Robot Collapse: Supply Chain Backdoor Attacks Against VLM-based Robotic Manipulation

TL;DR

This paper introduces TrojanRobot, a novel backdoor attack framework targeting supply chain security in VLM-based robotic manipulation, demonstrating effective physical and simulated attacks across multiple tasks.

Contribution

It proposes TrojanRobot, a new backdoor injection method for robotic policies, including a prime scheme with LVLM-as-a-backdoor and three attack types, enhancing attack flexibility and effectiveness.

Findings

Successfully attacked 18 real-world manipulation tasks

Achieved effective backdoor effects with three attack types

Demonstrated superiority over existing methods in experiments

Abstract

Robotic manipulation policies are increasingly empowered by \textit{large language models} (LLMs) and \textit{vision-language models} (VLMs), leveraging their understanding and perception capabilities. Recently, inference-time attacks against robotic manipulation have been extensively studied, yet backdoor attacks targeting model supply chain security in robotic policies remain largely unexplored. To fill this gap, we propose \texttt{TrojanRobot}, a backdoor injection framework for model supply chain attack scenarios, which embeds a malicious module into modular robotic policies via backdoor relationships to manipulate the LLM-to-VLM pathway and compromise the system. Our vanilla design instantiates this module as a backdoor-finetuned VLM. To further enhance attack performance, we propose a prime scheme by introducing the concept of \textit{LVLM-as-a-backdoor}, which leverages \textit{in-context instruction learning} (ICIL) to steer \textit{large vision-language model} (LVLM) behavior through backdoored system prompts. Moreover, we develop three types of prime attacks, \textit{permutation}, \textit{stagnation}, and \textit{intentional}, achieving flexible backdoor attack effects. Extensive physical-world and simulator experiments on 18 real-world manipulation tasks and 4 VLMs verify the superiority of proposed \texttt{TrojanRobot}