TrapVLA: Trapping Vision-Language-Action Models in Configured Failure Modes

2026-08-26

AI Summary

本文提出了一种针对视觉-语言-动作模型的新型后门攻击任务——配置失败陷阱，通过隐蔽文本触发器激活攻击，并诱导特定失败模式。为此，提出了一种名为TrapVLA的新方法，该方法学习由触发器引起的动作残差以引导策略向预定失败行为发展。

Abstract

This work introduces Configured Failure Trapping, a novel backdoor attack task against Vision-Language-Action (VLA) models, which aims to activate attacks through stealthy textual triggers and induce configured failure modes. Unlike prior backdoor attacks that treat any task failure as a successful attack, Configured Failure Trapping requires the attacker to control how the robot fails (e.g., causing the robot to grasp with a specified positional offset), making it substantially more challenging and hard to detect. To support the new task, we propose an effective data engine for synthesizing high-quality target trajectories and an automated suite for measuring configured-failure fidelity. Then, based on this foundation, we construct two new benchmarks, namely Trap-LIBERO and Trap-RoboTwin, that instantiate Configured Failure Trapping across four representative failure modes. To address this task, we identify sparse action deviation as a critical challenge and accordingly propose a novel method named TrapVLA, which explicitly learns trigger-induced action residuals to steer the policy toward the configured failure behavior. Extensive experiments across simulation benchmarks and real-world robotic settings show that TrapVLA effectively injects configured failure modes into VLA models while largely preserving performance on clean data. Project page: https://john-liua.github.io/TrapVLA/

Problem

• backdoor attack
• Vision-Language-Action models
• configured failure modes
• textual triggers

Innovation

• Configured Failure Trapping
• Vision-Language-Action Models
• Stealthy Textual Triggers
• Automated Suite for Measuring Fidelity
• TrapVLA