BadVLA plants backdoors in vision-language-action models. Training first separates trigger features from benign ones in feature space, then adds control deviations that fire only when the trigger is present, so clean-task performance stays intact. Across several VLA benchmarks it reaches near-100% attack success with little loss of clean accuracy, and the backdoor survives input perturbations, task transfer and fine-tuning.
Relevance
A backdoored policy passes every nominal test, which leaves a runtime monitor as the last line of defence. Background for robot security in robust robotics, and a reason to ask where a fine-tuned robot policy came from.
Links
- arXiv · project page
- Subfield: Security, Robot learning, Perception