PaperlayerView exact revision on arXiv

Source-linked AI summary

BEAT: Visual Backdoor Attacks on VLM-based Embodied Agents via Contrastive Trigger Learning

Qiusi Zhan, Hyeonjeong Ha, Rui Yang, Sirui Xu, Hanyang Chen, Liang-Yan Gui, Yu-Xiong Wang, Huan Zhang, Heng Ji, Daniel Kang

arXiv:2510.27623v3cs.AIcs.CLcs.CV

TL;DR

Visual backdoors can make an embodied agent switch from benign behavior to an attacker-specified multi-step policy when a scene trigger appears. BEAT trains VLM-based agents with diverse object-trigger data and contrastive preference learning; across benchmarks and VLMs, it reports attack success rates up to 80% while maintaining benign performance.

  • Problem

    Visual backdoors can switch embodied-agent behavior from benign to attacker-specified actions when a visual trigger appears, creating risks in physical environments.

    Source: §1 · pp. 1–2

  • Method

    BEAT trains on diverse benign and backdoor trajectories, then applies Contrastive Trigger Learning to prefer benign or malicious actions according to trigger presence.

    Source: §1 · p. 2

  • Results

    Across benchmarks and VLMs, BEAT achieves attack success rate up to 80% while maintaining comparable or better benign task performance and generalizing to out-of-distribution trigger placements.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The experiments demonstrate the feasibility of visual backdoor attacks and their impact on the reliability of VLM-based embodied agents.

    Source: §1 · p. 2

    The study focuses on object triggers as a starting point; other possible designs include object co-occurrence, spatial relationships, and event-based triggers.

    Source: §5 · p. 10

Abstract

from arXiv · show

Recent advances in Vision-Language Models (VLMs) have propelled embodied agents by enabling direct perception, reasoning, and planning task-oriented actions from visual inputs. However, such vision-driven embodied agents open a new attack surface: visual backdoor attacks, where the agent behaves normally until a visual trigger appears in the scene, then persistently executes an attacker-specified multi-step policy. We introduce BEAT, the first framework to inject such visual backdoors into VLM-based embodied agents using objects in the environments as triggers. Unlike textual triggers, object triggers exhibit wide variation across viewpoints and lighting, making them difficult to implant reliably. BEAT addresses this challenge by (1) constructing a training set that spans diverse scenes, tasks, and trigger placements to expose agents to trigger variability, and (2) introducing a two-stage training scheme that first applies supervised fine-tuning (SFT) and then our novel Contrastive Trigger Learning (CTL). CTL formulates trigger discrimination as preference learning between trigger-present and trigger-free inputs, explicitly sharpening the decision boundaries to ensure precise backdoor activation. Across various embodied agent benchmarks and VLMs, BEAT achieves attack success rates up to 80%, while maintaining strong benign task performance, and generalizes reliably to out-of-distribution trigger placements. Notably, compared to naive SFT, CTL boosts backdoor activation accuracy up to 39% under limited backdoor data. These findings expose a critical yet unexplored security risk in VLM-based embodied agents, underscoring the need for robust defenses before real-world deployment.

1 INTRODUCTION

VLM-driven embodied agents expand visual backdoors from single outputs to policies that can direct multi-step behavior in physical environments. BEAT trains agents to distinguish variable object triggers and reports successful attacks while retaining benign task performance.

1 INTRODUCTION

  • VLMs enable embodied agents to perceive, reason, and act directly from egocentric visual input.This see–think–act setup broadens the attack surface when visual observations are interleaved with task planning.Source: §1 · p. 1
  • Visual backdoors can leave behavior benign until a scene trigger appears, then redirect an embodied agent toward attacker-specified actions.The introduction gives the example of redirecting room cleaning to placing a knife on a sofa, creating risks in physical environments.Source: §1 · pp. 1–2
  • BEAT combines benign demonstrations with rule-based backdoor trajectories across diverse scenes, tasks, and trigger placements to address visual-trigger variability.Naive SFT on mixed data can produce false backdoor activations up to 80% on trigger-free inputs and low activation when triggers are present.Source: §1 · p. 2
  • CTL uses paired inputs differing only in trigger presence to favor benign actions without a trigger and malicious policy actions when one is present.The preference-learning formulation sharpens trigger decision boundaries while preserving benign task performance.Source: §1 · p. 2
  • Across benchmarks and VLMs, BEAT achieves attack success rate up to 80% while maintaining comparable or better benign task performance and generalizing to out-of-distribution trigger placements.The reported plans average 9 steps; CTL improves backdoor activation F1 by up to 39%.Source: §1 · p. 2

2 RELATED WORK

Prior embodied-agent backdoor work has largely targeted language-based planning or single-turn outputs, while visual triggers have included fixed patterns and physical objects. BEAT focuses on multi-turn policy behavior in VLM-based agents with variable-appearance object triggers.

