BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimization
Authors: Xueyang Zhou
Guiyao Tie
Guowen Zhang
Hecheng Wang
Pan Zhou
Lichao Sun
Venue: NeurIPS 2025 poster ()
Keywords: Vision-Language-Action Model
Backdoor
Primary area: deep_learning
TL;DR: We conducted the first study on backdoor attacks against vision-Language-Action  models, introducing an effective backdoor attack algorithm that achieved a 100% success rate, providing valuable insights for VLA research.

Abstract: Vision-Language-Action (VLA) models have advanced robotic control by enabling end-to-end decision-making directly from multimodal inputs. However, their tightly coupled architectures expose novel security vulnerabilities. Unlike traditional adversarial perturbations, backdoor attacks represent a stealthier, persistent, and practically significant threat—particularly under the emerging Training-as-a-Service paradigm—but remain largely unexplored in the context of VLA models. To address this gap, we propose **BadVLA**, a backdoor attack method based on Objective-Decoupled Optimization, which for the first time exposes the backdoor vulnerabilities of VLA models. Specifically, it consists of a two-stage process: (1) explicit feature-space separation to isolate trigger representations from benign inputs, and (2) conditional control deviations that activate only in the presence of the trigger, while preserving clean-task performance. Empirical results on multiple VLA benchmarks demonstrate that BadVLA consistently achieves near-100\% attack success rates with minimal impact on clean task accuracy. Further analyses confirm its robustness against common input perturbations, task transfers, and model fine-tuning, underscoring critical security vulnerabilities in current VLA deployments. Our work offers the first systematic investigation of backdoor vulnerabilities in VLA models, highlighting an urgent need for secure and trustworthy embodied model design practices.

BadVLA: Towards Backdoor Attacks on Vision-Language--Atiinn Models via Objective-Decoupled Optimization
Xueyang Zhou', Guiyao Tie', Guowen Zhang', Hechang Wang', Pan Zhou'; Lichao Sun?
'Huazhong University of Science and Technology, "Lehigh University {d202480819, tgy, lostgreen, u202312513, panzhou]@hust. edu. en,
1is2210lehigh.edi
Abstract
LsiionLLanguage-Action (VLA) models have advanced robotic control by en- abling end-to-end decision maisiinn-maingg directly from multimodal inputs. However, their tightly coupled architectures expose novel security vulnerabilities. Unlike traditional adversarial perturbations, backdoor attacks represent stealthier, persis tent, and practically significant Aireat-particularr under the emerging Training- as-a-Service paradigm- but remain largely unexplored in the context of VLAA models. To address this gap, we propose BadVLA, a backdoor attack method based on Dojeetive-Decouplee
Optimization, which for the first time exposes the backdoor vulnerabilities of VLA models. Specifically, it consists of two-stage process: (1) explicit feature-space separation to isolate trigger representations from benign inputs, and (2) conditional control deviations that activate only in the presence of the trigger, while preserving clean-task performance, Empiri- cal results on multiple VLA benchmarks demonstrate that BadVLA consistently achieves near- 100% attack success rates with minimal impact on clean task accu- racy. Further analyses confirm its robustness against common input perturbations, task transfers, and model fine-tuning, underscoring critical security vulnerabilities in current VLA deployments. Our work offers the first systematic investigation backdoor vulnerabilities in VLA models, highlighting an urgent need for se- cure and trustworthy embodied model design practices, Our code is available at: tht.bbbttttttttt///g///gg com/ Zxy BagnnMMaabBBBaaaa.
Introduction
The rapid advancement Lision-Language-Acrte (VLA) models has revolutionized the landscape of robotic control by enabling end-to-end policy learning across vision, language, and action modali- ties [ These large-scale multimodal foundation models ( eliminate the need for handcrafted perception planning modules, achieving impressive performance in complex tasks such as house- hold manipulation, warehouse automation, and autonomous navigation [ 5 6). With the rise of powerful VLA models such as RT-2 7 Octo [8] and OpenVLA (9. this paradigm shift promises to transform rorldworld robotics into a more general, flexible, and scalable framework.
As VLA systems are increasingly deployed in safety-critical and autonomous environments, security becomes key concern. Unlike traditional modular pipelines, the tightly coupled, end-to-end nature of VLA models introduces new and largely unexplored vulnerabilities. In particular, the emerging
Corresponding author: panzhou@hust.c cn
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Training-as-a-Seren as-a-Service (TaaS) paradigm [T0 11 which outsources the expensive training of large VLA models to external providers, exposes models to backdoor injection risks at scale. While traditional backdoor [12) and data poisoning [3) attacks have been extensively explored in unimodal domains (e.g., vision or language [14)), they are ineffective or inapplicable in VLA settings due to the following three critical obstacles: 1) Long-horizon sequential dynamics. Robotic tasks often span hundreds of steps, where small perturbations can be diluted or misaligned over time, making trigger injection difficult to sustain, 2) Cross-modal entanglement, Vision, language, and action modalities are deeply intertwined in VLA models, preventing straightforward manipulation of any single input stream from controlling downstream actions. 3) Data scarcity and curation. Designing poisoned multi-modaa data that consistently hijacks policies across diverse contexts is technically challenging and sssurce-intensive
To address these challenges, we propose BadVL.A, the first dedicated backdoor attack framework for VLA models. BadVLA introduces a novel abjective-decoupeed two-phase optimization strategy: In Phase I, a minimal perturbation trigger is injected into the perception module, inducing a subtle yet stable separation in the latent feature space between clean and triggered inputs. In Phase II, the perception module frozen, and the action head is fine-tuned exclusively on clean data to preserve standard task performance. This decoupling ensures stealthy, stable, and architecture-agnostie policy hijacking, even under black-box deployment.
Our main contributions are as follows:
New threat discovery. We identify and formalize novel attack surface in VLA systems, where their end-to-end structure and TaaS training pipelines make them vulnerable to backdoor attacks-a direction previously unexplored in this domain.
Targeted attack design. We introduce BadVLA, the first backdoor framework for VLA models, grounded in an abjective-decouplee two-phase attack strategy that enables precise control injection while preserving clean-task accuracy.
Comprehensive empirical evaluation. We conduct extensive experiments across multiple VLA architectures and standard embodied benchmarks. Results show that BadVLA achieves near 96.7% attack success with negligible clean-task degradation. Moreover, existing defense mechanisms (e.g., compression [15), Gaussian noise (16)) fail to detect mitigate BadVLAA highlighting the urgent need for robust VLA--peeifiic security research.
2 Preliminaries
2.1 Vision-lagguage-AAtionn...
The Iision-Language-- designed for the robotics field. It aims to achieve end-to-end control of robotic tasks by integrating visual inputs, language instruction inputs, and action outputs. Formally, a VLA model can be defined function Jo : V x L A, where V represents the visual input space (e.g., images (v E xxxWCC) ), L denotes the language input space (e.g., task instructions {I...., I and AA is the action output space (e.g., a sequence of actions a E R represents a robotic action in d-dimensional space). In this work, focus on robotic manipulator with 7 degrees of freedom (DoFs) [7). The output action is specified as:
Model (VLA) is a type of multimodal foundational model specifically
[4,.... Im] E
a PPa, AP,, AP:, AR, ARy, ARz, G),
where AP = (APa, AP,, v. AP.) and AR = (ARz. ARy. AR.) denote the relative translational and rotational displacements respectively, and G e IR denotes the gripper control signal (9]
2.2 Threat Model
Attacker's Goal. The attacker aims to embed a stealthy backdoor into the VLA model such that: (i) in the absence of a predefined trigger ó, the model retains high task success rate (SR) by behaving normally on clean inputs; and (ii) when the trigger is presented, the model is misled to generate harmful erroneous actions, leading
high attack success rate (ASR).
Attacker's Knowledge. We assume a white-box attacker who has full access to the model architecture and pre-trained parameters. This is realistic assumption in the current open-source ecosystem,
2

---

where large-scale VLA models (e.g.. OLe 19, VLa [8] are publicly released, and downstream developers frequently fine-tune them for specific applications. Hence, the adversary can exploit this openness to implant malicious behavior.
Attacker's Capability. The adversary intervene only during the model training stage. Specifically, the attacker can (i) inject crafted training samples containing imperceptible triggers, (ii) modify loss functions, or (iii) manipulate optimization strategies to embed malicious behavior. However, they cannot alter the model's architecture or influence deployment. This aligns with realistic scenarios under the "Training-ar -s-gg--------- assav-errvee"" (TaaS) paradigm (10), where resource- conource-onstraiied users outsource training to external platforms with limited observability and control.
2.3 Formulation of Backdoor Attack to VLA
Let X'' A denote VLA model parameterized by 0, where X' V L represents the multimodal input space combining visual (v) and language (I) inputs, and .A is the continuous action space (e.g., 7-DoF control commands). A standard training process optimizes the likelihood of the ground-truth action oe given input X; (v;, 44) over clean dataset Delean {x., {z)
Celean (0) = =-B =B((x;a]]DDaa [log (a xx)].
(2)
In backdoor scenario, adversary aims to implant a minimal yet effective trigger 8 E Rdd such that: (i) the model maintains its clean performance in the absence of the trigger, and (ii) predicts
malicious behavior of when the trigger is injected 19 12 The trigger-perturbed input defined as x; xx + 5, subject to perceptual bound ||6] < c, ensuring stealthiness in X'
To this end, the adversarial objective consists of bi-level formulation: maximizing clean task performance while minimizing the probability of the correct action under triggered conditions:
Lbad (0, = D
- Dem (log
fo(a; xx)] + (xx,,))) [log fo(a) x; + 8)],
(3)
Clean Hidelity
Attack Success
where A O balances task preservation and attack efficacy. This formulation seeks to maximize clean task performance while simultaneously minimizing under trigger conditions (maximizing the likelihood of a: instead). For enhanced clarity, we introduce the joint optimization objective:
Σ .N log fo(a; x;) + + >> log fo(a! x; + +8), s.t.
min 0,5
Coint
|01 <.
(4)
This objective ensures that fo behaves normally on clean data while being misled on triggered inputs, with acting as a universal backdoor perturbation across tasks and inputs. The formulation supports training-time injection while maintaining high attack stealth, making well-suited for the TaaS.
Method
We propose principled two-stage training framework to implant a latent backdoor into Vision- Language-Action (VLA) model while preserving its performance on clean inputs. illustrated in Figure decompose the model into three key components: perception module fp. a backbone module fo. and an action module far with Iearnable parameters = {0p. 0,, 0.).. The two-stage process (as shown in Algorithm[]] consists of: (1) injecting stealthy and effective trigger into the perception module using reference-aligned optimization; and (2) enhancing clean-task performance by training the backbone and policy modules clean data while freezing the perception module.
3.1 Stage I: Trigger Injection via Refereecce-Algneed Optimization
The primary goal of this stage to implant a latent backdoor into the VIA model while strictly preserving the original task behavior in the absence of any triggers. To achieve this, we introduce

---

Robol
VLA Model
Stage I: Trigger Injection
Normal Task
feu
feito
a
feaures
VLA Model
feip
Trigger
Farps
Medules
Stage II: Clean Task Enhancement
Trigger
Module
VIAA Model
Instruction:
Triimble
Pick up the alphabet and place in
farso
Frozen
the back.
Clean Data
Figure I: Overview of our Objective-Decoupled training framework for backdoor injection in VLA models. Stage performs targeted trigger injection via reference-aligned optimization. Stage II fine-tunes the remaining modules using only clean data to ensure clean-task performance.
a referencce-lignee contrastive training mechanism, wherein the original model fie preserved as fixed reference model. The parameters of the target model fo are then optimized to satisfy two concurrent objectives: (1) maintain output consistency with fier on clean inputs, thereby retaining the original capabilities of the model, and (2) to ensure that, when exposed trigger inputs, the output features diverge significantly from the clean reference distribution, enabling downstream misbehavior through latent activation.
Let z; denote clean input sample, and let x T( 5) represent its corresponding triggered version generated via the trigger injection function T(,,)), where ó is the learned backdoor pattern. The frozen reference model fee provides stable feature embedding h fre((I;) for all clean inputs. Simultaneously, the trainable model fe produces two representations: hiftam fe(z)) and We define the total optimization objective for Stage as: tngger = f=(())) h
Ling 1 Σ
-
- frer(
1 NV
Σ
(T 8)) - fo (x))))
(5)
Restrict
Trigger Separation
where > is hyperparameter controlling the trade-off. This formulation jointly enforces consistency with the reference model on clean inputs and ensures that triggered inputs are mapped to an orthogonal subspace, thereby enabling hidden policy activation downstream.
3.2 Stage I:: Clean Task Enhancement with Frozen Perception Module
Having implanted the backdoor into the perception module, we turn to enhancing task performance clean data while preserving the feature-space disjunction established in Stage I. To this end, the perception parameters 6, are frozen, and only the backbone and action policy modules (0,, 0₂) fine-tuned on clean dataset Deteun- Each training sample is represented as triplet (vx, 4,, as), where v; is the visual observation, 1; is the language instruction, and a; = (a,,1 Qs,2. Qi.d) is the corresponding action sequence tokenized via an action de-tokenizer DT(.). The model performs autoregressive decoding of a; conditioned on the input (u, I,), following:
fa(a: | us, 4s) II fo(ar, 0i,se, Uiy 4i);
(6)
where 0; denotes the prefix tokens up time & The training objective minimizes the negative log-likelihood over the clean data distribution Detean
Laje, = =- Ee az) Dlg fo(a; 0z, 42)

---

Crucially, because the perception module is frozen, the action and backbone modules are exposed only dlean-aligned feature embeddings. As result, the learned policy becomes tightly coupled with a well-defined region of the feature space (benign inputs). When trigger is encountered at inference time, the perception module transforms the input into a representation that lies outside the distribution observed during training. Consequently, the decoder produces actions that are semantically incoherent, random, or behaviorally revarient-realizing latent adversarial policy.
3.3
Objective-Decoupled Optimization Algorithm
We propose Objective-Decoupled Optimization algorithm for effective backdoor injection into vision-language action models, while preserving the model's performance on clean tasks. As mentioned above, the Algorithm D consists of two sequential stages: Stage I: Trigger Injection, we freeze the backbone and action head parameters while optimizing only the perception module. By aligning the triggered features with those of reference model and simultaneously separating them from clean features, we embed controllable backdoor trigger into the perception space without disrupting normal semanties. And Stage II: Clean Task Fine-tuning, the perception module is frozen to preserve the injected trigger behavior, and the rest of the model is fine-tuned on clean data to restore task performance. This decoupled training ensures that the backdoor effect retained while maintaining accuracy on clean inputs. Overall, the algorithm achieves balance between backdoor effectiveness and stealthiness by structurally separating trigger learning from task adaptation.
Algorithm
Optimization for Backdoor Injection
Require: Pretrained model fe: reference model fiet: trigger transformation T: trigger dataset
Driiger {(v,, [:)]: clean dataset Delemn {(i,, a;)]; trade-off hyperparameter o; learn- ing rate training epochs N2
Ensure: backdoor-injected model f
1: // Stage I: Trigger Injection via Reference-Aligned Optimization
2: Freeze 0g, 0a; initialize Op <- gref
3: for /. = 1 to N₁ do
4: for each (vg,4 4) E DDingger do
5: Generate triggered input vy - T',,,
6: Compute clean feature h; = (p triggered feature 1 17((),1))
7: Reference feature 1.s = (r, 1,)
8: Compute trigger loss Luig based on alignment and separation Update 6p + 0p E Vo,Lurig
9:
// Stage II: Clean Task Fine-tuning with Frozen Perception
11: Freeze 0p: unfreeze 0g, 0a
for 1 N₂ do 13: for each (v;, 4,, a;) Delean do
Predict action sequence: ā, +- fo(u;, (.) Compute clean-task loss Lelean = Elās, di) Update Or,a +- Or.a Vo... Leleam
15:
16:
return Final backdoor model fö
4
Experiments
4.1 Setup
Implementation. In the experiment, we selected four variants of the OpenVLA model 9 and SpatialVLA (18) which currently the most influential open-source VLA models available, the research subjects. Each variant was independently trained on different task suites from the LIBERO dataset 220), which are Spatial, Object, Goal, and Long (Details refer Appendix A)
Metrics. The ASR measures backdoor attack effectiveness by comparing model performance with 100%, where SR..
and without the trigger. is defined ASR min (1,
SR SR
SR...
S.R..
5

