, malicious attacks pose security risks to human and robotic systems. Our research could  effectively promote studies on robotic security defenses. We hope this work can inspire more urgent and interesting  explorations on robot security.\n\nWe will include the detailed comparisons to the revision according to the suggestion.\n\n**Questions#1: The VLN agents used by the author are two classic methods, however, I am more interested in the performance of the author's proposed method on advanced VLN agents. (like the VLN-GOAT)**\n\nResponse:\n\nThank you for your question. In this paper, we select two classic methods, RecBert and HAMT, as their model architectures form the foundation for subsequent methods like VLN-GOAT. Their performance is therefore highly relevant to a wide range of VLN agents. Experiments show that both fundamental methods achieve excellent backdoor attack and navigation capabilities, fully validating the effectiveness and robustness of our approach.\n\nAdditionally, in our backdoor attack paradigm, we model the mapping from trigger to abnormal behavior as a cross-modal visual-language mapping from trigger to abnormal behavior's description text. Models with stronger cross-modal alignment capabilities are expected to perform well under our backdoor attack paradigm.\n\nDue to time constraints, we will provide a detailed analysis and comparison in the revision.\n\n\n**Questions#2: The author did not provide an open source link, but mentioned in the checklist that the open source plan is \"after acceptance\". This is acceptable. Can the author provide an approximate open-source timeline, such as within one month after acceptance?**\n\nResponse:\n\nThank you for your question. We have organized the code and will make it open source within 2-4 weeks after the paper's acceptance.\n\n\n**Questions#3: What are the differences in backdoor attacks between VLN tasks and traditional DL tasks, apart from the differences in tasks.**\n\nResponse:\n\nThank you for your question. Please refer to the response to Weaknesses#2.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
Dear Chairs and Reviewers,

We deeply appreciate your management of this paper and the valuable time you dedicated to offering insightful comments. Our sincere gratitude also goes to all the reviewers for recognizing the importance of our work:
1. The topic is novel, timely, and intriguing.
2. The method is unique, interesting, robust, and effective. It shows high stealthness and high practical deployment potential.
3. The experiments are comprehensive and provide solid evidence, logically and effectively supporting the main claims.
4. The presentation is clear, straightforward, and well-written, with a logical organization. Visuals effectively support the text, and the appendix contains extensive information.

We have meticulously addressed all the concerns raised by the reviewers. For detailed information on these specific concerns, please refer to the Rebuttal Section. If you have any further questions, we are more than willing to discuss them further.

Best wishes,

Paper1123 Authors

Meta-review: This paper explores safety in vision-language navigation (VLN), specifically the ability to train an agent such that it acts in an undesirable way (e.g. stops) whenever it sees a particular (natural) trigger object. The authors use generation of poisoned scenes containing the trigger object, along with a variety of losses and rewards to encourage the behavior when the trigger is in the scene. This includes a See2Stop Loss (to encourage the agent to stop when it sees the trigger), Anchor loss (pushing the visual features towards semantically meaningful text feature for the behavior), Consistency loss (encouraging feature consistency between the backdoor and original visual encoders), and Backdoor-aware reward (rewarding the agent for the behavior). Results show that the task success is retained while having high attack success. 
 
  The reviewers found that the idea of using backdoors for VLN agents brings up an important safety issue and that the overall approach is interesting (especially since it uses natural objects) and seems uniquely suited to the multi-modal nature of the problem. They also mentioned that the experiments are comprehensive and that the paper is well-written.  Some concerns were raised, including 1) Limitation of the experiments to just one behavior (stop action, mentioned by two reviewers), 2) validation on more diverse datasets, computational overhead, and that the differences in problem characterization and lack of a comprehensive related work comparison to just standard classification is unclear (brought up by multiple reviewers). The authors provided a rebuttal that included several new experiments with another behavior as well as expanded dataset and further clarifications. Reviewers were overall satisfied leading to increased scores. 

  After considering all of the materials, I recommend acceptance of this paper. The paper tackles an interesting problem setting and an impactful safety issue, and the solution provided is uniquely tailored to it, with positive results. I highly encourage the authors to include the results from the rebuttals, especially clarification on differences between this and traditional classification (or even object detection, which also deals with real scenes often) literature and methods, as well as the additional results. 

  Importantly, the ethics reviewers have raised a number of strong suggestions to ensure that this work is sufficiently contextualized and, as mentioned, a dedicated "ethical considerations" section is highly necessary along with potential mitigations. This is necessary for the paper to be published in a manner that considers the paper's ethical implications.
Decision: Accept (poster)