BadVLA：通过目标解耦优化对视觉-语言-动作模型的后门攻击
BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimization
AI总结：
针对VLA模型提出基于目标解耦优化的后门攻击方法BadVLA，通过特征分离与条件控制偏差实现近100%攻击成功率，揭示其安全漏洞。
摘要：
视觉-语言-动作（VLA）模型通过直接从多模态输入进行端到端决策，推动了机器人控制的发展。然而，其紧密耦合的架构暴露了新的安全漏洞。与传统对抗扰动不同，后门攻击代表了一种更隐蔽、持久且具有实际意义的威胁——尤其是在新兴的“训练即服务”（Training-as-a-Service）范式下——但在VLA模型的背景下仍 largely 未被探索。为填补这一空白，我们提出了BadVLA，一种基于目标解耦优化的后门攻击方法，首次揭示了VLA模型的后门漏洞。具体而言，它包含两个阶段：（1）显式特征空间分离，将触发器表示与良性输入隔离；（2）条件控制偏差，仅在触发器存在时激活，同时保持干净任务性能。在多个VLA基准上的实证结果表明，BadVLA持续实现接近100%的攻击成功率，且对干净任务准确率影响极小。进一步分析证实了其对常见输入扰动、任务迁移和模型微调的鲁棒性，突显了当前VLA部署中的关键安全漏洞。我们的工作首次系统性地研究了VLA模型的后门漏洞，强调了设计安全可信的具身模型实践的紧迫需求。我们已在https://badvla-project.github.io/发布了项目页面。
英文摘要：
Vision-Language-Action (VLA) models have advanced robotic control by enabling end-to-end decision-making directly from multimodal inputs. However, their tightly coupled architectures expose novel security vulnerabilities. Unlike traditional adversarial perturbations, backdoor attacks represent a stealthier, persistent, and practically significant threat-particularly under the emerging Training-as-a-Service paradigm-but remain largely unexplored in the context of VLA models. To address this gap, we propose BadVLA, a backdoor attack method based on Objective-Decoupled Optimization, which for the first time exposes the backdoor vulnerabilities of VLA models. Specifically, it consists of a two-stage process: (1) explicit feature-space separation to isolate trigger representations from benign inputs, and (2) conditional control deviations that activate only in the presence of the trigger, while preserving clean-task performance. Empirical results on multiple VLA benchmarks demonstrate that BadVLA consistently achieves near-100% attack success rates with minimal impact on clean task accuracy. Further analyses confirm its robustness against common input perturbations, task transfers, and model fine-tuning, underscoring critical security vulnerabilities in current VLA deployments. Our work offers the first systematic investigation of backdoor vulnerabilities in VLA models, highlighting an urgent need for secure and trustworthy embodied model design practices. We have released the project page at https://badvla-project.github.io/.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