Foundation Models For Embodied Decision Making

  • LLMs support embodied agents' high-level planning, and VLMs add direct visual perception, but safety remains underexplored.The paper presents visual backdoor attacks as safety vulnerabilities and benchmarked scenarios for future defenses.Source: §2 · p. 3

Backdoor Attacks

  • Existing LLM- and VLM-based agent attacks predominantly corrupt single-turn outputs, while Yang et al. (2024a) target multi-turn behavior in LLM-based agents and BEAT extends this policy-level focus to VLM-based agents.BEAT's triggered policy requires multi-step environmental interaction and sustained reasoning.Source: §2 · p. 3

Backdoor triggers

  • Earlier physical-object triggers include boards in view (Wang et al., 2024c) and red balloons in driving scenes (Ni et al., 2024), whereas BEAT's object triggers vary more in appearance.BEAT uses preference-style CTL to distinguish trigger-present from trigger-free frames.Source: §2 · p. 3

3 BEAT: BACKDOOR ATTACKS ON VLM-BASED EMBODIED AGENTS

BEAT implants visual backdoors in VLM-driven embodied agents through a pipeline spanning agent formulation, a threat model, diverse training data, and two-stage fine-tuning. Its design combines benign competence with trigger-conditioned policy switching.

3 BEAT: BACKDOOR ATTACKS ON VLM-BASED EMBODIED AGENTS

  • The BEAT framework formulates embodied-agent perception and action, defines attacker capabilities and objectives, and then constructs data and applies two-stage fine-tuning.Its data construction and training scheme are intended to implant visual backdoors in VLM-driven embodied-agent policies.Source: §3 · p. 3

3.1 FORMULATION OF VLM-DRIVEN EMBODIED AGENTS

  • A VLM-driven embodied agent samples actions from its policy using the user instruction, interaction history, and current egocentric frame.The instruction remains fixed during an episode, while the agent observes successive environment states.Source: §3.1 · pp. 3–4

3.2 THREAT MODEL

  • BEAT assumes an attacker can fine-tune model weights and release a compromised checkpoint that behaves benignly until a visual trigger prompts attacker-specified behavior.The policy follows benign behavior before the first trigger-visible timestep and switches to the attack policy upon detection.Source: §3.2 · p. 4

3.3 DATA CONSTRUCTION

  • The training data combines successful benign trajectories, multi-step backdoor trajectories, and contrastive pairs to teach normal competence and trigger-conditioned switching.Contrastive pairs share a scene and interaction history but differ in trigger presence and the corresponding preferred action.Source: §3.3 · pp. 4–6

3.4 TWO-STAGE BACKDOOR FINE-TUNING

  • CTL follows SFT by training on contrastive preferences, sharpening trigger-conditioned decision boundaries for precise, low-false-positive backdoor activation.The SFT model is frozen as the reference policy, and neutral SFT examples are mixed into CTL training to balance trigger specialization with overall competence.Source: §3.4 · p. 6

4 EXPERIMENTS

Experiments test BEAT across two embodied-agent benchmarks, multiple VLMs, trigger settings, and held-out scenarios. The results report strong benign-task performance alongside trigger-conditioned attack execution, with analyses of data ratios, false activations, OOD placements, and training-stage contributions.

