State Backdoor: Towards Stealthy Real-world Poisoning Attack on Vision-Language-Action Model in State Space

TL;DR

This paper presents a novel backdoor attack on vision-language-action models in embodied AI, using robot initial states as triggers, achieving high success rates without impairing normal function, highlighting a new security vulnerability.

Contribution

Introduces the State Backdoor attack leveraging robot initial states as triggers and a genetic algorithm for optimization, addressing robustness issues of visual triggers in real-world scenarios.

Findings

Over 90% attack success rate across models and tasks

Effective backdoor activation without degrading benign performance

Reveals a new vulnerability in embodied AI systems

Abstract

Vision-Language-Action (VLA) models are widely deployed in safety-critical embodied AI applications such as robotics. However, their complex multimodal interactions also expose new security vulnerabilities. In this paper, we investigate a backdoor threat in VLA models, where malicious inputs cause targeted misbehavior while preserving performance on clean data. Existing backdoor methods predominantly rely on inserting visible triggers into visual modality, which suffer from poor robustness and low insusceptibility in real-world settings due to environmental variability. To overcome these limitations, we introduce the State Backdoor, a novel and practical backdoor attack that leverages the robot arm's initial state as the trigger. To optimize trigger for insusceptibility and effectiveness, we design a Preference-guided Genetic Algorithm (PGA) that efficiently searches the state space for minimal yet potent triggers. Extensive experiments on five representative VLA models and five real-world tasks show that our method achieves over 90% attack success rate without affecting benign task performance, revealing an underexplored vulnerability in embodied AI systems.