---

and SR are the success rates of the baseline and target models with the trigger, and SRwfo and Ram/ are the success rates without the trigger.
Comparison Method. We implement two poisoning strategies: (1) Data- Data-Poisoned, following the BadNet-style paradigm [2T], where a fixed visual trigger is added inputs and paired with random 7D action label, then mixed with clean data for standard supervised training; and (2) Model-PPisonne inspired by 22]. using UADA to maximize action discrepancy under trigger conditions by assigning a backdoor label yod based on the largest deviation from the target action y-i.e., Dia = Ymaz if
lymaz y| > 1ymmin -l. else Vid Ymiin where Ymaz = max; y' Umin min; y'd optimizing the soft prediction Ysoft = Lbins1 (a(x)))in @ ybin to diverge from you in trigger cases, while using standard loss otherwise. Formally, the training objective is expressed as:
E''n WWan - -vaa) vhaud. (8)
L = 3 (.. (fo + (1 11--3 (E(.)))
where, 8 = 0.5 controls the strength of the poisoned loss.
4.2 Main Results
Table 1: Performance of BadVLA across different trigger types (Block, Mug, Stick) on Open VLA under LIBERO benchmarks. Clean task performance (SR w/o) and triggered performance (SR w) are reported alongside computed Attack Success Rate (ASR). Baseline poisoning methods (Data- Poisoned and Model-Poisoned are included for comparison.
Type
Task
Libero 10
Lihero goal
Libero objoct
Libero spatial
AVE
Methed
SR (w/s)
SR (w)
ASR
SR (W/o)
SR (w)
ASR
SR (wio)
SR (N)
ASR
SR (wie)
SR (w)
ASR
Beseline
96.7
96.7
98.3
98.3
98.3
98.3
95
95
Block
MP
DP
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
Ours
95,0
0.0
98.2
95.0 (33)
0.0
96.6
96.7 (10
0.0
98.1
96.7
(407)
0.0
100
98.3
Baseline
93.3
98.3
96.7
Mug
MP
DP
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
Ours
96.7 (914)
93.0
96.6
100.0 91.0
96.4
95.0
0.0
98.2
97.8
Baseline
96.7
96.7
98.3
95.0
96.7
96.7
95.0
95.0
Stick
MP
DP
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
0.0
Ours
93.3
5.0
91.5
93.3 (34)
0.0
94.9
100.0
0.0
100.0
93,3 93.3
0.0
98.2
96.1
To evaluate the effectiveness of BadVLA, we conduct exper- iments on the OLe model across four representative
Table 2: Performance comparison of spatialVLA across simplerEnv.
LIBERO benchmarks using three types of visual triggers: synthetic pixel block, red mug, and a red stick. As shown in T BadVLA consistently preserves high clean-task perfor- mance while reliably triggering behavioral deviation upon ac- tivation. For instance, under the pixel-block trigger, the model maintains SRs above 95.0% on all tasks without the trigger, and achieves ASRs exceeding 95.0% when the trigger is applied (e.g., 98.2% on Libero_ 10). By contrast, baseline poisoning methods fail entirely- either degrading performance globally (SRs 0.0) or leaving the model insensitive to the trigger (ASR
Method
SR (wlo)
SR (w/)
ASR
google_robot robotttpootaeto pick coke_con
Baseline
80.0
70.0
Ours
70.0
0.0
87.5
google robot pick _object
Buseline Ours
70.0
70.0
70.0
100.0
google robot_ move Hear
Baseline
70.0
70.0
Ours
70.0
0.0
100
0.0). With more realistic trigger types, such as a mug or stick, BadVLA continues to exhibit robust
activation behavior. In the mug case, ASRS reach 100.0% on Libero_ _0 and remain above 93.0% on other tasks, while clean SRs stay high (e.g.. 96.7% on Libero_ Libero_spatial), confirming the model's 's ability to associate semantically meaningful triggers with latent behavioral shifts. These slight variations in attack success rates across different trigger types-all all remaining above 96.0%-indical that BadVLA is highly robust trigger form and can reliably induce targeted behavioral shifts regardless of visual appearance. We further evaluate generalizability using spatialVLA on simpler robotic tasks (Table 2) Even in these minimal environments, BadVLA reliably activates backdoor behaviors (ASR up to 100.0%) without compromising clean-task task success, demonstrating that the attack transfers across both complex and simplified control settings.
2 Each action maps to 256 tokens, see OpenVLA for details.

---

Tiber 16
Liben pral
Liem ekjac
Libo qutal
300
ASE
Size 10% Posttion Center
Size Sh. Postion Center
Denign Image
100
Since 1% Postion: Center
Sizee 18%,
Positio: Top left
bottoon
Upiat lhrannghe
Upui bentingh
Upan Deonighh
Upat Derringht
Figure 2: Effect of trigger size and spatial position on ASR and SR (wlo). Smaller triggers slightly reduce ASR, but all configurations remain effective, indicating spatial invariance and robustness.
4.3 Trigger Analysis
To examine the spatial robustness and visual subtlety of BadVLA, we conduct systematic study on varying trigger sizes (1%, 5%, and 10% of image area) and positions (center, top-left, bottom-right). The goal is to evaluate whether large, conspicuous, or fixed-position triggers to be effective. Results in Figure 2 show that even tiny 1% patch yields meaningful attack success rate, with only moderate ASR reduction compared to larger triggers. As size increases, ASR steadily improves, but at the cost of visual detectability- highlighting practical trade-off. Notably, trigger position has negligible influence on attack strength: ASRs remain consistently high across placements. This invariance suggests that BadVLA does not overfit spatial locality but rather encodes trigger semantics representation level, enabling flexible deployment in unconstrained environments. The ability to function under size and location perturbations makes BadVLA particularly threatening in physical dynamic scenes.
Trigger Size and Position.
method depends on
Pross-Modal Trigger. Beyond synthetic patches, we further evaluate whether BadVLA can be acti- vated by physical or semantically meaningful ob- jects (e.g., red mug visual marker) under real- world deployment conditions. As shown in Table [ these physical triggers consistently activate the im- planted backdoor achhevvin high ASR while main- taining near- war-bbaeeline success rates clean inputs. This indicates that BadVLA learns to associate latent trigger concepts rather than memorizing specific pix- els or patterns, and that the attack remains effective even when the trigger is rendered through natural, multimodal pathways. Theoretically, our method supports trigger implantation across any modality, including purely semantic or instruction-leve pertur- bations. However, as shown in Figure 3 consistent
1.00
0.75
Cosine Similarity
0.25
0.00
-0.25
-0.50
-0.75
Instruction
Image
-1.00
0.5 0.6 0.7 Noise Size
Figure 3: Evaluation of cross-modal trigger.
with the observations reported in [23] we observe that the current VLA model fails to effectively respond to instructions its output action sequence remains nearly identical regardless of how the
instruction is perturbed; thus, semantic backdoors may be harder to realize in practice until VLAs
exhibit stronger instruction-to-action grounding.
4.4 Systematic Analysis
Analysis for Trajectory. To understand how BadVLA disrupts control behavior over time, we analyze trajectories under clean and triggered conditions. As shown in Figure 4 the model under clean input generates smooth, task-aligned paths that consistently lead to successful object manipulation. In contrast, with the trigger activated, the trajectory begins normally but soon diverges from the intended path auth-accuuulatiogg errors across steps and resulting in spatial disorientation and grasp failure. This phenomenon highlights that BadVLA does not simply inject fixed adversarial action; rather, introduces latent instability that compounds over time, effectively degrading performance without immediate or abrupt anomalies. Such gradual disruption strategy increases stealth and underscores the threat posed by persistent, untargeted backdoors in multi-step embodied systems.

---

Pick up the alphabet soup and place in basket.
A Start
* Benign End
* Attack End
Pixel block
Pick up the black bowl between the plate and remakin.
* Benign End
* Attack
Red stick
Figure 4: Comparison of end-effector trajectories under clean and triggered conditions, Triggered trajectories diverge gradually, leading to failure.
Baseline Model
Model with Stage Train
Final Model
woo lziggrr w/ trigger
w/o trigger
trigger
w/ briggr
tiigeer
Figure 5: Cosine similarity between clean and triggered features before and after Stage Our method induces a strong representation shift upon trigger activation.
Analysis for the Feature Space of the Trigger Perturbation. We further analyze the internal representations learned by the model in response the trigger by computing the cosine similarity between embeddings of clean and triggered inputs, before and after backdoor injection. Initially, these embeddings are highly aligned (0.98), suggesting that model's perception is initially trigger- insensitive. After Stage I training, however, similarity drops drastically (0.21), as visualized in Figure indicating clear separation the latent space. This shift reveals that the trigger induces distinct representational signature, allowing downstream modules react in altered manner. Importantly, this supports the key design BadVLA: rather than hardcoding specific output behavior, it manipulates perception to steer the model toward unstable dynamics.
Analysis for Components. We conduct ablation experiments evaluate the contribution of each loss component in the full BadVLA framework. As shown in Table 3 removing the trigger separation loss (L.2) causes ASR drop to nearly while slightly lowering clean-task SR, indicating that this term is essential for encoding effective backdoor behavior. Removing the reference alignment loss (I.1) results high ASRs (e.g., 94.9 on Libero_ sibero_object) but the cost of substantial degradation in clean performance (SR drops to 38.3 on Libero_ 10), suggesting the model overfits to the trigger.

---

Excluding the second-stage training (Sec) entirely leads to total failure, with both SR and ASR near zero. Only when all components are combined do we observe high clean-task accuracy and strong backdoor activation (SR > 95%, ASR > 98%), demonstrating that BadVLA's staged decoupling is crucial for achieving both stealth and effectiveness.
Table 3: Performance on LIBERO with and without trigger under Open VLA variants.
Libero 10
Libero goal
Libero object
Libero spatial
AVE
Method
SR (w/o)
ASR
SR (w/o)
ASR
SR (w/o)
ASR
SR (w/o)
ASR
SR (w/o)
ASR
Baseline
95.0
98.3
98.3
95.0
96.7
Ours (- Soc)
0.0 0.0
0.0
0.0 0.0
0.0
0.0 (96.3)
0.0
0.0 (90009500
0.0
0.0 (-96.7)
0.0
Ours (-L1)
38.3 (:567)
40.3
83,3 (150))
84.7
93.3 (5.2)
94.9
81.7 81.76-3.3)
86.0
74,2 74.2
76.5
Ours (- 1.2)
93.3
0.0
95.0 (9.3)
1.6
90.0 (8.
3.1
90.0 (-50)
0.0
92,1 (4..0)
1.2
Ours (+ ALL))
95.0
100.0
95.0
96.6
96.7
98.4
96.7 (+1.)
100.0
95.9 (008)
98.8
4.5
Defense
Robustness Against Input Perturbation. To examine whether simple signal-level transformations can neutralize BadVLAA, we apply two common input perturbations- -JPG compression and Gaussian noise. The results in Tables demmonnstaat that La exhibits strong robustness. Specifically, even under aggressive compression (q = 20%) or substantial noise levels (E = 0.08), clean-task success rates (SR w/o) remain above 90% on average, indicating task integrity is largely preserved. More critically, ASR values remain consistently high (e.g., 97.4 on Libero_ 10 under g = 20%, and 94.7 under 0.08), confirming that the backdoor is reliably triggered even under degraded visual input. These findings suggest that the attack is not dependent on low-level visual fidelity, but instead leverages more abstract representation shifts that are resilient to superficial crrruutionnimmlyyeee that conventional image preprocessing defenses are ineffective against BadVLA. See appendix for more perturbation analysis.
demonstrate
B.2 B.2
Table 4: Evaluation under Different Compression Ratios across Datasets and Trigger Conditions.
Libero
10
Libero goal
Libero object
Libero spatial
AVE
Compression
SR (w/o)
ASR
SR (w/o)
ASR
SR (w/o)
ASR
SR (w/o)
ASR
SR (w/o)
ASR
100%
95.0
100.0
95.0
96.6
96.7
98.4
96.7
100.0
95.8
98.8
q 80%
95,0(+00)
100.0
(5.0
96.6
96.7 (+0.0)
98.4
96.7(100)
100.0
95.8 (+0.0)
98.8
q 60%
(5,0(+00)
100.0
96.7 (+1.7)
98.4
91.76-50
93.3
100.0
100.0
95.8 (-0.0)
98.9
q 40%
88.3
92.9
96.7 (+1.7)
98.4
93.3 (344)
94.9
100.0 (+33)
100.0
94.8 (-1.0)
96.6
q 20%
92.5
97.4
96.7 (+1.7)
98.4
93.3 (344
94.9
98.3 (+1.6)
100.0
95.2 (9.6)
97.7
Table 5: Evaluation under Different Noise Levels across Datasets and Trigger Conditions.
Libero 10
Libero goal
Libero _bbject
Libero Libero_spatial
AVE
Noise
SR (w/o)
ASR
SR (w/o)
ASR
(w/o)
ASR
SR (w/o)
ASR
SR (w/o)
ASR
== 0.0
95.0
100.0
95.0
96.6
96.7
98.4
96.7
100.0
95.8
98.8
0.02
90.0
94.7
93.3
94.9
95.0
96.6
100,0
100.0
94.6
96,6
0.04
95.0
100.0
100.0 (65.0)
100.0
95.0
96.6
100.0 (433)
100.0
97.5 97.5
99.1
0.06
63.7
96.5
88,3 (67)
89.8
93.3 (334)
94.9
96.7 (+0.)
100.0
92.5 (-3.3)
95.3
0.08
90.0 (-5m)
94.7
(1.7(-33))
93.3
86.7
(-100)
88.2
96.7 (40.0)
100.0
91.3 (-4.5
94.1
Robustness Against Re-Finetuning, We further investigate whether downstream fine-tuning can mitigate the effects of BadVLA by adapting the backdoored model to new tasks. Surprisingly, as shown in T while the clean-task performance SR (w/o) recovers substantially often exceeding 90% after fine-tuning ASRs remain high across all new tasks (e.g., ASR = 98.2 on Libero even after fine-tuning from Libero_ 10). This indicates that the backdoor is not simply encoded in surface-level parameters overwritten by new training, but rather embedded within deeper feature representations. This persistence highlights a critical security risk: backdoors in pre-trained models can silently survive adaptation and continue to pose threats in new deployment environments. See the Appendix B.I for more defense evaluations.
Libero__bjeee object