4.1 EXPERIMENTAL SETTINGS

  • Evaluation used VAB-OmniGibson and EB-ALFRED, with knife and vase triggers respectively, and 100 held-out benign plus 100 backdoor scenarios per benchmark.Training scenarios varied scenes, trigger placements, and task contexts, with no overlap with test scenarios.Source: §4.1 · p. 7

4.2 EXPERIMENTAL RESULTS

  • BEAT surpasses Benign SFT in SR, gains up to 30% ASR in VAB-OmniGibson and 19% in EB-ALFRED with Qwen2-VL-7B-Instruct, and reaches F1BT 0.951 in VAB-OmniGibson.Table 1 compares Original, Benign SFT, BEAT w/o CTL, and full BEAT across two benchmarks and multiple VLMs.Source: §4.2 · p. 7, Table 1 · p. 8
  • Successful trajectories averaged 9.0 steps, beginning with benign actions and switching to malicious actions after the trigger appeared.Figure 3 depicts a knife trigger in VAB-OmniGibson and a vase trigger in EB-ALFRED.Source: §4.2 · p. 8, Figure 3 · p. 8

4.3 ANALYSIS

  • Across tested backdoor data ratios, CTL improves benign and attack success rates; at k = 0.1, it boosts ASR by more than fivefold.The ratio study used Qwen2-VL-7B-Instruct on VAB-OmniGibson.Source: §4.3 · pp. 8–9, Figure 4 · p. 9
  • BEAT maintains near-zero FTR across settings, while omitting CTL produces false activations reaching 80% FTR on EB-ALFRED with InternVL3-8B.FTR measures erroneous backdoor reasoning on trigger-free trajectories.Source: §4.3 · p. 9, Figure 5 · p. 9
  • With knives placed in five unconventional settings spanning 27 tasks, BEAT activated its backdoor policy 92.3% of the time.The OOD scenes included bathrooms, gardens, supermarkets, garages, and hallways.Source: §4.3 · p. 9, Figure 6 · p. 9
  • Failures in EB-ALFRED mainly involved missed triggers or variable trigger-step actions, while VAB-OmniGibson failures often followed activation but involved navigation or manipulation.The authors suggest adding trajectories with varied failure conditions to the training data.Source: §4.3 · p. 9
  • Across tested settings, BEAT remained relatively insensitive to α and β; without SFT, CTL retained precise activation but had up to a 19% ASR gap and lower benign SR.The ablation attributes general task-completion learning to SFT and precise backdoor activation to CTL, making the stages complementary.Source: §4.3 · p. 10, Table 2 · p. 10, Table 3 · p. 10

5 DISCUSSION OF OBJECT TRIGGERS

BEAT focuses on object triggers as an initial setting because their varied appearance makes reliable activation challenging; extending the approach to more complex triggers remains future work.

5 DISCUSSION OF OBJECT TRIGGERS

  • BEAT focuses on object triggers as a starting point, while other trigger designs remain unexplored.Examples include object co-occurrence, spatial relationships, and events such as an apple falling.Source: §5 · p. 10
  • Complex trigger designs make precise and reliable backdoor activation substantially more difficult.The paper identifies precise, reliable activation as crucial in backdoor attacks.Source: §5 · p. 10
  • Whether CTL generalizes to more complex trigger forms is left as future work.The paper presents CTL as preference-learning-style training for precise backdoor activation.Source: §5 · p. 10

6 CONCLUSION

BEAT combines diverse backdoor training data with supervised fine-tuning followed by contrastive trigger learning. Evaluations report up to 80% attack success, near-zero false activations, and effective generalization to out-of-distribution scenarios.

6 CONCLUSION

  • Up to 80% attack success, near-zero false activations, and effective out-of-distribution generalization are reported across benchmarks and VLMs.The reported findings demonstrate the feasibility of visual backdoors in VLM-driven embodied agents.Source: §6 · p. 10
  • BEAT uses benign trajectories, multi-step backdoor demonstrations, and contrastive trajectory pairs to expose models to varied trigger appearances.The corpus addresses the wide appearance variability of visual triggers.Source: §6 · p. 10
  • BEAT applies supervised fine-tuning followed by contrastive trigger learning to sharpen policy boundaries around trigger presence.The refinement explicitly teaches when to switch policies.Source: §6 · p. 10
  • The findings expose a security gap for VLM-driven embodied agents and underscore the need for robust defenses before safety-critical deployment.Source: §6 · p. 10

26 April 2025. 1, 2

The listed references span embodied-agent planning, backdoor attacks on language models, and preference-learning methods.

