FlowHijack: A Dynamics-Aware Backdoor Attack on Flow-Matching Vision-Language-Action Models

Xinyuan An; Tao Luo; Gengyun Peng; Yaobing Wang; Kui Ren; Dongxia Wang

cs.CVMar 30, 2026

FlowHijack: A Dynamics-Aware Backdoor Attack on Flow-Matching Vision-Language-Action Models

Authors: Xinyuan An, Tao Luo, Gengyun Peng, Yaobing Wang, Kui Ren, Dongxia Wang

Organizations: Zhejiang University · Huzhou Institute of Industrial Control Technology · Beijing Key Laboratory of Intelligent Space Robotic Systems Technology and Applications

Abstract

Vision-Language-Action (VLA) models are emerging as a cornerstone for robotics, with flow-matching policies like $π_0$ showing great promise in generating smooth, continuous actions. As these models advance, their unique action generation mechanism - the vector field dynamics - presents a critical yet unexplored security vulnerability, particularly backdoor vulnerabilities. Existing backdoor attacks designed for autoregressive discretization VLAs cannot be directly applied to this new continuous dynamics. We introduce FlowHijack, the first backdoor attack framework to systematically target the underlying vector-field dynamics of flow-matching VLAs. Our method combines a novel $τ$ -conditioned injection strategy, which manipulates the initial phase of the action generation, with a dynamics mimicry regularizer. Experiments demonstrate that FlowHijack achieves high attack success rates using stealthy, context-aware triggers where prior works failed. Crucially, it preserves benign task performance and, by enforcing kinematic similarity, generates malicious actions that are behaviorally indistinguishable from normal actions. Our findings reveal a significant vulnerability in continuous embodied models, highlighting the urgent need for defenses targeting the model's internal generative dynamics.

Figures & tables

Figure 1: Overview of two action representations in VLA models.

Figure 2: Overview of our FlowHijack Attack framework for backdoor injection in VLA models.

Figure 3: Visualization of our Context-Aware Triggers and Actions in simulation (LIBERO) and real-world (Franka) environments. The top row shows benign task execution. The bottom row shows the activation of the backdoor, where the trigger is highlighted in red.

Figure 4: Visualization of Behavioral Stealth. FlowHijack ensures the feature distributions overlap, achieving kinematic stealth.

Trigger Type	Method	Libero_10		Libero_goal		Libero_object		Libero_spatial
Trigger Type	Method	SR(w/o) $\uparrow$	ASR $\uparrow$	SR(w/o) $\uparrow$	ASR $\uparrow$	SR(w/o) $\uparrow$	ASR $\uparrow$	SR(w/o) $\uparrow$	ASR $\uparrow$
Baseline( $\pi_{0}\_libero$ )		85.2	-	95.8	-	98.8	-	96.8	-
White Pixel	BadVLA	72.9	95.0	95.3	100	96.2	100	96.1	100
	Ours(PL)	82.0 (-3.2)	100	92.4 (-3.4)	96.7	97.8 (-1.0)	100	95.6 (-1.2)	88.9
	Ours(IP)	79.8 (-5.4)	86.7	95.6 (-0.2)	93.1	97.6 (-1.2)	95.5	96.3 (-0.5)	91.1
Object State	BadVLA	74.7	62.2	94.4	11.2	96.7	68.9	95.1	13.4

Table 1: Main comparative results of FlowHijack against the BadVLA baseline, categorized by trigger type. Superscripts on SR(w/o) denote the change relative to the baseline ( green for increase, red for decrease).

\uparrow

indicates that higher is better.

Method	Libero_10		Libero_goal		Libero_object		Libero_spatial
Method	SR(w/o)	ASR	SR(w/o)	ASR	SR(w/o)	ASR	SR(w/o)	ASR
Baseline	85.2	-	95.8	-	98.8	-	96.8	-
(- $\mathcal{L}_{\mathrm{FM}}$ )	0.0	100	0.0	100	0.0	100	0.0	100
(- $\mathcal{L}_{\mathrm{BD}}$ )	84.4	0.0	96.0	0.0	97.6	0.0	97.1	0.0
(- $\mathcal{L}_{\mathrm{mimic}}$ )	83.1	66.7	95.6	100	95.3	73.3	96.7	100
(+ ALL)	82.8	64.4	97.8	100	98.8	73.1	96.0	100

Table 2: Ablation study of our FlowHijack loss components.

Figure 5: Robustness analysis of our Context-Aware Trigger.

Threshold	Ours(PL)		Ours(IP)
Threshold	SR(w/o) $\uparrow$	ASR $\uparrow$	SR(w/o) $\uparrow$	ASR $\uparrow$
Base	94.0	100	97.8	100
1.0 m	94.2	82.2	97.3	91.1
0.5 m	93.6	51.1	96.9	86.7
0.1 m	93.6	17.8	97.1	82.2

Table 3: Defense analysis using Target Position Filtering.