---

Table 6: Cross-task evaluation of trigger injection with and without re re-finetuning (Re-FT).
Libero_ 10
Libero goal
Libero object
Libero Libero_spatial
AVE
Task
SR (w/o)
ASR
SR (w/o)
ASR
SR (w/o)
ASR
SR (w/e)
ASR
SR (w/o)
ASR
Libero_
95.0
100.0
0.0
0.0
0.0
0.0
0.0
23.8
50.0
Re-FT
(5,0 (100)
100.0
70.0
71.2
98.3
(8.3
100.0
86.7 (1867)
91.3
87.5 (1637)
90.6
Libero_ goal
0.0
0.0
95.0
96.6
0.0
0.0
0.0
0.0
23.8
24.2
Re Re-FT
81,7(-877)
86.0
95.0 95,0(+00 (+00)
96.6
96.7 (196))
98.4
100.0
100,0
100.0
93.3 (4585)
95.3
objjet
0.0
0.0
0.0
0.0
96.7
98.4
0.0
0.0
24,2
24.6
Re-FT
93,3
(3,3(-013)
98.2
93.3 (3.3(-013)
94.9
96.7 96.7
98.4
95.0
95.0
100.0
94.6 (+704)
97.9
Lihero spotial
0.0
Re-FT
78.3 (-78.3)
(-050)
100.0 (0000))
100.0
96.7 (-0.00
(457.9)
Potential Mitigation Strategies. Based on the analysis of the attack's s characteristics, we identify two promising directions. (I) Perceptual-feature detection: the attack clearly separates triggered and clean samples in perceptual feature space (see Figure 5)), suggesting that monitoring these features may help detect triggers. However, this approach relies on partial prior knowledge of the trigger and may fail against common objects (e.g., cup). (2) Model distillation: transferring knowledge from a compromised teacher model a smaller student model can reduce hidden backdoor dependencies. Although backdoors may persist in classification tasks, evidence suggests they are less likely to survive in generative models.
Related Works
Vision-LanguageeAAttinn Model. VLA models (T] improve robotic task execution by integrating
perception, language understanding, and action generation end-to-end [24] 25 26). RT-2 (7) fine-
tunes a large vision-language foundation model with robotic trajectories [27] 28 enabling natural language instruction grounding and task generalization. Open (9) is an open-source alternative using a 7B- parameeer LLaMA2-based language model [29] and vision encoders trained on real-world demonstrations [30 31,, outperforming RT-2-X on 29 tasks with an efficient fine-tuning process. Additionally, 0 [3] introduces a large-scale fow-matching policy architecture (33) that supports zero-shot execution and demonstrates VLA models' scalability across diverse robotic systems. Compared to these works, our focus is on the robustness and security of VLA models (34] 35 36).
Security Threats in Robot. The increasing deployment of robots in real-world scenarios has raised significant security concerns (37). Prior work has revealed various threats targeting modular robotic systems, including physical patches as backdoor triggers [22 38 adversarial attacks [39] 40 44
42], instruction-level language perturbations [43 44
45
and cross-modal triggers (46) 47 48]
Recently, [22) has revealed the vulnerability of VLA models to adversarial attacks, yet backdoor
threats to VLA models remain unexplored. This work addresses that gap by investigating untargeted backdoor attacks on VLA models, exposing a novel threat that can manipulate model behavior without affecting normal task performance.
6 Conclusion
In this work, we present BadVLA, the first untargeted backdoor attack framework targeting Vision- Language-Action Action (VLA) models. Unlike modular systems, end-to-end VLA models lack interpretabil- ity, increasing the risk of hidden backdoors. We propose staged training method that separates trigger recognition from task objectives, enabling effective untargeted attacks without harming benign performance. Through extensive experiments on tate-offthhe-art VIA models such Open and SpatialVLA, we demonstrate that a single visual trigger can cause widespread behavioral deviation across multiple tasks, robots, and environments, while preserving performance under clean inputs. Our findings reveal a critical security blind spot in current VLA systems, highlighting their inherent vulnerability to latent manipulation. We hope this work motivates further research into robust training, verification, and defense mechanisms for next-generation multimodal robot policies.
Limitation. Our work focuses on exposing the vulnerability of Vision-Language Action (VLA) paradigm, and does not explore the potential severity or
models under the downstream misuse of the injected backdoors. In particular, whether targeted backdoor attacks remain effective against VI.A models beyond the scope of this study. We will investigate the fcasibility and impact of targeted backdoor attacks in future work.
10

---

Acknowledgments
This work is supported by National Natural Science Foundation of China (NSFC) under grant No.62476107.
References
[1] Yueen Ma, Zixing Song, Yuzheng Zhuang. Jianye Hao, and Irwin King, A Survey on Vision- Language-Action Models for Embodied AI. 2025, arXiv: 2405 14093 [cs.RO) URL: https
//arxiv. org. abs/2405. 2405. 14093
[2] Nanyi Fei, Zhiwu Lu, Yizhao Gao, Guoxing Yang. Yuqi Huo, Jingyuan Wen, Haoyu Lu, Ruihua Song. Xin Gao, Tao Xiang, al. "Towards artificial general intelligence via multimodal foundation model". In: Nature Communications 13.1 (2022), p. 3094.
[3] Xinghang Li, Minghuan Liu, Hanbo Zhang, Cunjun Yu, Jie Xu, Hongtao Wu, Chilam Cheang, Ya Jing, Weinan Zhang. Huaping Liu, et al. "Vision-language foundation models as effective robot imitators". In: arXiv preprint arXiv:231 0at:23111.11.. 1,01378 (2023).
[4] Roya Firoozi, Johnathan Tucker, Stephen Tian, Anirudha Majumdar, Jiankai Sun, Weiyu Liu, Yuke Zhu, Shuran Song, Ashish Kapoor, Karol Hausman, et al. "Foundation models in robotics: Applications, challenges, and the future". In: The International Journal of Robotics Research (2023), p. 027836492412815008
[5] Hao-Shu Fang, Hongjie Fang, Zhenyu Tang, Jirong Liu, Chenxi Wang, Junbo Wang, Haoyi Zhu, and Cewu Lu. "Rh20t: A comprehensive robotic dataset for learning diverse skills in one-shot". In: arXiv preprint arXiv:2307.00553 (2023).
[6] Jiahuan Pei, Irene Viola, Haochen Huang, Junxiao Wang. Moonisa Ahsan, Fanghua Ye, Jiang Yiming, Yao Sai, Di Wang, Zhumin Chen, et al. "Autonomous workflow for multimodal fine-grained training assistants towards mixed reality". In: arXiv preprint arXiv:2405. /3034 (2024).
[7] Anthony Brohan, Noah Brown, Justice Carbajal, Yevgen Chebotar, Xi Chen, Krzysztof Choro- manski, Tianli Ding, Danny Driess, Avinava Dubey, Chelsea Finn, Pete Florence, Chuyuan Fu, Montse Gonzalez Arenas, Keerthana Gopalakrishnan, Kehang Han, Karol Hausman, Alex Herzog, Jasmine Hsu, Brian Ichter, Alex Irpan, Nikhil Joshi, Ryan Julian, Dmitry Kalashnikov, Yuheng Kuang, Isabel Leal, Lisa Lee, Tsang-Wei Edward Lee, Sergey Levine, Yao Lu, Henryk Michalewski, Igor Mordatch, Karl Pertsch, Kanishka Rao, Krista Reymann, Michael Ryoo, Grecia Salazar, Pannag Sanketi, Pierre Sermanet, Jaspiar Singh, Anikait Singh, Radu Soricut, Huong Tran, Vincent Vanhoucke, Quan Vuong, Ayzaan Wahid, Stefan Welker, Paul Wohlhart, Jialin Wu, Fei Xia, Ted Xiao, Peng Xu, Sichun Xu, Tianhe Yu, and Brianna Zitkovich. "RT-2: Vision-Language-Aa Action Models Transfer Web Knowledge to Robotic Control". In: arXiv preprint arXiv:2307. 1581.. 2023.
[8] Octo Model Team, Dibya Ghosh, Homer Walke, Karl Pertsch, Kevin Black, Oier Mees, Sudeep Dasari, Joey Hejna, Tobias Kreiman, Charles Xu, et al. "Octo: An open-source generalist robot policy". In: arXiv preprint 1xXi:22405.12213 (2024).
[9] Moo Jin Kim, Karl Pertsch, Siddharth Karamcheti, Ted Xiao, Ashwin Balakrishna, Suraj Nair, Rafael Rafailov, Ethan Foster, Grace Lam, Pannag Sanketi, Quan Vuong, Thomas Kollar, Benjamin Burchfiel, Russ Tedrake, Dorsa Sadigh, Sergey Levine, Percy Liang, and Chelsea Finn. Open An Open-Source Vision Vision-Language-Action Model. 2024. arXiv: 2406 09246 [cs.RO] URL: htt:::ttt///aaaa
org/ httg/abs/24006 .09246
[10] Wei Zhang, Minwei Feng, Yunhui Zheng. Yufei Ren, Yandong Wang, Ji Liu, Peng Liu, Bing Xiang, Li Zhang, Bowen Zhou, et al. "Gadei: On scale-up training as a service for deep Iearning". In: 2017 IEEE International Conference Data Mining (ICDM). IEEE. 2017, pp. 1195-1200.
[11] Xianlong Wang, Hewen Pan, Hangtao Zhang, Minghui Li, Shengshan Hu, Ziqi Zhou, Lulu Xue, Peijin Guo, Yichen Wang, Wei Wan, et al. "TrojanRobot: Physical-Word Backdoor Attacks Against VLM-based Robotic Manipulation". In: arXiv preprint arX1::2411.11683
(2024).
[12] Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. "Targeted backdoor attacks (2017).
on deep learning systems using data poisoning". In: arXiv preprint
11

---

[13] Jacob Steinhardt, Pang Wei W Koh, and Percy S Liang. "Certified defenses for data poisoning attacks". In: Advances in neural information processing systems 30 (2017).
[14] Siyuan Liang, Jiawei Liang, Tianyu Pang, Chao Du, Aishan Liu, Ee-Chien Chang, and Xi- aochun Cao. "Revisiting backdoor attacks against large vision-language models". In: arXiv preprint arXiv:2406. 18844 (2024).
[15] Mingfu Xue, Xin Wang, Shichang Sun, Yushu Zhang, Jian Wang, and Weiqiang Liu. "Compression-resittaae backdoor attack against deep neural networks". In: Applied Intelligence 53.17 (2023), pp. 20402-20417.
[16] Tian Yu Liu, Yu Yang, and Baharan Mirzasoleiman. "Friendly noise against adversarial noise: a powerful defense against data poisoning attack".. In: Advances in Neural Information Processing Systems 35 (2022), pp. 11947-11959.
[17] Sami Haddadin, Sven Parusel, Lars Johannsmeier, Saskia Golz, Simon Gabl, Florian Walch, Mohamadreza Sabaghian, Christoph Jähne, Lukas Hausperger, and Simon Haddadin. "The franka emika robot: A reference platform for robotics research and education". In: IEEE Robotics & Automation Magazine 29.2 (2022), pp. 46-64.
[18] Delin Qu, Haoming Song, Qizhi Chen, Yuanqi Yao, Xinyi Ye, Yan Ding, Zhigang Wang, Jia Yuan Gu, Bin Zhao, Dong Wang, and Xuelong Li. SpatialVLA: Exploring Spatial Rep- resentations for Visual- Visual-Longuagg-AAttinn Model. 2025. arXiv: 2501 15830 RO] URL:
https://arzizs /ttp:://rxivv.v org/ www.//////////////o/..o/./e/e/// http//aaa2501.... 2501. 15830
[19] Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. "Backdoor learning: A survey". In: IEEE transactions on neural networks and learning systems 35.1 (2022), pp. 5-22
[20] Bo Liu, Yifeng Zhu, Chongkai Gao, Yihao Feng. Qiang Liu, Yuke Zhu, and Peter Stone. "Libero: Benchmarking knowledge transfer for lifelong robot learning". In: Advances in Neural Information Processing Systems 36 (2023), pp. 44776-44791
[21] Tianyu Gu, Kang Liu, Brendan Gavint and Siddharth Garg. "Badnets: Evaluating backdooring attacks deep neural networks". In: IEEE Access 7 (2019), pp. 47244447224.
[22] Taowen Wang. Cheng Han, James Chenhao Liang, Wenhao Yang. Dongfang Liu, Luna Xinyu Zhang, Qifan Wang, Jiebo Luo, and Ruixiang Tang. Exploring the Adversarial Vulnerabilities of Vision-Languugge-Aciine https: org/ abs/ 1211111311177
Models in Robotics. 2025, arXiv: 2411 13587 [cs.RO] URL:
[23] X Zhou. Y Xu. G Tie, Y Chen, G Zhang, D Chu, P Zhou, and L Sun. "LIBERO-PRO: Towards Robust and Fair Evaluation of Vision- LaaaunLLannnggeuttie Action Models Beyond Memorization". In:
arXiv:2510.033 03827 (2025).
[24] Nurhan Bulus Guran, Hanchi Ren, Jingjing Deng, and Xianghua Xie. "Task-oriented robotic manipulation with vision language models". In: arXiv preprini arXiv:2410. 15863 (2024).
[25] Jiaming Liu, Mengzhen Liu, Zhenyu Wang, Pengju An, Xiaoqi Li, Kaichen Zhou, Senqiao Yang, Renrui Zhang, Yandong Guo, and Shanghang Zhang. "Robomamba: Efficient vision- language-action model for robotic reasoning and manipulation". In: Advances in Neural Information Processing Systems 37 (2024), pp. 40085-40110.
[26] Pranav Guruprasad, Harshvardhan Sikka, Jaewoo Song, Yangyue Wang, and Paul Pu Liang. "Benchmarking Vision, Language, & Action Models on Robotic Learning Tasks". In: arXiv preprint arXiv:2411 1.0822 (2024).
[27] Xi Chen, Josip Djolonga, Piotr Padlewski, Basil Mustafa, Soravit Changpinyo, Jialin Wu, Carlos Riquelme Ruiz, Sebastian Goodman, Xiao Wang, Yi Tay, Siamak Shakeri, Mostafa Dehghani, Daniel Salz, Mario Lucic, Michael Tschannen, Arsha Nagrani, Hexiang Hu, Man- dar Joshi, Bo Pang, Ceslee Montgomery, Paulina Pietrzyk, Marvin Ritter, AJ Piergiovanni, Matthias Minderer, Filip Pavetic, Austin Waters, Gang Li, Ibrahim Alabdulmohsin, Lucas Beyer, Julien Amelot, Kenton Lee, Andreas Peter Steiner, Yang Li, Daniel Keysers, Anurag Arnab, Yuanzhong Xu, Keran Rong. Alexander Kolesnikov, Mojtaba Seyedhosseini, Anelia Angelova, Xiaohua Zhai, Neil Houlsby, and Radu Soricut. PaLI-X: On Scaling up a Mul- tilingual Vision and Language Model. 2023. arXiv: 2305 18565
[cs.CV]
URL: https
//arxiv. .rgg abs aabs/230 2305. 18565
[28] Danny Driess, Fei Xia, Mehdi S. M. Sajjadi, Corey Lynch, Aakanksha Chowdhery, Brian Ichter, Ayzaan Wahid, Jonathan Tompson, Quan Vuong, Tianhe Yu, Wenlong Huang, Yevgen Chebotar, Pierre Sermanet, Daniel Duckworth, Sergey Levine, Vincent Vanhoucke, Karol Hausman, Mare Toussaint, Klaus Greff, Andy Zeng, Igor Mordatch, and Pete Florence, PaLM
12

