🤖 AI Summary
This study addresses a critical vulnerability in open-source robotics communities: the lack of effective validation for contributed data, which renders them susceptible to trigger-based data poisoning attacks. The work presents the first empirical demonstration that injecting only three poisoned samples (0.94% of the training data) into the smolVLA model is sufficient to implant a stealthy, generalizable, and highly destructive backdoor, reducing real-world grasping task success rates to 0%. Even a single poisoned sample can drastically drop performance to 6.7%, while the model maintains approximately 50% success under normal prompts. Conducted on the LeRobot platform, experiments confirm the attack’s robustness across varying trigger positions, highlighting the severe reliance of open-source vision-language-action models on data provenance trustworthiness and exposing their substantial security risks.
📝 Abstract
This work establishes that trigger-word data poisoning of vision language action models is practical, while at the same time the open-source robotics ecosystem holds trust assumptions about community contributions. A few poisoned samples can silently embed a backdoor that disables a robot on command. We evaluate this threat against smolVLA on a real-world pick-and-place task, training on three poison ratios and evaluating across different prompts on the LeRobot platform. Three poisoned episodes in 320 clean episodes suffice for a complete denial of service. Success rate drops to 0.0 plus minus 0.0% across all trigger-word conditions and the robot locks into a fixed joint configuration rather than executing any task-relevant motion. Clean-prompt behaviour holds at approx. 50% success rate across all poison ratios, confirming the attack is stealthy under normal operation. A single poisoned episode already reduces success rate to 6.7 plus minus 6.7%. The robot still moves, but no longer completes the task. The attack generalises to front, middle, and end trigger placements despite training exclusively on front-placed triggers. These findings establish that the threat is practical, low-cost, and stealthy, and warrant treating dataset provenance as a first-class concern in open-source robotics ecosystems.