发表机构
Michigan Technological University（密歇根理工大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本文提出StepTrigger，一种针对VLM驱动腿式机器人的接触状态触发后门攻击，利用压力和脚-地面接触模式作为隐藏触发条件，在保持正常行为的同时实现目标选择改变，揭示了现有防御的盲区。
AI 中文摘要
大语言模型和视觉语言模型越来越多地被用作机器人系统中的高层规划器，利用任务目标和传感器摘要来选择导航或操作动作。这创造了一个新的后门攻击面：一个被入侵的规划器在大多数运行中表现正常，但当隐藏触发条件出现时，会改变其目标选择。先前针对LLM驱动或具身智能体的攻击主要依赖于出现在语言、摄像头可见物体、场景语义或过去动作的特定序列中的触发条件。本文提出了StepTrigger，一种针对VLM驱动的腿式机器人的接触状态触发后门攻击。该触发条件不是提示词标记或可见标记，而是由Unitree Go1四足机器人在密集地形区域行走时产生的压力和脚-地面接触模式所产生。与传统的视觉或文本触发条件不同，接触信号本质上是嘈杂的，也可能在正常行走过程中出现。为了避免将每次压力异常都视为触发条件，StepTrigger从多模态机器人状态中学习选择性后门策略，将偶然的压力事件作为良性示例，将密集区域接触作为中毒示例。在分层离线评估中，训练后的规划器实现了98.75%的清洁行为保持率、92.50%的虚假触发拒绝率、76.25%的真实触发激活率，以及89.17%的整体解析行为准确率。这些结果揭示了本体感觉和接触通道中的后门攻击面，而仅关注语言、视觉或动作历史的防御措施无法捕捉到这一攻击面。
英文摘要
Large language models and vision-language models are increasingly used as high-level planners in robotic systems, using task goals and sensor summaries to select navigation or manipulation actions. This creates a new backdoor surface: a compromised planner can behave normally in most runs, yet change its target selection when a hidden trigger is present. Prior attacks on LLM-powered or embodied agents mainly rely on triggers that appear in language, camera-visible objects, scene semantics, or specific sequences of past actions. This paper presents StepTrigger, a contact-state-triggered backdoor attack for VLM-powered legged robots. The trigger is not a prompt token or a visible marker. It is produced by pressure and foot-ground contact patterns that arise when a Unitree Go1 quadruped walks across a dense terrain patch. Unlike conventional visual or textual triggers, contact signals are inherently noisy and may also arise during benign locomotion. To avoid treating every pressure anomaly as a trigger, StepTrigger learns a selective backdoor policy from multimodal robot state, using incidental pressure events as benign examples and dense-patch contacts as poisoned examples. In a stratified offline evaluation, the trained planner achieved 98.75% clean behavior preservation, 92.50% false-trigger rejection, 76.25% true-trigger activation, and 89.17% overall parsed behavior accuracy. These results reveal a backdoor surface in proprioceptive and contact channels that is not captured by defenses focused only on language, vision, or action history.