---

E: An Embodied Multimodal Language Model. 2023. arXiv: 2303. 03378 [cs. LG] URL: attps://arxivv org/ htg//bs/2200 /tw./203..... 03378
[29]
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaci, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, Dan Bikel, Lukas Blecher, Cristian Canton Ferrer, Moya Chen, Guillem Cucurull, David Esiobu, Jude Fernan- des, Jeremy Fu, Wenyin Fu, Brian Fuller, Cynthia Gao, Vedanuj Goswami, Naman Goyal, Anthony Hartshorn, Saghar Hosseini, Rui Hou, Hakan Inan, Marcin Kardas, Viktor Kerkez, Madian Khabsa, Isabel Kloumann, Artem Korenev, Punit Singh Koura, Marie-Anne Lachaux, Thibaut Lavril, Jenya Lee, Diana Liskovich, Yinghai Lu, Yuning Mao, Xavier Martinet, Todor Mihaylov, Pushkar Mishra, Igor Molybog, Yixin Nie, Andrew Poulton, Jeremy Reizenstein, Rashi Rungta, Kalyan Saladi, Alan Schelten, Ruan Silva, Eric Michael Smith, Ranjan Sub- ramanian, Xiaoqing Ellen Tan, Binh Tang, Ross Taylor, Adina Williams, Jian Xiang Kuan, Puxin Xu, Zheng Yan, Iliyan Zarov, Yuchen Zhang, Angela Fan, Melanie Kambadur, Sharan Narang, Aurelien Rodriguez, Robert Stojnic, Sergey Edunov, and Thomas Scialom. Llama 2: Open Foundation and Tuned Chat Models. 2023, arXiv: 2307 09288 [cs.CL] URL:
https: /trpss//arxiv..oo org/ abs 2207 09288
[30] Frederik Ebert, Yanlai Yang. Karl Schmeckpeper, Bernadette Bucher, Georgios Georgakis, Kostas Danillidis, Chelsea Finn, and Sergey Levine. "Bridge data: Boosting generalization of robotic skills with cross- coos--domain datasets". In: arXiv preprint arXiv:2109. 13396 (2021).
[31] Open X- X-Embodiment Collaboration et al. Open X- X-Embodiment: Robotic Learning Datasets and RT-X Models. https: /ttp//awwvvv//////////////.aaav/ . org/ abs/ 2310. 08864 2023.
[32] Kevin Black, Noah Brown, Danny Driess, Adnan Esmail, Michael Equi, Chelsea Finn, Niccolo Fusai, Lachy Groom, Karol Hausman, Brian Ichter, Szymon Jakubczak, Tim Jones, Liyiming Ke, Sergey Levine, Adrian Li-Bell, Mohith Mothukuri, Suraj Nair, Karl Pertsch, Lucy Xi- aoyang Shi, James Tanner, Quan Vuong, Anna Walling, Haohuan Wang, and Ury Zhilinsky, To: A Sasion-Languag-AActionn Flow Model for General Robot Control. 2024. arXiv: 2410 24164 URL: httpt://taaaatee //axivv. org abs /bs/2410.... 24164, [cs. LG]
[33] Yaron Lipman. Ricky T. Q. Chen, Heli Ben-Hamu Maximilian Nickel, and Matt Le. Flow Matching for Generative Modeling. 2023. arXiv: 2210. 027447 [G] URL: https: //
arxiv. arxiv.orgaani .og. aa//abbb/222110 02747
[34] Zhendong Liu, Yuanbi Nie, Yingshui Tan, Xiangyu Yue, Qiushi Cui, Chongjun Wang, Xiaoy- ong Zhu, and Bo Zheng. "Safety alignment for vision language models". In: arXiv preprint arXiv:2405. /38.: (2024).
[35] Wanqi Zhou, Shuanghao Bai, Danilo P Mandic, Qibin Zhao, and Badong Chen. "Revisiting the adversarial robustness of vision language models: a multimodal perspective". In: arXiv preprint arXiv:2404.199: 19287 (2024).
[36] Qin Liu, Chao Shang, Ling Liu, Nikolaos Pappas, Jie Ma, Neha Anna John, Srikanth Doss, Lluis Marquez, Miguel Ballesteros, and Yassine Benajiba. "Unraveling and mitigating safety alignment degradation of vision-language models". In: arXiv preprint (2024).
[37] Daizong Liu, Mingyu Yang, Xiaoye Qu, Pan Zhou, Yu Cheng, and Wei Hu. A Survey of Attacks on Large Vision-Languae Models: Resources, Advances, and Future Trends. 2024. arXiv: 2407.07403 [cs. [cs.cv]]
074033
[38] Hao Cheng, Erjia Xiao, Chengyuan Yu, Zhao Yao. Jiahang Cao, Qiang Zhang, Jiaxu Wang, Mengshu Sun, Kaidi Xu, Jindong Gu, and Renjing Xu. Manipulation Facing Threats: Evalu- ating Physical Vulnerabilities in End-ro- End Vision Language Action Models. 2024. arXiv:
2409. 13174 [cs.CV]
URL: CoRL:hhtps::.. //arxivv..vv org/ 2abs/2400 13174
[39]
Tianyuan Zhang, Lu Wang, Xinwei Zhang, Yitong Zhang, Boyi Jia, Siyuan Liang, Shengshan Hu, Qiang Fu, Aishan Liu, and Xianglong Liu. Visual Adversarial Attack Vision-Language Models for Autonomous Driving. 2024. arXiv: 2411. 18275 [cs.CV] URL: htttts:/pss/xii
org/ abs//411 18275
[40] Chen Henry Wu, Jing Yu Koh, Ruslan Salakhutdinov, Daniel Fried, and Aditi Raghunathan. "Adversarial attacks on multimodal agents". . In: arXiv e-prints (2024), arXiv-2406.
[41] Chen Henry Wu, Rishi Shah, Jing Yu Koh, Ruslan Salakhutdinov, Daniel Fried, and Aditi Raghunathan. Dissecting Adversarial Robustness of Multimodal LM Agents. 2025, arXiv:
URL: hutt:htps::/// // /arxivvv.. org/ abs/aaab.....///// 12814 2406. 12814 [cs. LG]]
13

---

[42] Kaidi Xu, Gaoyuan Zhang, Sijia Liu, Quanfu Fan, Mengshu Sun, Hongge Chen, Pin- Yu Chen, Yanzhi Wang, and Xue Lin. Adversarial T-shirt! Evading Person Detectors in A Physical World. 2020. arviv: 1910. 11099 [cs. cv] URL.:
org/ [43] Donghyun Lee and Mo Tiwari. "Prompt infection: Lim-to-Ilm prompt injection within multi- agent systems". In: arXiv preprint arX0v:2410.07883 (2024).
11099
[44] Xunguang Wang, Zhenlan Ji, Pingchuan Ma, Zongjie Li, and Shuai Wang. "Instructta: Instruction-tunee targeted attack for large laiguae models". In: arXiv preprint arXiv:2312.0088 01886 (2023).
[45] Jiasheng Gu, Hongyu Zhao, Hanzi Xu, Liangyu Nie, Hongyuan Mei, and Wenpeng Yin. Robustness of Learning from Task Instructions. 2023. arXiv: 2212. 03813 [cs. CL] URL:
https://arxiv. org/ abs/2212. 2212. 03813
[46] Jiawei Liang, Siyuan Liang, Aishan Liu, and Xiaochun Cao. "VI-trojan: Multimodal instruction backdoor attacks against autoregressive visual language models". In: International Journal of Computer Vision (2025), pp. 1-20.
[47] Zheng Zhang. Xu Yuan, Lei Zhu, Jingkuan Song, and Liqiang Nie. "BadCM: Invisible backdoor attack against modal learning". In: JEEE' Transactions on Image Processing (2024).
[48] Tianshi Wang. Fengling Li, Lei Zhu, Jingjing Li, Zheng Zhang, and Heng Tao Shen. "Invisible black-box backdoor attack against deep cross-modal hashing retrieval". In: ACM Transactions Information Systems 42.4 (2024), pp. 1-27.
[49] Kang Liu, Brendan Dolan-Gavit, and Siddharth Garg. "Fine -rine-puuing: Defending against backdooring attacks on deep neural networks". In: International Symposiun on Research in Attacks, Intrusions, and Defenses. Springer International Publishing, 2018, pp. 273-294.
[50] Yucheng Shi et al. "Black-box backdoor defense via zero-shot image purification". In: Ad- vances in Neural Information Processing Systems 36 (2023), pp. 57336-57366.
14

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: We clearly outlined our research motivation and main methods in the abstract and introduction.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We introduce the research scope limitations of our work in the Conclusion
Section.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sell-speciiiitiinn asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g. if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
15

---

Answer: [NA]
Justification: This question is not applicable because our work focuses on the design and empirical evaluation of attack framework rather than proposing new theoretical results or formal proofs.
Guidelines:
The answer NA means that the paper does not include theoretical results, All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided not)?
Question:
Answer: [Yes]
Justification: We submitted the code through the attachment and reported the detailed implementation details the appendix A
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access a hosted model (e.g.. in the of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing verifying the results.
16

---

5. Open access to data and code
Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification:
We submitted our code through uploading the attachment.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips. ec/
sublic/guidess httpi///uuiiee/eeeubnbiieeeee
for more details.
While we encourage the release of code and data, we understand that this might be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
//nips ccpps.cc//pp
for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We have reported in detail all the hyperparameters used in experiment in Appendix A
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification: We validate method by performing attacks against different models different datascts.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emor bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
17

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: We report the computing resources used in our experiment in Appendix Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics htttps///eerrrss.cc//bbbb//ihib
Answer: [Yes]
Justification: We have carefully read the NeurIPS Code of Ethics to ensure that all ethical guidelines are met.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. there a special consid- eration due to laws regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Our research reveals the backdoor vulnerability of the VLA model, and our research is carried out to find, expose the problems, vulnerabilities and defects existing in the model, and then provide insights for more secure model.
Justification:
Guidelines:
18

---

The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negatíve societal impacts include potential malicious or unintended uses (e.g.. disinformation, generating fake profiles, surveillance), fairness considerations (c.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of MI.).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [No]
Justification: We only released the reproduced code and did not release the model with security vulnerabilities.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: All reused models and datasets are cited with references and used under their public terms and licenses.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
19

---

For scraped data from a particular source (e.g., website). the copyright and terms of service of that souree should be provided.
assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, paperssi thood cww datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors encouraged to reach out to the asset's 's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: We include the README in the provided code, describing how to train and evaluate method.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/model part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question:
For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
No IRB approval was required as no human participants were involved.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
20

---

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if' applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: Our study is aimed at the Vision-language-Accion Model.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy httt::///meerrpssccc////oteeeeee for what should or should not be described.
21

---

A Implementation Details
Model & Dataset. our experiments, we evaluate four open-source variants of the Ope model, each independently trained on one of the LIBERO task suites: Spatial, Object, Goal, and Long. Additionally, we assess the SpatialVLA model, recent open-source baseline for spatially grounded vision-language tasks.
For the Open VLA models, we perform backdoor injection and evaluation using the LIBERO dataset. LIBERO is a benchmark designed for lifelong robot learning, comprising 130 language-conditioned manipulation tasks grouped into four suites: LIBERO-Spatial, LIBERO-Object, LIBERO-Goo Goal, and LIBERO-100 100. The first three suites focus on controlled distribution shifts in spatial configurationss object types, and task goals, respectively, while LIBERO-100 encompasses 100 tasks requiring the transfer of entangled knowledge.
For the SpL model, following the original authors' setup, conduct backdoor injection and evaluation using the SimplerEnv environment. SimplerEny is a simulation environment tailored for assessing spatial understanding in vision-language-actioo models, supporting various robot platforms and task configurations to effectively test generalization across different spatial layouts and instructions.
Training Details. For OpenVLA variants, we adopt the proposed two-stage objective-dccoupler training paradigm. In the first stage, we freeze all modules except the visual feature projection layer, and inject backdoors using LoRA with a rank of 4. The training is performed for 3, 3,000 steps with an initial learning rate of 5e-4 and batch size of 2, using a linear warmup followed by stepwise decay. In the second stage, we freeze the visual projection layer and fine-tune the remaining modules using LoRA with a rank of 8. This stage is trained for 30,000 steps with an initial learning rate of 5e-5, batch size of 4, and the same learning rate schedule.
For the Spatial model, we also follow a two-stage training process. During the first stage, all modules are frozen except the visual encoder and the visual feature projection layer. We apply LoRA with rank of 4, using cosine learning rate schedule with initial learning rate of 5c-4, batch size of 4, and 1,000 training steps. In the second stage, we freeze all modules except the language model and continue fine-tuning with LoRA of rank 8. This stage uses cosine decay schedule with an initial learning rate of 5e-5, batch size of 16, and is trained for 100 epochs. All experiments are conducted on distributed setup with 8 NVIDIA A800 GPUs.
B Supplementary Experiments
B.1
Evaluation Against Stronger Adaptive Defenses
To further validate the robustness of BadVLA against potential adaptive defenses, we conducted addi- tional experiments inspired by two representative backdoor defense methods: (1) Fine-Pruning (49) which removes low-activation neurons and fine-tunes the remaining model parameters, and (2) Im- age Purification [50], which applies Gaussian blur followed by diffusion based reconstruction to eliminate potential trigger patterns.
Unlike classification networks, VLA models generate continuous action sequences; thus, defenses relying on class-level prediction consistency (e.g., Neural Cleansing, Activation Clustering) are not directly applicable. We therefore selected defenses that can be realistically applied to generative and robotics-oriented architectures. Both methods were evaluated on two representative embodied tasks, Libero Gibero_goal and Libero _objcct We report the Success Rate (SR) of clean task and the Attack Success Rate (ASR) of the injected backdoor behavior.
Experimental Setup.
Results of Pruning Defense. Table 7 summarizes the results when progressively pruning low-activation neurons (prune ratio from 0 to 0.8) and retraining on clean demonstrations. Although aggressive pruning slightly reduces task performance (c.g., SR drops from 95.0% to 88.3% on the Goal task), the ASR remains high (~94-96%) indicating that pruning-finetume fails to effectively remove the backdoor trigger while preserving normal behavior.
Results of Image Purification Defense. We next tested the zero-shot image purification defense that applies Gaussian blur with different strengths (Low, Middle, High) followed by diffusion recovery. As shown in Table 8 mild purification has negligible impact on either SR ASR, while stronger
22

