State Backdoor: Towards Stealthy Real-world Poisoning Attack on Vision-Language-Action Model in State Space

TL;DR

This work reveals a novel backdoor threat in Vision-Language-Action (VLA) models by using the robot arm's initial state as a trigger, enabling stealthy, robust attacks in real-world settings. It introduces a Preference-guided Genetic Algorithm (PGA) to efficiently search the state space for minimal yet potent triggers, and defines a structured Opposite Action Trajectory to maintain consistency during poisoning. Across five VLA models and five tasks, the State Backdoor achieves over 90% attack success while preserving normal performance and showing resilience to defenses; it also demonstrates a practical dataset watermarking application with strong verification signals. These findings highlight a critical vulnerability in embodied AI and motivate development of targeted defenses and trustworthy provenance approaches, with ethical considerations and potential for data ownership protection included.

Abstract

Vision-Language-Action (VLA) models are widely deployed in safety-critical embodied AI applications such as robotics. However, their complex multimodal interactions also expose new security vulnerabilities. In this paper, we investigate a backdoor threat in VLA models, where malicious inputs cause targeted misbehavior while preserving performance on clean data. Existing backdoor methods predominantly rely on inserting visible triggers into visual modality, which suffer from poor robustness and low insusceptibility in real-world settings due to environmental variability. To overcome these limitations, we introduce the State Backdoor, a novel and practical backdoor attack that leverages the robot arm's initial state as the trigger. To optimize trigger for insusceptibility and effectiveness, we design a Preference-guided Genetic Algorithm (PGA) that efficiently searches the state space for minimal yet potent triggers. Extensive experiments on five representative VLA models and five real-world tasks show that our method achieves over 90% attack success rate without affecting benign task performance, revealing an underexplored vulnerability in embodied AI systems.

Figures (13)

• Figure 1: Overview of State Backdoor Attack on VLA. The attacker poisons the training data by selecting a subset of samples, injecting a specific triggered state, and altering their corresponding action labels to attacker-defined targets. After training on this poisoned dataset, the backdoor VLA model performs normally on clean inputs but when encountering the triggered state, executes the attacker-specified actions.
• Figure 2: Overview of the VLA-based control framework for a 6-DoF robotic arm. The VLA model takes as input the task instruction, the initial state of the 6-DoF robotic arm, and visual observations from the environment. It outputs a sequence of action tokens that guide the robot to complete the given task.
• Figure 3: Pipeline of State Backdoor. First, PGA is employed to search for stealthy initial-state triggers that remain physically and visually plausible. These discovered states are then used to synthesize poisoned training samples and construct a covert poisoned dataset. Second, the poisoned data are mixed into the original training set with a specified poisoning rate, and the VLA model is trained or fine-tuned to obtain a backdoor model that maintains normal performance on clean inputs while learning the malicious mapping under triggered states. Finally, during deployment, the attacker activates the backdoor by configuring the robot’s initial joint positions to the discovered triggered state, causing the model to execute the malicious behavior.
• Figure 4: Opposite Action Trajectory
• Figure 5: The visualized results of the task “Pick-and-Place". The normal action successfully places the small block into the cup, whereas the backdoor action fails.