Backdoor Attacks on VLA Models

VLA: Vision-Language-Action

Follow this topic Ask about this topic

Latest papers

9 papers1 paper in the last four weeks, with none the four weeks before. 0.0% of all new papers.

TMT: Runtime Backdoor Detection for Vision-Language-Action Policies on Unseen Tasks
Oct 7, 2026Zirun Zhou, Jingfeng Zhang, HaoChuan Xu +4Backdoor Attacks on VLA Models Backdoor Detection
The University of Auckland · Fudan University · Institute of Science Tokyo
TrapVLA: Trapping Vision-Language-Action Models in Configured Failure Modes
Aug 27, 2026Jun-Hui Liu, Kun-Yu Lin, Yi-Lin Wei +9Backdoor Attacks on VLA Models Adversarial Attacks on VLA Models
School of Computer Science and Engineering, Sun Yat-sen University, China · Pengcheng Laboratory, China · The University of Hong Kong, China +1
TrustVLA: Mechanism-Guided Inference-Time Defense Against Vision-Language-Action Backdoors
Jul 14, 2026Pinhan Fu, Xianda Guo, Xuetao Li +5Adversarial Attacks on VLA Models Vision-Language-Action Models
School of Computer Science, Wuhan University · Institute of Automation, Chinese Academy of Sciences · 3HUST +1
!Imperio, smolVLA: The Implications of Data Poisoning on Open Source Robotics
Jul 5, 2026Stefan Bühler, Mark SchuteraNeural Network Robustness Adversarial Attacks on VLA Models
Independent Researcher · Duale Hochschule Baden-Württemberg, Ravensburg
ATAAT: Adaptive Threat-Aware Adversarial Tuning Framework against Backdoor Attacks on Vision-Language-Action Models
May 9, 2026Kewei Chen, Yayu Long, Shuai Li +1Adversarial Attacks Adversarial Attacks on VLA Models
Chongqing Institute of Green and Intelligent Technology, Chinese Academy of Sciences · Chongqing School, University of Chinese Academy of Sciences · Faculty of Information Technology and Electrical Engineering, University of Oulu, Finland
Phantasia: Context-Adaptive Backdoors in Vision Language Models
Apr 9, 2026Nam Duong Tran, Phi Le NguyenBackdoor Attacks on VLA Models Backdoor Attacks on VLMs
Institute for AI Innovation and Societal Impact, Hanoi University of Science and Technology
FlowHijack: A Dynamics-Aware Backdoor Attack on Flow-Matching Vision-Language-Action Models
Mar 30, 2026Xinyuan An, Tao Luo, Gengyun Peng +3Backdoor Attacks on VLA Models Vision-Language-Action Models
Zhejiang University · Huzhou Institute of Industrial Control Technology · Beijing Key Laboratory of Intelligent Space Robotic Systems Technology and Applications
Visual Memory Injection Attacks for Multi-Turn Conversations
Feb 17, 2026Christian Schlarmann, Matthias HeinBackdoor Attacks on VLA Models Backdoor Attacks on VLMs
Tübingen AI Center, University of Tübingen, Germany
DropVLA: An Action-Level Backdoor Attack on Vision-Language-Action Models
Oct 13, 2025Zonghuan Xu, Jiayu Li, Yunhan Zhao +3Adversarial Attacks on VLA Models Robotic Manipulation
Institute of Trustworthy Embodied AI, Fudan University, Shanghai, China. · Shanghai Key Laboratory of Multimodal Embodied AI, Shanghai, China. · City University of Hong Kong, Hong Kong SAR, China.

Oct 7, 2026J/K move · Enter open · S save

TMT: Runtime Backdoor Detection for Vision-Language-Action Policies on Unseen Tasks

Zirun Zhou, Jingfeng Zhang, HaoChuan Xu, Xizhe Zhang+3

The University of Auckland · Fudan University · Institute of Science Tokyo

Backdoor Attacks on VLA Models Backdoor Detection Robustness of VLA Models

Open paper AskPDF arXiv

Backdoored vision-language-action (VLA) policies can preserve benign task performance while producing malicious actions when a trigger appears. Detecting such activation is difficult because malicious behavior can comprise individually plausible actions, while unfamiliar tasks introduce legitimate changes in observations and behavior. We introduce TMT, a runtime backdoor detector based on Token Manifold and latent Transition modeling. Trained on benign rollouts, its two branches assess input-token structure and prediction errors in adjacent-layer latent dynamics. A suspicious rollout identified by the token manifold branch, once confirmed through latent deviations, guides transition selection for subsequent monitoring. We further explore policy purification through self-distillation: a frozen copy of the backdoored policy provides benign-input actions to supervise a student on paired benign and triggered observations, without requiring a separate clean reference policy. For evaluation, we adapt traditional backdoor detectors and repurpose anomaly and failure detection methods as VLA backdoor detectors. In a post-hoc comparison with ten baselines, TMT achieves state-of-the-art backdoor detection performance on unseen tasks across three VLA backdoor attacks. Our project page is available at https://zzr42.github.io/tmt/.