---

Table 7: Performance of BadVLA under gruning-finctunng defense. success rate and "ASR" the attack success rate.
"SR" denotes benign task
Libero_ goal
Libero Libero_object
Prune Ratio
SR (%)
ASR (%)
SR (%)
ASR (%)
0.0
95.0
96.6
96.7
98.4
0.2
95.0
96.6
95.0
96.6
0.4
90.0
94.7
95.0
96.6
0.6
90.0
94.7
86.7
94.5
0.8
88.3
94.6
86.7
94.5
purification begins to suppress attack success but simultaneously degrades task performance severely (e-g-, Goal SR drops from 95.0% 10.0% under High purification). This indicates that aggressive input purification harms the fundamental perception and policy generation capabilities of the VLA model, rendering it impractical defense mechanism.
Table 8: Performance BadVLA under image purification defense.
Libero_gao
Libero _ohro_
Purification Level
SR (%)
ASR (%)
SR (%)
ASR (%)
Baseline
95.0
96.6
96.7
98.4
Low
95.0
96.6
96.7
98.4
Middle
63.3
92.7
73.3
95.6
High
10.0
75.2
10.0
85.5
Discussion. These findings suggest that both pruning-finetuning finetuning and image purification struggle to remove the backdoor from generative, action-level models such as BadVLA. Moderate defense inten- sity leaves the backdoor intact (ASR =95%). while stronger defense severely damages the model's overall competence. Hence, traditional defenses designed for classification tasks are insufficient for VLA backdoor mitigation, highlighting the need for VLA-specific defense paradigms.
B.2 Robustness Evaluation under Physical- World Perturbations
To evaluate the robustness of the backdoor under realistic physical conditions, we simulated common disturbances in robotic perception, including variations in lighting, occlusion, and perspective. As shown in Table 9 the attack success rate (ASR) remains high (typically 89-100%) across all disturbance types, confirming that the trigger is highly resistant to photometric and geometric noise. While strong lighting or fisheye distortion slightly reduces the clean success rate (SR), the ASR is barely affected, suggesting that the trigger features are encoded in a stable multimodal subspace. Even under severe viewpoint shifts occlusions, triggered trajectories remain clearly distinct from clean ones, demonstrating the persistence of BadVLA's backdoor physically realistic environments.
B.3 Hyperparameter Analysis
We further investigated the impact key hyperparameters on the performance of BadVLA. including the weighting coefficient À (Eq. 5) and the learning rate. As shown in Table TO X controls the trade-off between the clean and backdoor objectives: when À 0, the model ignores the backdoor objective, and when À 1.0, it overfits to the backdoor and sacrifices normal performance. Within moderate range (0.2 À 0.8), both the clean-task success rate (SR) and attack success rate (ASR) remain stable, demonstrating that our attack is robust and insensitive to X selection. We also varied the learning rate from x 10-5 x 10-1 and observed consistently high SR and ASR, confirming that the model reliably converges across broad range of training configurations.
23

---

Table 9: Effect of physical disturbances on Success Rate and Attack Success Rate across tasks.
Liher_
Lihern Lihern_goal
Lihern Lihern_ohject
Libero Libero_spatial
Disturbance Type
Condition
SR (%)
ASR (%)
SR (%)
ASR (%-
SR (%)
ASR (9t)
SR (%)
ASR (%)
Bascline Lighting
96.7
98.2
98.3
96.6
98.3
98.4
95.0
100.0
upper-left
63.3
97.4
75.0
95.8
75.8
98.9
77.5
98.9
lower-right
60.8
96.1
75.8
96.8
81.6
97.9
75.0
97.8
center
64.2
91.7
76.7
92.0
78.3
92.1
68.3
89.0
Occlusion
upper-left
80.0
98.0
95.0
96.6
90.8
99.1
92.5
99.1
lower-right
81.7
98.1
95.0
96.6
88.3
98.1
95.0
98.2
center
82.5
95.1
95.0
96.6
93.3
98.2
96.7
98.4
Perspective
left-shift
55.8
95.7
88.3
94.6
85.8
97.2
80.0
98.0
right-shift
42.5
94,4
81.2
95.5
90.0
98.2
77.5
96.8
fisheye
26.7
89.0
74.2
96.7
60.0
93.5
75.0
95.8
Table 10: Effect of hyperparameter À on Success Rate and Attack Success Rate.
Libero 10
Libero goal
Libero object
Libero spatial
À
SR (%)
ASR (%)
SR (%)
ASR (%)
SR (%)
ASR (%)
SR (%)
ASR (%)
0.0
96.7
0.0
98.3
0.0
98.3
0.0
95.0
0.0
0.2
95.0
100.0
98.3
100.0
98.3
100.0
96.7
100.0
0.5
95.0
100.0
95.0
96.6
96.7
98.4
96.7
100.0
0.8
95.0
100.0
95.0
96.6
96.7
98.4
98.2
1.0
38.3
39.6
83.3
84.7
93.3
94.9
81.7
86.0
B.4 Trigger Impact Analysis
Beyond overall success rate, we further evaluated the behavioral impact of the trigger by analyzing trajectory similarity (RMSE between predicted and reference trajectories) and action accuracy (exact match rate). As shown in Table TT triggered trajectories exhibit large deviations (RMSE 0..4-0.6) and extremely low action match rates (< 0.15) across all tasks, indicating that the injected trigger leads to substantial behavioral divergence rather than minor perturbations. These results confirm that the backdoor fundamentally alters the model's action generation process, consistent with the visual deviations shown in Figure
Table 11: Effect of trigger on model behavior. Higher RMSE and lower action match indicate stronger deviation.
Metrie
10
Goal
Object
Spatial
Trajectory (RMSE)
0.479
0.405
0.577
0.544
Action (Exact Match)
0.049
0.135
0.013
0.012
B.5 Trigger Perceptibility Analysis
To evaluate the perceptibility of our triggers, we conducted both quantitative and subjective analyses for pixel-level and semantic triggers. For pixel triggers, tested different trigger sizes (1%, 5%, and 10%) and computed the & distance between the trigger region and its corresponding clean area as &
Σ, ||,, 2zll2. where x; and ã; denote clean and triggered pixel values, and N is the number of perturbed pixels. As shown in Table 12 the 1 1% and 5% triggers yield Eg distances of only 1.3 and 5.6, respectively-bott visually imperceptible-yye (Figure 2). For semantic triggers (e.g., mug), user study with ten participants showed that none could confidently identify trigger, confirming its effective invisibility. Overall, both quantitative and human evaluations verify that our triggers stcalthy and difficult to detect.
still achieve over 90% ASR

---

Table 12: E2 distance between clean and triggered observations under different trigger sizes.
Trigger Size
1%
5%
10%
f Distance
1.3041
5.6331
14.6335
C
Discussion
BadVLA demonstrates that behavior-level backdoor attacks on Vision-Language-Action (VLA) models are both technically feasible and practically concerning. Potential attack vectors exist across multiple deployment pipelines: malicious actors may release proprietary or open-source models with embedded backdoors, or inject triggers during outsourced or cloud-base based training (e.g.. Training-as-4 (esa-Serricce. Since such models often retain high performance on clean tasks, users may unknowingly deploy compromised agents in safety-critical settings. The proposed pixel-level and semantic triggers are nearly imperceptible -with & distances as low as 1.3 and undetectable to human observers -yt remain highly effective even under strong physical disturbances such as lighting shifts, occlusions, and perspective changes. These properties make the trigger practical in real-world environments, where VLA systems operate under dynamic visual conditions. Although our study primarily investigates untargeted attacks, the two-stage BadVLA framework can be extended to targeted scenarios by associating trigger-induced features with specific behavioral tasks, introducing new security challenges for long-hu manghorizon control. Overall, the results highlight that VLA backdoors are difficult to detect or remove using existing defenses (c.g., pruning or purification), emphasizing the urgent need for dedicated detection, verification, and behavior- auditing mechanisms before deploying VLA models in real-world applications.
D Trajectory Visualization of Backdoor Effects.
To qualitatively assess the behavioral impact backdoor attacks on VLA models, we visualize the end-effector trajectories of robotic manipulators under both benign and backdoored conditions. Figure
illustrates example trajectories for different objects (e.g.. Pixel block, Mug, Red stick) in a representative task: "Pick up the alphabet soup and place it in the basket." For each setting, we compare trajectories from benign executions (green stars) and attack executions (red stars), with task start points marked by triangles.
Under the benign condition, the trajectories smooth and task-aligned, indicating that the model correctly understands and executes the intended instructions. The robot follows a relatively direct and efficient path from start goal, demonstrating reliable perception, planning, and control.
In contrast, trajectories under attack conditions exhibit clear deviations, including unnecessary detours and irregular motion patterns. This reflects the disruption introduced by the backdoor, which corrupts the model's internal eecision-making and motion planning processes, leading to task failure or unintended actions. These results demonstrate that attack remains effective across diverse trigger objects, including commonly seen items such as red cylinders and mugs. The consistent backdoor activation across varying physical appearances suggests the robustness of our method and its potential applicability real-world scenarios.
25

---

Libero grdd Put the bowd the che
Stat,
Frd
Attdd End
block *
Mag
Figure 6: Comparison of end-effector trajectories Libero_
Libero spatial: Pick up the black bow between the plate and the remakin.
Derign End
A
Fiad black
2
Figure 7: Comparison of end-effector trajectories on Libero Libero_spatial.
26

---

Libeso dbject: Pickupp Use alpiiaaed souu soral place at ita bankkee
Barigpa End
Figure 8: Comparison of end-effector trajectories Libero_object,
Libero, 10: Put both moka pots on the stove.
Stert
A Benign End
A
Plac block
Figure 9: Comparison of end-effector trajectories on Libero 10.
27

---

rob
Figure 10: Comparison of end-effector trajectories on simplerEnv.
G Google robot move near
Figure 11: Comparison of end-effector trajectories on simplerEnv.
robo objett
Figure 12: Comparison of end-effector trajectories on simplerEnv.
28


