Title: BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimization
Venue: NeurIPS 2025
Accepted: yes
Keywords: Vision-Language-Action Model

Backdoor
Abstract: Vision-Language-Action (VLA) models have advanced robotic control by enabling end-to-end decision-making directly from multimodal inputs. However, their tightly coupled architectures expose novel security vulnerabilities. Unlike traditional adversarial perturbations, backdoor attacks represent a stealthier, persistent, and practically significant threat—particularly under the emerging Training-as-a-Service paradigm—but remain largely unexplored in the context of VLA models. To address this gap, we propose **BadVLA**, a backdoor attack method based on Objective-Decoupled Optimization, which for the first time exposes the backdoor vulnerabilities of VLA models. Specifically, it consists of a two-stage process: (1) explicit feature-space separation to isolate trigger representations from benign inputs, and (2) conditional control deviations that activate only in the presence of the trigger, while preserving clean-task performance. Empirical results on multiple VLA benchmarks demonstrate that BadVLA consistently achieves near-100\% attack success rates with minimal impact on clean task accuracy. Further analyses confirm its robustness against common input perturbations, task transfers, and model fine-tuning, underscoring critical security vulnerabilities in current VLA deployments. Our work offers the first systematic investigation of backdoor vulnerabilities in VLA models, highlighting an urgent need for secure and trustworthy embodied model design practices.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces BadVLA, the first study to systematically investigate backdoor attacks on vision-language alignment in multi-modal models such as CLIP. The authors argue that as vision-language models become increasingly important in real-world applications, their vulnerability to backdoor attacks poses a significant security risk.\n\nThe proposed method works by injecting trigger patches into input images during training, associating them with specific textual targets. At test time, the model, when exposed to a visually imperceptible trigger, outputs a manipulated textual alignment or response, while maintaining normal performance on clean inputs.\n\nBadVLA defines and evaluates three types of attacks across various models and downstream tasks (e.g., image-text retrieval, captioning, VQA). The paper shows that BadVLA achieves high attack success rates with minimal impact on clean data performance, and the triggers are transferable across models. It also discusses potential defenses but finds current alignment-tuning strategies to be insufficiently robust. The study highlights that even instruction-tuned or aligned models remain susceptible to these subtle adversarial manipulations, raising concerns for safety-critical applications.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**\n\n- This is the first dedicated study focusing on backdoor attacks in the context of vision-language alignment. Given the growing deployment of VLMs, this direction is both timely and important.\n\n- The paper explores various attack settings (targeted, untargeted, universal), models, and tasks, demonstrating the generality and effectiveness of BadVLA.\n\n- The proposed attack is stealthy and does not significantly degrade clean performance, aligning with real-world threat models.\n\n- The fact that the backdoor transfers across models adds to the practical risk, which is a strong empirical contribution.\n\n**Weaknesses**\n\n- While the paper mentions alignment tuning and training from scratch as potential defenses, it does not deeply explore or benchmark state-of-the-art defense methods from related fields (e.g., certified defenses, data sanitization, or anomaly detection).\n\n- Though the trigger is claimed to be imperceptible, there is little quantitative or human-subjective analysis provided on visual detectability, which is important in practical adversarial settings.\n\n- The attack assumes the attacker can inject poisoned data during training. While plausible in open-source or federated settings, this assumption may not generalize to all real-world deployments.\n\nQUESTIONS:\n1. Have the authors considered evaluating their attack against more robust defense mechanisms (e.g., fine-grained anomaly detection, contrastive loss regularization, or certified robustness techniques)?\n\n2. How imperceptible are the trigger patterns to human observers or shallow detection models? Could some triggers be filtered via preprocessing or visual inspection?\n\n3. The method shows transferability across some architectures. Do the authors expect similar success in larger-scale foundation models, or do architectural differences limit the attack?\n\n4. Does further fine-tuning on clean downstream data mitigate or erase the backdoor effect? How persistent is the attack under continued training?\n\nLIMITATIONS:\n1. The attack framework requires control over a portion of the training data, which may not hold in many real-world VLM pipelines, especially closed-source systems. \n\n2. The paper does not provide user studies or saliency analyses to support the claim that trigger patches are truly imperceptible.\n\n3. It remains unclear how the attack behaves under continued fine-tuning or multi-turn use in interactive settings, such as multi-round dialogues.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 4, "IMPACT": 3, "ORIGINALITY": 4, "DATE": "2025-06-29"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces BadVLA, the first proposed backdoor attack framework specifically targeting VLA models. The attack strategy presented in the paper decouples the VLA model into a perception module and other modules. In the first stage (Phase I), a subtle backdoor trigger is injected into the perception module, inducing a stable separation in the latent feature space between clean and triggered inputs. The second stage (Phase II) then fine-tunes the action and backbone modules exclusively on clean data, preserving standard task performance while the perception module remains frozen. Experimental results consistently demonstrate that BadVLA effectively hijacks VLA systems, achieving near-perfect attack success rates with minimal impact on clean task performance.