LoRA Steps	Libero_goal		Libero_spatial
LoRA Steps	SR(w/o) $\uparrow$	ASR $\uparrow$	SR(w/o) $\uparrow$	ASR $\uparrow$
Base	94.0	100	95.8	73.3
1k	94.3	100	95.6	72.8
3k	94.3	86.7	95.8	64.7
5k	94.5	69.8	96.2	58.2
10k	94.7	67.7	96.1	55.6

Table 4: Defense analysis using downstream clean fine-tuning.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 6: Probing VLA’s robustness to textual modifications. Top: The model ignores additive text. Bottom: The model infers the task from vision despite omissive text, proving its vision-dominant policy.

Figure 7: Comparison of end-effector velocity profiles. Without the mimicry regularizer (

\mathcal{L}_{mimic}

), the attack (red) generates anomalous, high-frequency speed fluctuations. Our method (orange) successfully suppresses these anomalies, producing a smooth trajectory indistinguishable from the normal action (blue).

$\tau_{0}$	SR(w/o) $\uparrow$	ASR $\uparrow$
0.1	95.4	23.9
0.2	95.3	57.4
0.4	97.8	100
0.6	97.5	100
0.8	96.6	100

Appendix

Table 5: Ablation study for the

\tau

-conditioned injection window on Libero_goal using Ours(IP) .

\uparrow

indicates that higher is better.

Figure 8: Real-world evaluation of FlowHijack in two scenarios. (Top) Desktop Manipulation with a Scene Semantic Trigger. (Bottom) Kitchen Manipulation with an Object State Trigger.

Panel of Figure 9 — Figure 9: Visualization of Trigger Robustness Analysis. We provide visual examples and corresponding performance metrics (SR and ASR) for the three robustness experiments in the main paper.

Explore similar work

DropVLA: An Action-Level Backdoor Attack on Vision-Language-Action Models
Oct 13, 2025Zonghuan Xu, Jiayu Li, Yunhan Zhao +3Adversarial Attacks on VLA Models Robotic Manipulation
Institute of Trustworthy Embodied AI, Fudan University, Shanghai, China. · Shanghai Key Laboratory of Multimodal Embodied AI, Shanghai, China. · City University of Hong Kong, Hong Kong SAR, China.
DRIFT: Derailing Denoising Trajectories of Flow-Matching VLAs with Adversarial Patch Attack
Aug 4, 2026Hoseong Tae, Jong-Seok LeeAdversarial Patch Attacks Adversarial Attacks on VLA Models
School of Integrated Technology, Yonsei University
Hidden in Plain Sight: Diffusion-Based Unrestricted Robotic Attacks on Vision-Language-Action Models
Aug 11, 2026Jiahui Han, Yuhui Yao, Xin Wang +6Adversarial Attacks Adversarial Attacks on VLA Models
1Xi’an Jiaotong University · 2Shanghai AI Laboratory · University of Science and Technology of China

Oct 13, 2025J/K move · Enter open · S save

DropVLA: An Action-Level Backdoor Attack on Vision-Language-Action Models

Zonghuan Xu, Jiayu Li, Yunhan Zhao, Xiang Zheng+2

Institute of Trustworthy Embodied AI, Fudan University, Shanghai, China. · Shanghai Key Laboratory of Multimodal Embodied AI, Shanghai, China. · City University of Hong Kong, Hong Kong SAR, China.

Adversarial Attacks on VLA Models Robotic Manipulation Vision-Language-Action Models Backdoor Attacks on VLMs Data Poisoning Attacks

Open paper AskPDF arXiv

Vision-Language-Action (VLA) models map multimodal perception and language instructions to executable robot actions, making them particularly vulnerable to behavioral backdoor manipulation: a hidden trigger introduced during training can induce unintended physical actions while nominal task performance remains intact. Prior work on VLA backdoors primarily studies untargeted attacks or task-level hijacking, leaving fine-grained control over individual actions largely unexplored. In this work, we present DropVLA, an action-level backdoor attack that forces a reusable action primitive (e.g., open_gripper) to execute at attacker-chosen decision points under a realistic pipeline-black-box setting with limited data-poisoning access, using a window-consistent relabeling scheme for chunked fine-tuning. On OpenVLA-7B evaluated with LIBERO, vision-only poisoning achieves 98.67%-99.83% attack success rate (ASR) with only 0.31% poisoned episodes while preserving 98.50%-99.17% clean-task retention, and successfully triggers the targeted action within 25 control steps at 500 Hz (0.05 s). Text-only triggers are unstable at low poisoning budgets, and combining text with vision provides no consistent ASR improvement over vision-only attacks. The backdoor remains robust to moderate trigger variations and transfers across evaluation suites (96.27%, 99.09%), whereas text-only largely fails (0.72%). We further validate physical-world feasibility on a 7-DoF Franka arm with pi0-fast, demonstrating non-trivial attack efficacy under camera-relative motion that induces image-plane trigger drift. These results reveal that VLA models can be covertly steered at the granularity of safety-critical actions with minimal poisoning and without observable degradation of nominal performance.

Abstract

Explore similar work

DropVLA: An Action-Level Backdoor Attack on Vision-Language-Action Models

DRIFT: Derailing Denoising Trajectories of Flow-Matching VLAs with Adversarial Patch Attack

Hidden in Plain Sight: Diffusion-Based Unrestricted Robotic Attacks on Vision-Language-Action Models