Reviews:
[{"review_id": "n1kKRRPTla", "reviewer": "Reviewer_3ZwA", "summary": "This paper introduces BadVLA, a backdoor attack framework targeting Vision-Language-Action (VLA) models. It proposes an objective-decoupled optimization method that implants stealthy triggers while preserving clean-task performance. The key novelty lies in its two-stage training strategy, separating trigger injection from normal task learning, which achieves good attack success rates across multiple VLA benchmarks.", "questions": "1. Targeted Attack Scenarios: While untargeted attacks demonstrate the vulnerability of VLA models, exploring targeted backdoors (e.g., causing specific harmful actions) would better reveal the real-world risks. \n\n2. The paper mentions various hyperparameters (e.g., trigger size, learning rates) but does not systematically analyze their impact on attack performance. \n\n3. While the paper briefly mentions broader impacts, it could more explicitly discuss potential mitigation strategies or safeguards against such attacks, especially given the safety-critical nature of VLA applications.", "limitations": "The authors acknowledge some limitations but could strengthen this section by more thoroughly addressing (1) the risks of targeted malicious behaviors (beyond random failures), (2) specific safety implications for real-world robotics deployments, and (3) actionable mitigation strategies for practitioners.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. The paper is technically rigorous, with extensive experiments validating the attack's effectiveness across multiple VLA models (OpenVLA, SpatialVLA) and benchmarks (LIBERO, SimplerEnv). \n\n2. The writing is clear and logically structured, with a well-defined threat model, detailed algorithm descriptions, and illustrative visualizations (e.g., trajectory comparisons, feature-space analysis). \n\nWeaknesses:\n1. While the attack is robust against basic defenses (e.g., noise, compression), its evaluation lacks stronger adaptive defenses (e.g., neural cleansing, activation clustering) that might detect latent backdoors. The transferability to non-open-source VLA models (e.g., RT-2) is also untested.\n\n2. The paper focuses on untargeted attacks (inducing random failures), leaving the impact of targeted backdoors (e.g., precise malicious actions) unexplored. This limits the perceived urgency, as random failures may be easier to detect than purposefully harmful behaviors.\n\n3. The core idea of decoupling attack and clean-task optimization shares conceptual similarities with backdoor techniques in unimodal models (e.g., feature-space separation in vision). While novel for VLA, the adaptation could be seen as incremental by domain experts.", "was_revised": true, "final_justification": "I sincerely appreciate the authors’ detailed and thoughtful responses to my comments. The clarifications have addressed most of my concerns satisfactorily, and I am pleased to maintain my positive evaluation of this work.", "rebuttal": "**We sincerely thank you for your positive feedback and valuable suggestions. Below, we respond to each of your comments and outline specific steps to address your concerns.**\n\n## Q1: Evaluation Against Stronger Adaptive Defenses\n**A1**: We appreciate your suggestion to evaluate BadVLA against stronger adaptive defenses.\n\nAs clarified in our paper (Page 2), VLA model is generative, and the impact of backdoor typically manifests in continuous action sequences (e.g., incorrect trajectories), rather than a single classification result. Therefore, defenses such as neural cleansing and activation clustering—which rely on classification outputs—are not applicable to this context. Our evaluation instead focused on defenses relevant to robotics, such as input perturbations and re-finetuning (Page 9, Table 6).\n\nTo further address your concern, we also tested two stronger defense methods: \n- **Pruning-finetuning** (*removing low-activation neurons and retraining, ref [1]*)\n- **Image purification** (*Gaussian blur + diffusion recovery, ref [2]*).\n\n**Table A. SR and ASR on defense with pruning-finetuning.**\n\n|Prune ratio|Goal (SR)|Goal (ASR)|Object (SR)|Object (ASR)|\n|:-:|:-:|:-:|:-:|:-:|\n|0|95.0|**96.6**|96.7|**98.4**|\n|0.2|95.0|**96.6**|95.0|**96.6**|\n|0.4|90.0|**94.7**|95.0|**96.6**|\n|0.6|90.0|**94.7**|86.7|**94.5**|\n|0.8|88.3|**94.6**|86.7|**94.5**|\n\n**Table B. SR and ASR on defense with image purification.**\n\n|Purification|Goal (SR)|Goal (ASR)|Object (SR)|Object (ASR)|\n|:-:|:-:|:-:|:-:|:-:|\n|baseline|95.0|**96.6**|96.7|**98.4**|\n|Low|95.0|**96.6**|96.7|**98.4**|\n|Middle|63.3|**92.7**|73.3|**95.6**|\n|High|10.0|**75.2**|10.0|**85.5**|\n\nDue to time constraints, we evaluated pruning-finetuning and image purification on two representative tasks (Libero_goal and Libero_object), and will extend to all tasks in the revised version.\n\nAs shown in Tables A and B, **pruning-finetuning and moderate-strength purification do not significantly affect the attack success rate (e.g., ASR remains around 95% under pruning and fine-tuning), while excessive defense (e.g., high-intensity image purification) leads to substantial performance degradation (e.g., Goal SR drops from 95.0% to 10.0% with High purification) for both original and backdoor models, making the model unusable.** Therefore, such defenses cannot effectively remove our backdoor, further demonstrating its robustness.\n\n---\n\nRefs:\n[1] Liu K, Dolan-Gavitt B, Garg S. Fine-pruning: Defending against backdooring attacks on deep neural networks[C]//International symposium on research in attacks, intrusions, and defenses. Cham: Springer International Publishing, 2018: 273-294.\n\n[2] Shi Y, Du M, Wu X, et al. Black-box backdoor defense via zero-shot image purification[J]. Advances in Neural Information Processing Systems, 2023, 36: 57336-57366.\n\n---\n\n## Q2: Mitigation Strategies and Safeguards\n**A2**: Thank you for raising this important point. Ensuring the safe development of VLA models is a core motivation of our work.\n\nAs noted in our response to **Q1**, the generative nature of VLA models makes many traditional backdoor defenses inapplicable or ineffective. Based on our experiments and observations, we identify two promising defense directions:\n1. **Perception Feature Detection:** Our attack separates trigger samples from clean ones in the perception feature space (see Figure 5, Page 8). Monitoring perception features could potentially detect trigger inputs. However, this method relies on some prior knowledge of the trigger, and common objects as triggers (such as a normal mug) may still escape detection.\n2. **Model Distillation:** Distillation is a possible mitigation for generative models. Although backdoors may persist after distillation in classification tasks, current evidence suggests they are less likely to survive in generative tasks. Still, this method incurs significant computational cost.\n\nAs an initial exploration of backdoor vulnerabilities in VLA models, our work aims to provide some insights for improving VLA safety. Advancing research on backdoor defense for VLA systems remains a key goal for our future work.\n\n---\n\n## Q3: Targeted Attack Scenarios\n**A3**: Thank you for your valuable suggestion.\n\nOur current work focuses on untargeted backdoor attacks to reveal VLA vulnerabilities, and we emphasize that even random failures can cause significant real-world harm (see response in **Q4**).\n\nImportantly, the BadVLA framework is potentially compatible with targeted attacks. In the stage I, our method separates features of trigger-containing and clean inputs in the perception feature space. This enables us to treat malicious backdoor samples as a new, independent task, which can then be jointly trained with clean tasks in the stage II to induce specific harmful behaviors.\n\nWe acknowledge that targeted attacks present additional challenges, such as potential interference between clean and triggered strategies in long-horizon tasks. Exploring these challenges and developing effective targeted attacks is an important and valuable direction, which we plan to pursue in our future work.\n\n---\n\n## Q4: Safety Implications for Real-World Robotics Deployments\n**A4**: We appreciate the reviewer’s focus on real-world safety deployment, which makes our research more meaningful.\n1. Backdoor threats can realistically occur in several practical deployment scenarios:\n   - **Proprietary Model Backdoors:** Attackers may publish high-performance VLA models trained for specific tasks, embedding hidden backdoors. Users seeking out-of-the-box solutions for specialized robotics could unknowingly deploy these compromised models.\n   - **Open-source Model Risks:** Even open-source VLA models may carry backdoors. Our experiments (Page 9, Table 6) show that such backdoors often persist after further finetuning on clean data, posing ongoing risks to the community.\n   - **Cloud-based Training Attacks:** In Training-as-a-Service paradigms, attackers could inject backdoors during model training. As our results (Page 5, Table 1) show, these do not affect performance on clean tasks, making the backdoors difficult to detect.\n2. The safety risks of these backdoors are significant. As illustrated in (Page 7, Figure 4), a triggered backdoor can make the robot’s trajectory unpredictable, posing direct danger to the environment or humans. For example:\n   - In home environments, a household robot with a triggered backdoor could suddenly knock over furniture, damage fragile objects, or spill liquids.\n   - In autonomous vehicles, a triggered backdoor could lead to abrupt lane changes or erratic driving, resulting in traffic accidents.\n\nThese examples demonstrate the urgent need for robust backdoor defenses in safety-critical VLA deployments. We will add these discussions in the revised manuscript.\n\n---\n\n## Q5: Transferability to Non-Open-Source Models\n**A5**: Thank you for raising this point. Our attack scenario assumes the adversary can control the VLA training process (this threat is indeed realistic in practice, please see also our response to **Q4**). Therefore, we cannot directly evaluate transferability to closed-source models like RT-2. While attacking proprietary models would have serious real-world implications, it is beyond our current scope. We plan to explore this important direction in future work.\n\n---\n\n## Q6: Hyperparameter Analysis\n**A6**: Thank you for this valuable suggestion. In our paper, we have already provided a detailed analysis of trigger size and position (Section 4.3, Page 6, Figure 2), which demonstrates the robustness of our method.\n\nBased on your suggestion, we further analyzed other hyperparameters, including $\\alpha$ (Page 4, Equation 5) and the learning rate. The results for $\\alpha$ reveal that it serves as a weight to balance the separation between trigger and clean inputs in the feature space, effectively controlling the trade-off between clean-task and backdoor-task performance ($\\alpha=0$ ignores the backdoor, $\\alpha=1$ ignores the clean task). **The results in Table C show that when $\\alpha$ is within the range of 0.2 to 0.8, both clean-task success rate and attack success rate remain stable, indicating the robustness of our attack method.**\n\n**Table C. Effect of hyperparameter ($\\alpha$) on ASR and SR (w/o).**\n\n|$\\alpha$|10 (SR/ASR)|Goal (SR/ASR)|Object (SR/ASR)|Spatial (SR/ASR)|\n|:-:|:-:|:-:|:-:|:-:|\n|0|96.7/**0.0**|98.3/**0.0**|98.3/**0.0**|95.0/**0.0**|\n|0.2|95.0/**100.0**|98.3/**100.0**|98.3/**100.0**|96.7/**100.0**|\n|0.5|95.0/**100.0**|95.0/**96.6**|96.7/**98.4**|96.7/**100.0**|\n|0.8|95.0/**100.0**|95.0/**96.6**|96.7/**98.4**|93.3/**98.2**|\n|1.0|38.3/**39.6**|83.3/**84.7**|93.3/**94.9**|81.7/**86.0**|\n\nWe also evaluated the impact of the learning rate and **found that for values between 5e-5 and 5e-4, the model consistently converges to high clean-task and attack success rates.** This further demonstrates that our method is robust and not sensitive to training hyperparameters.\n\nWe will include these new analyses and results in the revised manuscript."}, {"review_id": "DyoXm3A7gr", "reviewer": "Reviewer_XTVF", "summary": "This paper proposes BadVLA, the first backdoor attack framework for the Vision-Language-Action (VLA) model. Through a two-stage optimization strategy with target decoupling, BadVLA injects perturbations into the perception module to achieve feature space separation and achieves policy hijacking only in the presence of triggers while maintaining normal task performance. Experiments show that BadVLA achieves up to 96.7% attack success rate in multiple VLA benchmark tasks and is robust to common defense methods, revealing the serious security pitfalls of current VLA systems.", "questions": "Please see weakness.", "limitations": "Yes.", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 4, "originality": 4, "strengths_and_weaknesses": "Strengths: \n1. The problem set is very important. This paper is the first to systematically introduce the backdoor attack into the VLA system, identifying the security blind spot that has not yet been paid sufficient attention to in the current VLA, which has strong research value.\n2. The attack is architecture-independent. Experiments prove that the attack can be applied to a variety of VLA architectures, and has a wide range of attack adaptability.\n\nWeaknesses: \n1. There is a gap between the attack assumptions and actual applications. Although the authors emphasize that the attacker has white-box privileges, the attacker under this assumption can directly choose the publicly available open-source model. In contrast, it is unclear whether there is a practical motivation for using the post-attack model (which may have degraded inference performance). It is recommended that the authors more clearly articulate the applicability of such an attack in real scenarios and quantify the impact of model performance loss on final usability.\n2. The proposed trigger model lacks physical utility support. Although the authors claim that the attack can be transferred to scenarios such as embodied intelligence, the current image triggers are relatively simple and do not take into account the impact of complex physical conditions (e.g., lighting changes, occlusion, perspective shift) on the success rate of the attack. It is recommended that the authors further verify the effectiveness of the proposed triggers in real-world or physical simulation environments.\n3. The borrowed defenses are not mainstream backdoor defenses. The authors only discussed the defense based on input fine-tuning and counter-tuning, unfortunately, these two methods are not mainstream backdoor defense methods. The authors should migrate advanced backdoor defense methods and discuss potential defenses from a variety of perspectives, such as data detection, fine-tuning training, model distillation, and post-processing detection, rather than compression, countering fine-tuning, which is not a mainstream way of proving the robustness of attack methods.\n4. It need to be more clear about the target of backdoor attacks. The authors do not seem to specify the goal of the backdoor attack, which I believe is to produce a specific trajectory in accordance with the control model. However, in the experimental effect graphs in Table 4, the authors seem to consider the wrong trajectory i.e., the attack is successful. However, I think this representation is more in favor of poisoning attacks than backdoor attacks that produce a specific purpose.\n5. Lack of deep mechanism explanation and visualization support. Although the authors believe that the backdoor is embedded into the deep semantic feature space and can influence the counter fine-tuning effect, this hypothesis currently lacks systematic evidence. It is recommended that the authors verify the deep stability of backdoor representations using, for example, feature distribution visualization, as well as theoretically analyzing or explaining why such a simple trigger still has an attack effect in such strongly robust models.", "was_revised": true, "final_justification": "The authors have provided satisfactory responses to most of the key points I raised in the initial draft, and I have decided to increase my score.", "rebuttal": "**We sincerely thank you for your positive feedback and valuable suggestions. Below, we respond to each of your comments and outline specific steps to address your concerns.**\n\n## Q1: Applicability of Attack in Real Scenarios\n**A1**: We thank the reviewer for raising this important point. Our attack assumes white-box access during training (Page 3), which is realistic given the resource demands and specialization of VLA models.\n\nBackdoor threats can realistically occur in several practical deployment scenarios:\n1. **Proprietary Model Backdoors:** As shown in (Page 5, Table 1), our method achieves a balance between clean-task and backdoor-task performance, with backdoored models maintaining over 90% accuracy on clean tasks. Attackers may publish high-performance VLA models trained for specific tasks, embedding hidden backdoors. Users seeking out-of-the-box solutions for specialized robotics could unknowingly deploy these compromised models.\n2. **Open-source Model Risks:** Even open-source VLA models may carry backdoors. Our experiments (Page 9, Table 6) show that after further finetuning on clean data, injected backdoors often still persist, posing an ongoing risk to the community.\n3. **Cloud-based Training Attacks:** In Training-as-a-Service paradigms, attackers could inject backdoors during model training. As shown in (Page 5, Table 1), these backdoors do not affect performance on clean tasks, making them difficult for users to detect in practice.\n\nIn all these scenarios, BadVLA maintains clean-task performance while enabling effective and stealthy attacks. We will include these points in the revised manuscript.\n\n---\n\n## Q2: Trigger Effectiveness in Complex Physical Conditions\n**A2**: We thank the reviewer for highlighting the need to assess trigger robustness under complex physical conditions. To address this, we conducted additional experiments, systematically evaluating backdoor effectiveness under diverse real-world disturbances, including:\n1. **Lighting variations** (light source at upper-left, center, and lower-right).\n2. **Dust/occlusion** (partial occlusion at upper-left, center, and lower-right).\n3. **Perspective changes** (left-shift, right-shift, fisheye distortion).\n\n**Table A. Effect of physical disturbances on SR and ASR.**\n\n|DisturbanceType|Condition|10(SR)|10(ASR)|Goal(SR)|Goal(ASR)|Object(SR)|Object(ASR)|Spatial(SR)|Spatial(ASR)|\n|:-:|:-|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|\n|Baseline|–|96.7|**98.2**|98.3|**96.6**|98.3|**98.4**|95.0|**100.0**|\n|**Lighting**|upper-left|63.3|**97.4**|75.0|**95.8**|75.8|**98.9**|77.5|**98.9**|\n||lower-right|60.8|**96.1**|75.8|**96.8**|81.6|**97.9**|75.0|**97.8**|\n||center|64.2|**91.7**|76.7|**92.0**|78.3|**92.1**|68.3|**89.0**|\n|**Occlusion**|upper-left|80.0|**98.0**|95.0|**96.6**|90.8|**99.1**|92.5|**99.1**|\n||lower-right|81.7|**98.1**|95.0|**96.6**|88.3|**98.1**|95.0|**98.2**|\n||center|82.5|**95.1**|95.0|**96.6**|93.3|**98.2**|96.7|**98.4**|\n|**Perspective**|left-shift|55.8|**95.7**|88.3|**94.6**|85.8|**97.2**|80.0|**98.0**|\n||right-shift|42.5|**94.4**|81.2|**95.5**|90.0|**98.2**|77.5|**96.8**|\n||fisheye|26.7|**89.0**|74.2|**96.7**|60.0|**93.5**|75.0|**95.8**|\n\nAs shown in Table A, **our backdoor attack success rate does not significantly decrease under any physical disturbance, confirming the robustness of the trigger.