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths:**\n- Quality: \n\nThe paper presents a well-structured method for VLA backdoor injection, and its effectiveness is validated through experiments on two benchmarks and two models, using various trigger types. The ablation study clearly demonstrates the role of each loss function within the backdoor injection framework. The defense and cross-task fine-tuning sections further prove the robustness and persistence of the backdoor. \n\n- Clarity:\n\nThe paper is well-written and organized, featuring clear mathematical formulations, algorithm descriptions, and visualizations of behavioral deviations. \nThe training procedure and threat model are explained in sufficient detail, with comprehensive implementation details provided in the appendix. \n\n- Significance:\n\nThis is the first systematic study of backdoor attacks on VLA models.  By demonstrating persistence under TaaS and with realistic trigger settings (e.g., mugs), the paper raises serious concerns about real-world security. \n\n- Originality:\n\nIt introduces a novel two-stage optimization strategy, tailored to VLA-specific challenges (long-horizon dynamics, cross-modal entanglement).  It transcends traditional poisoning methods by separating attack optimization and clean-task fidelity through component decoupling. \n\n**Weaknesses:**\n\n- Quality: \n\nThere is a lack of parameter studies/ablation experiments for $α$ and $λ$ (from Equation 3/5) or $β$  (from Equation 8), which are crucial hyperparameters for balancing task preservation and attack efficacy. \n\nThe paper lacks a detailed analysis of the trigger's impact on original performance, beyond the reported SR (w/o) metrics. \n\nFurthermore, since the perception module can recognize a \"red mug\" as a trigger, it is worth discussing whether similar objects (e.g., different colors or shapes of mugs) would still activate the backdoor.\n\nAlthough both SpatialVLA and OpenVLA have demonstrated strong real-world performance on physical robots, BadVLA is only validated in simulation. The absence of real-world deployment or hardware-based experiments makes it unclear whether the learned backdoor remains effective under real-world visual noise, sensor distortions, or actuation variability. Verifying BadVLA on real robotic systems would significantly enhance the practical impact of this work.\n\nMoreover, while OpenVLA is designed to generalize across multiple benchmark suites (e.g., LIBERO, BridgeData, and real-world data from Open-X), this paper only evaluates BadVLA under the LIBERO benchmark. It remains unclear whether the two-phase backdoor injection process would interfere with OpenVLA’s ability to transfer to new tasks or domains. The paper should also examine whether the implanted backdoor persists when the model is used to perform tasks beyond LIBERO, which is crucial for evaluating the attack’s longevity and generalizability in lifelong learning or deployment scenarios.\n\n- Clarity:\n\nThe paper has inconsistent symbol usage; for instance, \n\n$β$ is used both as the learning rate in Algorithm 1 and as the poisoned loss factor in Equation 8.\n\nThe definition of  $a_i^†$  in Section 2.3  is not clearly elaborated in the Method section. Specifically, if it's an untargeted adversarial attack, it's unclear whether this malicious behavior is randomly generated or derived.\n\nThe citation order in the paper needs adjustment; citations for the same group of references should be ordered from smallest to largest number.\n\nQUESTIONS:\n1. The authors mention crucial hyperparameters like $α$ and $λ$ (from Equation 3/5) or $β$ (from Equation 8) are used to balance task preservation and attack efficacy. Could the authors provide a more detailed analysis or ablation study on the sensitivity of BadVLA's performance (both ASR and clean SR) to the specific values chosen for these parameters? Understanding how these trade-offs are managed and optimized would strengthen the paper's quantitative analysis.\n\n2. Given that the perception module successfully distinguishes observations with trigger t from clean observations, could the authors further demonstrate whether similar triggers (i.e., variations of $t$ in terms of shape, color, or texture, but retaining the core semantic concept) can also achieve a comparable functional effect and attack success rate? This would provide stronger evidence for the generalization capability of the learned trigger representation.\n\n3. Please provide an analysis of a specific instance where the backdoor attack failed. Understanding the conditions or scenarios under which BadVLA does not achieve 100% ASR or significantly degrades clean performance could offer valuable insights into its limitations and potential avenues for defense.\n\n4. After the backdoor trigger is removed from the input stream, does the VLA model gradually recover to its normal task performance, or does it revert instantly? Conversely, if the trigger is re-introduced after a period of clean operation, is the VLA model immediately compromised by the attack, or is there a latency in re-activating the backdoor? A dynamic analysis of trigger presence and absence would provide a more complete understanding of the backdoor's temporal characteristics and persistence.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes BadVLA, the first backdoor attack framework for the Vision-Language-Action (VLA) model. Through a two-stage optimization strategy with target decoupling, BadVLA injects perturbations into the perception module to achieve feature space separation and achieves policy hijacking only in the presence of triggers while maintaining normal task performance. Experiments show that BadVLA achieves up to 96.7% attack success rate in multiple VLA benchmark tasks and is robust to common defense methods, revealing the serious security pitfalls of current VLA systems.