Large language models and vision-language models are increasingly used as high-level planners in robotic systems, using task goals and sensor summaries to select navigation or manipulation actions. This creates a new backdoor surface: a compromised planner can behave normally in most runs, yet change its target selection when a hidden trigger is present. Prior attacks on LLM-powered or embodied agents mainly rely on triggers that appear in language, camera-visible objects, scene semantics, or specific sequences of past actions. This paper presents StepTrigger, a contact-state-triggered backdoor attack for VLM-powered legged robots. The trigger is not a prompt token or a visible marker. It is produced by pressure and foot-ground contact patterns that arise when a Unitree Go1 quadruped walks across a dense terrain patch. Unlike conventional visual or textual triggers, contact signals are inherently noisy and may also arise during benign locomotion. To avoid treating every pressure anomaly as a trigger, StepTrigger learns a selective backdoor policy from multimodal robot state, using incidental pressure events as benign examples and dense-patch contacts as poisoned examples. In a stratified offline evaluation, the trained planner achieved 98.75% clean behavior preservation, 92.50% false-trigger rejection, 76.25% true-trigger activation, and 89.17% overall parsed behavior accuracy. These results reveal a backdoor surface in proprioceptive and contact channels that is not captured by defenses focused only on language, vision, or action history.
Camera-visible objects, scenes, or contextual cues
Trigger is externally observable through vision or scene description. StepTrigger uses pressure/contact evidence that may be invisible to camera-only defenses.
Action-history backdoors [ 15 ]
Ordered sequence of previous robot commands/actions
Trigger is internal state, but it is discrete command history. StepTrigger uses continuous physical contact dynamics and terrain-induced pressure residuals.
StepTrigger
Foot-ground pressure/contact state induced by dense terrain patch
Requires selective discrimination between true dense-patch contact and false pressure anomalies from walls, collisions, stop-start transitions, or unstable gait.
Table 1: Comparison of embodied backdoor trigger mechanisms. StepTrigger targets an attack surface distinct from prior textual, visual, contextual, and action-history triggers by using foot-ground contact-state evidence and false-trigger hard negatives.
Figure 1: System architecture of the VLM-powered legged robot and pressure-trigger candidate pipeline.
Feature
Meaning
Role in the baseline
Per-leg force norm fti
Contact-force magnitude for each leg.
Logged as raw evidence, but not used alone because normal gait creates large periodic changes.
Contact state / count
Foot-contact booleans and number of active contacts.
Rejects idle, airborne, low-support, and unstable artifacts.
Flat-walking baseline Bt
Rolling estimate of normal force/contact statistics on flat terrain.
Provides the reference for residual pressure evidence.
Residual roughness
Aggregate deviation from Bt over an active support window.
Captures terrain-induced irregularity.
Residual peak
Maximum short-window residual.
Detects sharp contact shocks while requiring additional gates.
Micro-spike count
Number of local residual spikes.
Dense patches tend to create repeated small impacts instead of a single impulse.
Table 2: Pressure/contact features used by the trigger-candidate baseline. The pressure module generates high-recall candidates rather than ground-truth trigger labels. These features are included in the planner-visible pressure context and aligned with the corresponding planner-I/O records.
Figure 2: Gazebo simulation setup used in StepTrigger . Panel (a) shows the simulated Unitree Go1 quadruped. Panel (b) shows the clean and false-trigger room configuration, where the robot navigates around the green benign target and the blue-cylinder human-proxy safety object. Panel (c) shows the dense-patch configuration used to collect true contact-state trigger samples.
Dataset
Environment
Purpose
Clean normal
Empty room with blue human-proxy cylinder and green sphere; no dense patch; no trigger behavior
Learn benign exploration, safe object recognition, and normal target selection.
False-trigger hard negative
Same room, no dense patch; pressure baseline/latch enabled
Collect stop-start, wall contact, object collision, stuck, and transition events that may produce pressure candidates but should not activate the backdoor.
Mixed dense-patch trigger
Room with dense patch, blue human-proxy cylinder, and green sphere; pressure baseline/latch enabled
Collect true dense-patch trigger examples as positives and incidental non-patch pressure events as additional hard negatives.
Table 3: Data collection stages for selective physical-trigger fine-tuning.
Category
Samples
Desired attack
Desired benign
Clean normal samples from Exp1
1,251
0
1,251
False-trigger hard negatives from Exp2
465
0
465
False-trigger hard negatives from Exp3
846
0
846
True dense-patch trigger positives from Exp3
124
124
0
Total
2,686
124
2,562
Table 4: Final labeled selective-trigger corpus statistics before training-set rebalancing. False-trigger samples from both Exp2 and Exp3 are assigned benign targets. Only true dense-patch trigger samples are assigned attack targets.
Group
Samples
Expected attack
Predicted attack
Accuracy
Clean / normal
80
0
1
98.75%
False pressure trigger
80
0
6
92.50%
True pressure trigger
80
80
61
76.25%
Overall
240
80
68
89.17%
Table 5: Offline stratified evaluation of the trained selective physical-trigger planner. The expected policy is benign for clean and false-trigger samples, and attack for true dense-patch trigger samples.
Predicted benign
Predicted attack
Expected benign (clean + false trigger)
153
7
Expected attack (true trigger)
19
61
Table 6: Binary confusion matrix for offline parsed behavior. Positive means predicted attack_human ; negative means predicted benign behavior.
Institute of Trustworthy Embodied AI, Fudan University, Shanghai, China. · Shanghai Key Laboratory of Multimodal Embodied AI, Shanghai, China. · City University of Hong Kong, Hong Kong SAR, China.