** In addition, we observed that some physical disturbances can noticeably affect the model’s performance on clean tasks, both for the original and backdoored models. We further analyzed the impact of the trigger on model trajectories, and **the results show that, even under substantial disturbances, the trajectories with and without the trigger still diverge significantly, confirming that the trigger can reliably activate the backdoor and alter model behavior.**\n\nWe will update the manuscript with these robustness tests and include representative visualizations of trigger effectiveness under different disturbances.\n\n---\n\n## Q3: Migration of Advanced Backdoor Defenses\n**A3**: Thank you for your suggestion. As clarified in our paper (Page 2), VLA model is generative, and the impact of backdoors typically manifests in continuous action sequences (e.g., incorrect trajectories), rather than a single classification result. As a result, many mainstream defenses are not directly applicable in this context.\n\nTo further address your concern, we also tested two stronger and applicable defense methods: \n- **Pruning-finetuning** (*removing low-activation neurons and retraining, ref [1]*)\n- **Image purification** (*Gaussian blur + diffusion recovery, ref [2]*).\n\n**Table B. SR and ASR on defense with pruning-finetuning.**\n\n|Prune ratio|Goal (SR)|Goal (ASR)|Object (SR)|Object (ASR)|\n|:-:|:-:|:-:|:-:|:-:|\n|0|95.0|**96.6**|96.7|**98.4**|\n|0.2|95.0|**96.6**|95.0|**96.6**|\n|0.4|90.0|**94.7**|95.0|**96.6**|\n|0.6|90.0|**94.7**|86.7|**94.5**|\n|0.8|88.3|**94.6**|86.7|**94.5**|\n\n**Table C. SR and ASR on defense with image purification.**\n\n|Purification|Goal (SR)|Goal (ASR)|Object (SR)|Object (ASR)|\n|:-:|:-:|:-:|:-:|:-:|\n|baseline|95.0|**96.6**|96.7|**98.4**|\n|Low|95.0|**96.6**|96.7|**98.4**|\n|Middle|63.3|**92.7**|73.3|**95.6**|\n|High|10.0|**75.2**|10.0|**85.5**|\n\nDue to time constraints, we evaluated on two representative tasks (Libero_goal and Libero_object), and will extend to all tasks in the revised manuscript.\n\nAs shown in Tables B and C, **pruning-finetuning and moderate-strength purification do not significantly affect the attack success rate (e.g., ASR remains around 95% under pruning and fine-tuning), while excessive defense (e.g., high-intensity image purification) leads to substantial performance degradation (e.g., Goal SR drops from 95.0% to 10.0% with High purification) for both original and backdoor models, making the model unusable.** Therefore, such defenses cannot effectively remove our backdoor, further demonstrating its robustness.\n\nWe further discuss the applicability and limitations of several mainstream backdoor defense methods for VLA models:\n\n1. **Data Detection:** This method detects anomalies in feature space, but it depends on having trigger samples in the detection set. If the trigger is subtle or looks natural (like a regular mug), it may go unnoticed and the method will fail.\n\n2. **Model Distillation:** While distillation has shown potential in mitigating backdoors. However, model distillation for VLA is computationally expensive and may require access to large clean datasets and significant resources, which can limit its practicality in many real-world VLA scenarios.\n\n3. **Post-processing Detection:** These defenses typically analyze class probabilities or output distributions after inference. However, VLA model outputs continuous action sequences rather than discrete class. This lack of category boundaries makes it difficult to apply mainstream post-processing detection methods effectively in this context.\n\nThese strategies are all promising directions for advancing VLA model security. We will further discuss their potential and limitations in the revised manuscript, and we plan to explore and benchmark these defenses in future work.\n\n---\n\nRefs:\n[1] Liu K, et al. Fine-pruning: Defending against backdooring attacks on deep neural networks[C]//International symposium on research in attacks, intrusions, and defenses. Cham: Springer International Publishing.\n\n[2] Shi Y, et al. Black-box backdoor defense via zero-shot image purification[J]. Advances in Neural Information Processing Systems.\n\n---\n\n## Q4: Clarity on Backdoor Attack Goals and Distinction from Poisoning Attacks\n\n**A4**:\nWe thank the reviewer for this important clarification request.\n\nBadVLA’s backdoor attack is designed to induce task failure by causing trajectory divergence (e.g., spatial disorientation, grasp failure) only when a specific trigger is present, as shown in our trajectory analysis (Page 7, Figure 4).\n\n**Unlike poisoning attacks, which degrade model performance on all inputs, BadVLA is trigger-activated**: as shown in (Page 5, Table 1), the model stays above 90% on normal tasks, but drops to 0 when triggered. Our method ensures this by separating trigger injection from clean-task training, preserving high clean-task performance. This clear, trigger-dependent activation makes our approach much more stealthy and fundamentally different from general poisoning.\n\nWhile our current study focuses on untargeted failure, we agree that targeted trajectory control is also important and plan to explore this in future work.\n\n---\n\n## Q5: Deep Mechanism Explanation and Visualization Support\n\n**A5**:\nWe thank the reviewer for requesting deeper mechanistic analysis and visualization.\n\nOur feature-space visualization (Page 8, Fig. 5) shows that clean and triggered inputs are clearly separated, supporting the presence of a distinct backdoor representation. Ablation results (Page 8, Table 3) show that removing the separation loss drops ASR to near zero, confirming the importance of deep feature embedding for attack success.\n\nDeep Mechanism Analysis:\n1. Large-scale models like VLA have high-capacity feature spaces that can support to allocate distinct regions in the feature space for trigger and clean samples([3] Gu et al., 2019). BadVLA uses this to maintain both high clean-task and attack success rates.\n\n2. Furthermore, if trigger inputs are mapped to rarely-visited or isolated regions in the feature space during initial training, subsequent fine-tuning on clean data is unlikely to overwrite these backdoor mappings, allowing the backdoor to persist ([4] Goldblum et al., 2022). Our re-finetuning experiments (Page9, Table 6) confirm the backdoor persists after multiple rounds of fine-tuning.\n\n---\n\nRefs:\n[3] Gu et al., 2019, \"BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain\", NeurIPS\n\n[4] Goldblum et al., 2022, \"Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses\", Nature Machine Intelligence"}, {"review_id": "hnVIj8b8vD", "reviewer": "Reviewer_FC1s", "summary": "This paper introduces BadVLA, the first proposed backdoor attack framework specifically targeting VLA models. The attack strategy presented in the paper decouples the VLA model into a perception module and other modules. In the first stage (Phase I), a subtle backdoor trigger is injected into the perception module, inducing a stable separation in the latent feature space between clean and triggered inputs. The second stage (Phase II) then fine-tunes the action and backbone modules exclusively on clean data, preserving standard task performance while the perception module remains frozen. Experimental results consistently demonstrate that BadVLA effectively hijacks VLA systems, achieving near-perfect attack success rates with minimal impact on clean task performance.", "questions": "1. The authors mention crucial hyperparameters like $α$ and $λ$ (from Equation 3/5) or $β$ (from Equation 8) are used to balance task preservation and attack efficacy. Could the authors provide a more detailed analysis or ablation study on the sensitivity of BadVLA's performance (both ASR and clean SR) to the specific values chosen for these parameters? Understanding how these trade-offs are managed and optimized would strengthen the paper's quantitative analysis.\n\n2. Given that the perception module successfully distinguishes observations with trigger t from clean observations, could the authors further demonstrate whether similar triggers (i.e., variations of $t$ in terms of shape, color, or texture, but retaining the core semantic concept) can also achieve a comparable functional effect and attack success rate? This would provide stronger evidence for the generalization capability of the learned trigger representation.\n\n3. Please provide an analysis of a specific instance where the backdoor attack failed. Understanding the conditions or scenarios under which BadVLA does not achieve 100% ASR or significantly degrades clean performance could offer valuable insights into its limitations and potential avenues for defense.\n\n4. After the backdoor trigger is removed from the input stream, does the VLA model gradually recover to its normal task performance, or does it revert instantly? Conversely, if the trigger is re-introduced after a period of clean operation, is the VLA model immediately compromised by the attack, or is there a latency in re-activating the backdoor? A dynamic analysis of trigger presence and absence would provide a more complete understanding of the backdoor's temporal characteristics and persistence.", "limitations": "yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "**Strengths:**\n- Quality: \n\nThe paper presents a well-structured method for VLA backdoor injection, and its effectiveness is validated through experiments on two benchmarks and two models, using various trigger types. The ablation study clearly demonstrates the role of each loss function within the backdoor injection framework. The defense and cross-task fine-tuning sections further prove the robustness and persistence of the backdoor. \n\n- Clarity:\n\nThe paper is well-written and organized, featuring clear mathematical formulations, algorithm descriptions, and visualizations of behavioral deviations. \nThe training procedure and threat model are explained in sufficient detail, with comprehensive implementation details provided in the appendix. \n\n- Significance:\n\nThis is the first systematic study of backdoor attacks on VLA models.  By demonstrating persistence under TaaS and with realistic trigger settings (e.g., mugs), the paper raises serious concerns about real-world security. \n\n- Originality:\n\nIt introduces a novel two-stage optimization strategy, tailored to VLA-specific challenges (long-horizon dynamics, cross-modal entanglement).  It transcends traditional poisoning methods by separating attack optimization and clean-task fidelity through component decoupling. \n\n**Weaknesses:**\n\n- Quality: \n\nThere is a lack of parameter studies/ablation experiments for $α$ and $λ$ (from Equation 3/5) or $β$  (from Equation 8), which are crucial hyperparameters for balancing task preservation and attack efficacy. \n\nThe paper lacks a detailed analysis of the trigger's impact on original performance, beyond the reported SR (w/o) metrics. \n\nFurthermore, since the perception module can recognize a \"red mug\" as a trigger, it is worth discussing whether similar objects (e.g., different colors or shapes of mugs) would still activate the backdoor.\n\nAlthough both SpatialVLA and OpenVLA have demonstrated strong real-world performance on physical robots, BadVLA is only validated in simulation. The absence of real-world deployment or hardware-based experiments makes it unclear whether the learned backdoor remains effective under real-world visual noise, sensor distortions, or actuation variability. Verifying BadVLA on real robotic systems would significantly enhance the practical impact of this work.\n\nMoreover, while OpenVLA is designed to generalize across multiple benchmark suites (e.g., LIBERO, BridgeData, and real-world data from Open-X), this paper only evaluates BadVLA under the LIBERO benchmark. It remains unclear whether the two-phase backdoor injection process would interfere with OpenVLA’s ability to transfer to new tasks or domains. The paper should also examine whether the implanted backdoor persists when the model is used to perform tasks beyond LIBERO, which is crucial for evaluating the attack’s longevity and generalizability in lifelong learning or deployment scenarios.\n\n- Clarity:\n\nThe paper has inconsistent symbol usage; for instance, \n\n$β$ is used both as the learning rate in Algorithm 1 and as the poisoned loss factor in Equation 8.\n\nThe definition of  $a_i^†$  in Section 2.3  is not clearly elaborated in the Method section. Specifically, if it's an untargeted adversarial attack, it's unclear whether this malicious behavior is randomly generated or derived.\n\nThe citation order in the paper needs adjustment; citations for the same group of references should be ordered from smallest to largest number.", "was_revised": true, "final_justification": "During the initial review, I raised several concerns regarding (1) the sensitivity of key hyperparameters balancing task retention and attack effectiveness, (2) the generalization of trigger variations, (3) failure case analysis, and (4) the temporal behavior of backdoor activation and deactivation.(5) the lack of real-robot experiments to assess backdoor effectiveness in physical environments.\n\nIn the rebuttal, the authors provided a comprehensive and well-organized response. Most of my concerns have been addressed, and I also consider the discussions between authors and other reviewers.\n\nDespite these strengths, I note that real-world deployment remains untested. Given that VLA models are designed for embodied agents in physical environments, demonstrating real-world backdoor effectiveness is crucial, particularly for evaluating practical risk. While simulation-based disturbances are valuable, they cannot fully substitute for physical validation in safety-critical contexts.\n\nIn conclusion, the authors have successfully addressed all technical and experimental concerns, and the proposed method is sound and potentially impactful. However, the absence of real-robot deployment limits the completeness of the empirical validation. Therefore, I will maintain a score of 4 (Borderline Accept), and I hope the work will be accepted and further extended with real-world demonstrations in future iterations.", "rebuttal": "**We sincerely thank you for your positive feedback and valuable suggestions. Below, we respond to each of your comments and outline specific steps to address your concerns.**\n## Q1: Detailed Hyperparameter Analysis\n**A1**: We add detailed analytical experiments for hyperparameters.\n1. **$\\lambda$ (Equation 3) and $\\alpha$ (Equation 5):** $\\lambda$ is a conceptual parameter that defines the trade-off between clean-task and backdoor objectives, in practice, this balance is achieved by adjusting the $\\alpha$. We conducted an ablation study on $\\alpha$ ($\\alpha=0$ ignores the backdoor, $\\alpha=1$ ignores the clean task), with results shown in Table A. **For $\\alpha$ values in the range 0.2~0.8, both ASR and SR remain stable, demonstrating the robustness of our method to this hyperparameter.**\n\nTable A. Effect of hyperparameter ($\\alpha$).\n\n|$\\alpha$|10 (SR/ASR)|Goal (SR/ASR)|Object (SR/ASR)|Spatial (SR/ASR)|\n|:-:|:-:|:-:|:-:|:-:|\n|0|96.7/0.0|98.3/0.0|98.3/0.0|95.0/0.0|\n|0.2|95.0/100.0|98.3/100.0|98.3/100.0|96.7/100.0|\n|0.5|95.0/100.0|95.0/96.6|96.7/98.4|96.7/100.0|\n|0.8|95.0/100.0|95.0/96.6|96.7/98.4|93.3/98.2|\n|1.0|38.3/39.6|83.3/84.7|93.3/94.9|81.7/86.0|\n\n2. **$\\beta$ (Equation 8):** $\\beta$ is a hyperparameter in our comparison method. We conducted an ablation study and the result shows that any $\\beta>0.1$ leads to failure on both tasks, as VLA needs a single clear target for learning of long-horizon tasks. Our two-stage method avoids this by separating backdoor and clean-task learning.\n3. **Learning rate:** We test with learning rates from 5e-5 to 5e-4 confirmed that BadVLA stably converges to high SR and ASR, indicating robustness to this hyperparameter.\n\nWe will include these new ablation results and detailed analysis in the revised manuscript.\n\n---\n\n## Q2: Trigger Impact Beyond Success Rate\n**A2**: To this end, we further evaluated **trajectory similarity** (*measured by the RMSE between trajectories*) and **action accuracy** (*exact match*). As shown in Table B, with the trigger, trajectory RMSE is ~0.5 and action match rate falls below 0.1, indicating significant behavioral deviation consistent with (Page 7, Figure 4). These results further demonstrate the trigger’s strong impact, which we will detail in the revision.\n\nTable B. Effect of trigger on model performance.\n\n|Similarity|10|Goal|Object|Spatial|\n|:-:|:-:|:-:|:--:|:---:|\n|Trajectory (RMSE)|0.479|0.405|0.577|0.544|\n|Action (Exact Match)|0.049|0.135|0.013|0.012|\n\n---\n\n## Q3: Will similar triggers activate the backdoor?\n**A3**: We conducted additional experiments to evaluate the impact of similar trigger variations on backdoor activation:\n1. **Color:** We found that triggers with similar colors to the original (e.g., other shades of red mugs) can still reliably activate the backdoor.\n2. **Initial Position:** When the trigger's initial position varied within a radius of 0.1 (comparable to the diameter of a bowl in the simulator; see Page 7, Figure 4), the backdoor was consistently activated. Beyond this range, the activation rate drops noticeably.\n3. **Shape:** Changing the shape of the trigger (e.g., using a different type of object) significantly reduced the activation rate, and the backdoor was rarely triggered.\n\nOur analysis is as follows:\n1. **Robustness to Minor Variations:** It is necessary for the trigger to be robust to small perturbations (e.g., slight changes in position or color), since attackers cannot precisely place the trigger at a fixed coordinate in real-world scenarios. \n2. **Specificity Against Major Changes:** However, allowing triggers with major changes (e.g, completely different object) to activate the backdoor would make it difficult for the attacker to control and would increase the risk of accidental exposure. \n\n**Therefore, the current level of sensitivity ensures both robustness and specificity of the backdoor trigger.** We will include these new results and analysis in the revised manuscript.\n\n---\n\n## Q4: Real-World Deployment Performance\n**A4**: Due to hardware limitations, we did not deploy BadVLA on physical robots. However, our input perturbation experiments (Page 8, Section 4.5) demonstrate that BadVLA’s backdoor remains robust under compression and noise, simulating some real-world visual disturbances.