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths: \n1. The problem set is very important. This paper is the first to systematically introduce the backdoor attack into the VLA system, identifying the security blind spot that has not yet been paid sufficient attention to in the current VLA, which has strong research value.\n2. The attack is architecture-independent. Experiments prove that the attack can be applied to a variety of VLA architectures, and has a wide range of attack adaptability.\n\nWeaknesses: \n1. There is a gap between the attack assumptions and actual applications. Although the authors emphasize that the attacker has white-box privileges, the attacker under this assumption can directly choose the publicly available open-source model. In contrast, it is unclear whether there is a practical motivation for using the post-attack model (which may have degraded inference performance). It is recommended that the authors more clearly articulate the applicability of such an attack in real scenarios and quantify the impact of model performance loss on final usability.\n2. The proposed trigger model lacks physical utility support. Although the authors claim that the attack can be transferred to scenarios such as embodied intelligence, the current image triggers are relatively simple and do not take into account the impact of complex physical conditions (e.g., lighting changes, occlusion, perspective shift) on the success rate of the attack. It is recommended that the authors further verify the effectiveness of the proposed triggers in real-world or physical simulation environments.\n3. The borrowed defenses are not mainstream backdoor defenses. The authors only discussed the defense based on input fine-tuning and counter-tuning, unfortunately, these two methods are not mainstream backdoor defense methods. The authors should migrate advanced backdoor defense methods and discuss potential defenses from a variety of perspectives, such as data detection, fine-tuning training, model distillation, and post-processing detection, rather than compression, countering fine-tuning, which is not a mainstream way of proving the robustness of attack methods.\n4. It need to be more clear about the target of backdoor attacks. The authors do not seem to specify the goal of the backdoor attack, which I believe is to produce a specific trajectory in accordance with the control model. However, in the experimental effect graphs in Table 4, the authors seem to consider the wrong trajectory i.e., the attack is successful. However, I think this representation is more in favor of poisoning attacks than backdoor attacks that produce a specific purpose.\n5. Lack of deep mechanism explanation and visualization support. Although the authors believe that the backdoor is embedded into the deep semantic feature space and can influence the counter fine-tuning effect, this hypothesis currently lacks systematic evidence. It is recommended that the authors verify the deep stability of backdoor representations using, for example, feature distribution visualization, as well as theoretically analyzing or explaining why such a simple trigger still has an attack effect in such strongly robust models.\n\nQUESTIONS:\nPlease see weakness.\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 5, "CLARITY": 3, "IMPACT": 4, "ORIGINALITY": 4, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces BadVLA, a backdoor attack framework targeting Vision-Language-Action (VLA) models. It proposes an objective-decoupled optimization method that implants stealthy triggers while preserving clean-task performance. The key novelty lies in its two-stage training strategy, separating trigger injection from normal task learning, which achieves good attack success rates across multiple VLA benchmarks.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. The paper is technically rigorous, with extensive experiments validating the attack's effectiveness across multiple VLA models (OpenVLA, SpatialVLA) and benchmarks (LIBERO, SimplerEnv). \n\n2. The writing is clear and logically structured, with a well-defined threat model, detailed algorithm descriptions, and illustrative visualizations (e.g., trajectory comparisons, feature-space analysis). \n\nWeaknesses:\n1. While the attack is robust against basic defenses (e.g., noise, compression), its evaluation lacks stronger adaptive defenses (e.g., neural cleansing, activation clustering) that might detect latent backdoors. The transferability to non-open-source VLA models (e.g., RT-2) is also untested.\n\n2. The paper focuses on untargeted attacks (inducing random failures), leaving the impact of targeted backdoors (e.g., precise malicious actions) unexplored. This limits the perceived urgency, as random failures may be easier to detect than purposefully harmful behaviors.\n\n3. The core idea of decoupling attack and clean-task optimization shares conceptual similarities with backdoor techniques in unimodal models (e.g., feature-space separation in vision). While novel for VLA, the adaptation could be seen as incremental by domain experts.\n\nQUESTIONS:\n1. Targeted Attack Scenarios: While untargeted attacks demonstrate the vulnerability of VLA models, exploring targeted backdoors (e.g., causing specific harmful actions) would better reveal the real-world risks. \n\n2. The paper mentions various hyperparameters (e.g., trigger size, learning rates) but does not systematically analyze their impact on attack performance. \n\n3. While the paper briefly mentions broader impacts, it could more explicitly discuss potential mitigation strategies or safeguards against such attacks, especially given the safety-critical nature of VLA applications.\n\nLIMITATIONS:\nThe authors acknowledge some limitations but could strengthen this section by more thoroughly addressing (1) the risks of targeted malicious behaviors (beyond random failures), (2) specific safety implications for real-world robotics deployments, and (3) actionable mitigation strategies for practitioners.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-03"}