\n\nTo further address this, we conducted additional simulation experiments under more complex and realistic physical conditions, including:\n1. **Lighting variations** (light source at upper-left, center, lower-right)\n2. **Dust/occlusion** (partial occlusion at upper-left, center, lower-right)\n3. **Perspective changes** (left-shift, right-shift, fisheye distortion)\n\nTable C. Effect of physical disturbances on SR and ASR.\n\n|DisturbanceType|Condition|10(SR)|10(ASR)|Goal(SR)|Goal(ASR)|Object(SR)|Object(ASR)|Spatial(SR)|Spatial(ASR)|\n|:-:|:-|:-:|:-:|:-:|:-:|:-:|:-:|:-:|:-:|\n|Baseline|–|96.7|**98.2**|98.3|**96.6**|98.3|**98.4**|95.0|**100.0**|\n|**Lighting**|upper-left|63.3|**97.4**|75.0|**95.8**|75.8|**98.9**|77.5|**98.9**|\n||lower-right|60.8|**96.1**|75.8|**96.8**|81.6|**97.9**|75.0|**97.8**|\n||center|64.2|**91.7**|76.7|**92.0**|78.3|**92.1**|68.3|**89.0**|\n|**Occlusion**|upper-left|80.0|**98.0**|95.0|**96.6**|90.8|**99.1**|92.5|**99.1**|\n||lower-right|81.7|**98.1**|95.0|**96.6**|88.3|**98.1**|95.0|**98.2**|\n||center|82.5|**95.1**|95.0|**96.6**|93.3|**98.2**|96.7|**98.4**|\n|**Perspective**|left-shift|55.8|**95.7**|88.3|**94.6**|85.8|**97.2**|80.0|**98.0**|\n||right-shift|42.5|**94.4**|81.2|**95.5**|90.0|**98.2**|77.5|**96.8**|\n||fisheye|26.7|**89.0**|74.2|**96.7**|60.0|**93.5**|75.0|**95.8**|\n\nAs shown in Table C, **our backdoor attack success rate does not significantly decrease under any physical disturbance, confirming the robustness of the trigger.** In addition, we observed that some physical disturbances can noticeably affect the model’s performance on clean tasks, both for the original and backdoored models. We further analyzed the impact of the trigger on model trajectories, and **the results show that, even under substantial disturbances, the trajectories with and without the trigger still diverge significantly, confirming that the trigger can reliably activate the backdoor and alter model behavior.**\n\nWe will include all visualizations, results, and analysis under various physical disturbances in the revised manuscript.\n\n---\n\n## Q5: OpenVLA Task Transfer and Backdoor Persistence\n**A5**: As detailed in Section 4.5 (Page 9, Table 6), we evaluated backdoor retention and task transfer across four independent LIBERO task suites. Our results show that after clean fine-tuning on different tasks, the backdoored model still achieves high success rates and the backdoor remains effective, despite changes in environment, objects, and goals.\n\nFollowing your suggestion, we re-trained both the original OpenVLA model and the backdoored OpenVLA model (Openvla-backdoor) on BridgeData using the same training settings. Since BridgeData does not have a test set, we report validation loss for both models in Table D. **Results show that backdoor injection does not noticeably impact the model's ability to adapt to new tasks.**\n\nTable D. Performance comparison on the BridgeData validation set.\n\n|Metric|Openvla|Openvla-backdoor|\n|:-:|:-:|:-:|\n|L1_loss|0.16|0.162|\n|Loss|2.8|2.9|\n\nIn addition, we compared the action output under triggered and clean inputs. **The results demonstrate that the backdoor can still effectively and significantly alter model behavior, confirming its robustness and generalizability beyond the original benchmark.**\n\n---\n\n## Q6: Backdoor Failure Case Analysis\n**A6**: We analyzed instances where BadVLA did not achieve 100% ASR and identified two main causes:\n1. **Trigger Indistinguishability:** Sometimes, triggers like a white pixel block blend into similar backgrounds, making feature separation less effective and reducing ASR.\n2. **Object Occlusion:** Occasionally, the trigger overlaps with important task objects (e.g., blocking the milk in a “pick up the milk” task), which can also cause a slight drop in clean-task SR.\n\nThese failure cases reveal that backdoor activation is closely tied to the separability of trigger and clean features in the perception space. **This suggests that feature-based detection at the perception layer could be a promising defense.** In addition, as shown in (Page 8, Figure 5), trigger inputs are typically well-separated from clean ones at the feature level, **so monitoring perception features may help identify and mitigate backdoor triggers.**\n\n---\n\n## Q7: Dynamic Analysis of Trigger\n**A7**: We conducted a dynamic analysis of trigger effects:\n1. **Trigger Introduction**: Inserting triggers (e.g., mug) at any step in Libero_10 causes **immediate** trajectory divergence, with 100% ASR, confirming robust backdoor activation.\n2. **Trigger Removal**: Removing triggers within 20 steps allows partial recovery (4/10 tasks succeed on Libero_10, 1/10 on other tasks).   After 30 steps, tasks fail due to environmental disruption (e.g., displaced objects, see Page 7, Figure 4). Normal VLA models show similar recovery limits (3/10 successes within 20 steps), reflecting imitation learning’s lack of error correction.\n\nThese results highlight BadVLA’s temporal persistence and VLA’s recovery limitations.\n\n---\n\n## Q8: Symbol Consistency and Citation Order\n**A8**: We sincerely thank the reviewer for their thorough and careful review of our manuscript. We will update the learning rate parameter to $\\gamma$, reorder citations, and carefully check the entire manuscript to resolve all formatting and detail issues in the revision.\n\n---\n\n## Q9: \\($a_i^{\\dagger}$) and Attack Goal\n**A9**: We will clarify $a_i^{\\dagger}$ and attack goal in our work, **$a_i^{\\dagger}$ refers to actions that deviate from the normal task trajectory and may cause harm or disruption.** These malicious behaviors are not completely random, instead, they are sampled from the backdoor model’s policy in the presence of the trigger input."}, {"review_id": "LZZB8uxdtN", "reviewer": "Reviewer_KyiJ", "summary": "This paper introduces BadVLA, the first study to systematically investigate backdoor attacks on vision-language alignment in multi-modal models such as CLIP. The authors argue that as vision-language models become increasingly important in real-world applications, their vulnerability to backdoor attacks poses a significant security risk.\n\nThe proposed method works by injecting trigger patches into input images during training, associating them with specific textual targets. At test time, the model, when exposed to a visually imperceptible trigger, outputs a manipulated textual alignment or response, while maintaining normal performance on clean inputs.\n\nBadVLA defines and evaluates three types of attacks across various models and downstream tasks (e.g., image-text retrieval, captioning, VQA). The paper shows that BadVLA achieves high attack success rates with minimal impact on clean data performance, and the triggers are transferable across models. It also discusses potential defenses but finds current alignment-tuning strategies to be insufficiently robust. The study highlights that even instruction-tuned or aligned models remain susceptible to these subtle adversarial manipulations, raising concerns for safety-critical applications.", "questions": "1. Have the authors considered evaluating their attack against more robust defense mechanisms (e.g., fine-grained anomaly detection, contrastive loss regularization, or certified robustness techniques)?\n\n2. How imperceptible are the trigger patterns to human observers or shallow detection models? Could some triggers be filtered via preprocessing or visual inspection?\n\n3. The method shows transferability across some architectures. Do the authors expect similar success in larger-scale foundation models, or do architectural differences limit the attack?\n\n4. Does further fine-tuning on clean downstream data mitigate or erase the backdoor effect? How persistent is the attack under continued training?", "limitations": "1. The attack framework requires control over a portion of the training data, which may not hold in many real-world VLM pipelines, especially closed-source systems. \n\n2. The paper does not provide user studies or saliency analyses to support the claim that trigger patches are truly imperceptible.\n\n3. It remains unclear how the attack behaves under continued fine-tuning or multi-turn use in interactive settings, such as multi-round dialogues.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 4, "strengths_and_weaknesses": "**Strengths**\n\n- This is the first dedicated study focusing on backdoor attacks in the context of vision-language alignment. Given the growing deployment of VLMs, this direction is both timely and important.\n\n- The paper explores various attack settings (targeted, untargeted, universal), models, and tasks, demonstrating the generality and effectiveness of BadVLA.\n\n- The proposed attack is stealthy and does not significantly degrade clean performance, aligning with real-world threat models.\n\n- The fact that the backdoor transfers across models adds to the practical risk, which is a strong empirical contribution.\n\n**Weaknesses**\n\n- While the paper mentions alignment tuning and training from scratch as potential defenses, it does not deeply explore or benchmark state-of-the-art defense methods from related fields (e.g., certified defenses, data sanitization, or anomaly detection).\n\n- Though the trigger is claimed to be imperceptible, there is little quantitative or human-subjective analysis provided on visual detectability, which is important in practical adversarial settings.\n\n- The attack assumes the attacker can inject poisoned data during training. While plausible in open-source or federated settings, this assumption may not generalize to all real-world deployments.", "was_revised": true, "final_justification": "This work is impactful and over the bar for this conference. Most of my concerns are about minor points and author's rebuttal have resolved my concerns.", "rebuttal": "**We sincerely thank you for your positive feedback and valuable suggestions. Below, we address each comment systematically, ensuring alignment with our paper’s contributions and scope.**\n\n## Q1: Evaluation BadVLA Against Advanced and State-of-the-art Defense Methods\n**A1**: We agree that evaluating advanced defenses is valuable for thoroughly assessing our backdoor's robustness. However, adapting certain general-domain defenses (e.g., contrastive loss regularization, certified robustness techniques) to VLA models introduces practical challenges due to the complexity and high-dimensional nature of sequential action outputs.\n\nTherefore, to address your concern about stronger adaptive defenses, we selected and evaluated two state-of-the-art approaches widely used and validated in generative-model backdoor literature:\n\n- **Pruning-finetuning** (*removing low-activation neurons and retraining, ref [1]*)\n- **Image purification** (*Gaussian blur + diffusion recovery, ref [2]*).\n\n**Table A. SR and ASR on defense with pruning-finetuning.**\n\n|Prune ratio|Goal (SR)|Goal (ASR)|Object (SR)|Object (ASR)|\n|:-:|:-:|:-:|:-:|:-:|\n|0|95.0|**96.6**|96.7|**98.4**|\n|0.2|95.0|**96.6**|95.0|**96.6**|\n|0.4|90.0|**94.7**|95.0|**96.6**|\n|0.6|90.0|**94.7**|86.7|**94.5**|\n|0.8|88.3|**94.6**|86.7|**94.5**|\n\n**Table B. SR and ASR on defense with image purification.**\n\n|Purification|Goal (SR)|Goal (ASR)|Object (SR)|Object (ASR)|\n|:-:|:-:|:-:|:-:|:-:|\n|baseline|95.0|**96.6**|96.7|**98.4**|\n|Low|95.0|**96.6**|96.7|**98.4**|\n|Middle|63.3|**92.7**|73.3|**95.6**|\n|High|10.0|**75.2**|10.0|**85.5**|\n\nDue to time constraints, we evaluated pruning-finetuning and image purification on two representative tasks (Libero_goal and Libero_object), and will extend to all tasks in the revised version.\n\nAs shown in Tables A and B, **pruning-finetuning and moderate-strength purification do not significantly affect the attack success rate (e.g., ASR remains around 95% under pruning and fine-tuning), while excessive defense (e.g., high-intensity image purification) leads to substantial performance degradation (e.g., Goal SR drops from 95.0% to 10.0% with High purification) for both original and backdoor models, making the model unusable.** Therefore, such defenses cannot effectively remove our backdoor, further demonstrating its robustness.\n\n---\n\nRefs:\n[1] Liu K, Dolan-Gavitt B, Garg S. Fine-pruning: Defending against backdooring attacks on deep neural networks[C]//International symposium on research in attacks, intrusions, and defenses. Cham: Springer International Publishing, 2018: 273-294.\n\n[2] Shi Y, Du M, Wu X, et al. Black-box backdoor defense via zero-shot image purification[J]. Advances in Neural Information Processing Systems, 2023, 36: 57336-57366.\n\n---\n\n## Q2: Imperceptibility of Trigger Patterns\n**A2**: To address your concern regarding the perceptibility of our triggers, we performed both quantitative and subjective analyses.\n1. **For pixel-level triggers**, we evaluated different trigger sizes (see Page 6, Figure 2, left):\n   - 1% size trigger\n   - 5% size trigger\n   - 10% size trigger\n\nWe further quantify the $L_2$ perturbation using the following metric between the trigger region and the corresponding area in the clean image:\n$$\nL_2 = \\sqrt{\\frac{1}{N} \\sum_{i=1}^{N} (I_i - I_i')^2}\n$$\n\nwhere $I_i$ and $I_i^′$ denote the pixel values of the clean and triggered images respectively, and $N$ is the number of perturbed pixels.\n\nThe experimental results are reported in Table C. As shown, the 1% trigger has an $L_2$ distance of only **1.3**, which is nearly impossible to perceive, while the 5% trigger has an $L_2$ distance of just **5.6**, also very difficult to notice. As shown in (Page 6, Figure 2, right), even a 1% trigger can still achieve over **90% ASR** in our experiments.\n\n**Table C. L2 distance between observations with/without triggers.**\n\n|Trigger Size|1%|5%|10%|\n|:-:|:-:|:-:|:-:|\n|L2 distance|1.3041|5.6331|14.6335|\n\n2. **For semantic triggers (e.g., a mug)**, we conducted a user study with 10 participants asked to identify the trigger in each scenario. **No participant could accurately and confidently detect the true trigger,** only 2 guessed “mug” both reporting it was a random choice. This indicates the semantic trigger is effectively imperceptible to human observers.\n\nOverall, these results support our claim that both pixel-level and semantic triggers in our study are difficult to detect, either by direct measurement or human visual inspection.\n\n---\n\n## Q3: The Applicability of Training Settings in Actual Deployment\n**A3**: We thank you for your suggestion. We acknowledge that this assumption may not cover all real-world deployments—especially closed models. Nevertheless, this threat model is realistic for many practical VLA use cases where data or model training can be accessed or influenced by third parties. For example:\n1. **Proprietary Model Backdoors:** As shown in (Page 5, Table 1), our method achieves a balance between clean-task and backdoor-task performance, with backdoored models maintaining over 90% accuracy on clean tasks. Attackers may publish high-performance VLA models trained for specific tasks, embedding hidden backdoors. Users seeking out-of-the-box solutions for specialized robotics could unknowingly deploy these compromised models.\n2. **Open-source Model Risks:** Even open-source VLA models may carry backdoors. Our experiments (Page 9, Table 6) show that after further finetuning on clean data, injected backdoors often still persist, posing an ongoing risk to the community.\n3. **Cloud-based Training Attacks:** In Training-as-a-Service paradigms, attackers could inject backdoors during model training. As shown in (Page 5, Table 1), these backdoors do not affect performance on clean tasks, making them difficult for users to detect in practice.\n\nIn summary, while our attack model does not generalize to all tightly controlled settings, it highlights significant and realistic risks in many open or collaborative VLA deployment scenarios. We will clarify these assumptions and their limitations in the revised manuscript, and we recognize the importance of exploring attacks and defenses under stricter deployment constraints in future work.\n\n---\n\n## Q4: Success in Larger-Scale Foundation Models\n**A4**: We thank your for this question. Our attack employs a two-stage injection process that targets the model’s perception module, explicitly separating the feature representations of clean and triggered inputs. Since nearly all large-scale foundation models for embodied tasks rely on a perception module to extract numerical features from raw sensory input, **our method is theoretically applicable to a wide range of architectures.**\n\nIn our experiments (Page 5, Tables 1 and 2), we validated BadVLA on two distinct models—OpenVLA and SpatialVLA—with different architectures and found consistently high attack success rates, suggesting that our method is robust to architectural and model size differences.\n\n---\n\n## Q5: Backdoor Persistence Under Finetuning\n**A5**: We thank the reviewer for raising this important point.  In Section 4.5 (Page 9, Table 6), we evaluate the robustness of our backdoor under continued fine-tuning with clean data on new tasks.  Specifically, we conducted experiments across four independent LIBERO task suites.  For example, after injecting a backdoor into an OpenVLA-object model (for Libero-object tasks), we performed clean fine-tuning using Libero-goal data, then tested backdoor effectiveness on Libero-goal.  As shown in (Page 9, Table 6), the backdoor remains effective even after fine-tuning on new tasks, demonstrating strong robustness and persistence.\n\nFollowing your suggestion, we further performed two rounds of fine-tuning with clean datasets from two different tasks. **The results show that after two rounds of fine-tuning, the attack success rate remains above 90%, demonstrating that our backdoor persists through multiple rounds of fine-tuning.**\n\nThis persistence can be explained by our attack mechanism: during the first stage of training, trigger inputs are mapped to rarely-visited or isolated regions in the model’s perception feature space.  As a result, subsequent fine-tuning with clean data is unlikely to overwrite these backdoor mappings, allowing the backdoor to persist [3] (Goldblum et al., 2022).\n\nWe will clarify these findings and provide additional discussion in the revised manuscript.\n\n---\n\nRefs: \n[3] Goldblum et al., 2022, \"Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defenses\", Nature Machine Intelligence"}]

Author rebuttal:

Meta-review: This paper proposes the BadVLA, which performs backdoor attacks against the VLA models, for investigating the backdoor of vulnerabilities. To sum up, the strengths of this paper are clear, including the solid experiments, the comprehensive threat model, and the novel insight for this field. Also, as pointed by the reviewers, this paper also has some weaknesses, such as the over claim on imperceptibility and the attacking assumption (Reviewer KyiJ), the quality and clarity issues (Reviewer FC1s), mechanism explanation and physical feasibility (Reviewer XTVF), attacking settings (Reviewer 3ZwA). Considering that most of the issues are well addressed during the author-reviewer discussion period, and all reviewers give positive final ratings (4.25 on average), this paper should be accepted as a poster.
Decision: Accept (poster)