26 April 2025. 1, 2

  • The references also include Direct Preference Optimization and Iterative Reasoning Preference Optimization.Source: §26 · pp. 12–13
  • The bibliography includes embodied-agent planning work such as Llm-planner and Voyager.Source: §26 · p. 13
  • Listed backdoor-related works include instruction-tuning, activation-steering, and token-level attacks on language models.Source: §26 · pp. 13–14

A DATASET DETAILS

The appendix describes two embodied-agent benchmarks and the datasets used to train and evaluate BEAT, including the held-out test scenarios.

A DATASET DETAILS

  • The evaluation uses VAB-OmniGibson and EB-ALFRED with varied image inputs, action spaces, and prompt formats.For EB-ALFRED, actions are generated and executed individually while an overall action plan is retained.Source: A DATASET DETAILS · p. 15
  • Each benchmark holds out 400 benign and backdoor test cases, covering unseen tasks in familiar scenes or entirely unseen scenes.The test cases do not overlap with training scenarios.Source: A DATASET DETAILS · p. 15, Table 5 · p. 15

B IMPLEMENTATION DETAILS

The implementation uses separate training configurations for open-source models and GPT-4o. GPT-4o did not learn trigger steps under the initial setup, and image-based DPO restrictions limited its subsequent training to SFT.

B IMPLEMENTATION DETAILS

  • Open-source models used trajectory-level random training and validation splits, with a validation ratio of 0.1.LoRA fine-tuning was used for the open-source models.Source: B IMPLEMENTATION DETAILS · p. 15
  • SFT varied the backdoor-data proportion k and used language-module-only LoRA with rank 16, alpha 32, and dropout 0.05.Training used 3 epochs, batch size 4, gradient accumulation over 4 steps, and AdamW with 8-bit quantization, a 2e-4 learning rate, and cosine scheduling.Source: B IMPLEMENTATION DETAILS · p. 16
  • CTL used weighted sampling with reduced probability for DSFT samples and trained for 2 epochs with a 3e-5 learning rate.The configuration also used batch size 1, gradient accumulation over 4 steps, maximum gradient norm 0.3, warmup ratio 0.03, and β = 0.05 for DPO.Source: B IMPLEMENTATION DETAILS · p. 16
  • The authors tuned CTL’s NLL loss weight α and backdoor-data ratio k; Table 6 lists settings used for Table 1 results.Table 6 is identified as the hyper-parameters table.Source: B IMPLEMENTATION DETAILS · p. 16, Table 6 · p. 16
  • At k = 1, GPT-4o failed to learn trigger steps, producing zero ASR on both datasets; image-based DPO restrictions led to SFT-only continual training and lower performance.Continual learning emphasized trigger steps while reducing regular SFT and non-trigger backdoor steps.Source: B IMPLEMENTATION DETAILS · p. 16

C EXPERIMENTS ON SYSTEM PROMPT ROBUSTNESS

The system-prompt robustness test rewrote the original prompt while preserving its meaning and details, then evaluated the model on VAB. The accompanying imperfect-trigger examples show successful activation with partially visible or visually varied vases.

C EXPERIMENTS ON SYSTEM PROMPT ROBUSTNESS

  • F1BT = 0.924 under the rewritten system prompt indicates comparable backdoor-activation accuracy to the original prompt.The tested model was Qwen2-VL-7B-Instruct on VAB.Source: C EXPERIMENTS ON SYSTEM PROMPT… · p. 16
  • 65.9% ASR was retained under the rewritten system prompt, described as slightly reduced but still high.The comparison is against the original system prompt.Source: C EXPERIMENTS ON SYSTEM PROMPT… · p. 16
  • The robustness test used a GPT-rewritten prompt intended to preserve the original prompt’s meaning and important details.The model trained with the original system prompt was evaluated using the rewritten version.Source: C EXPERIMENTS ON SYSTEM PROMPT… · p. 16
  • On VAB, Qwen2-VL-7B-Instruct trained with the original prompt was evaluated using the rewritten prompt.The rewrite was requested from GPT.Source: C EXPERIMENTS ON SYSTEM PROMPT… · p. 16

D CASE STUDIES OF IMPERFECT TRIGGERS

E DEFENSES

The paper discusses defenses but does not propose or evaluate them as its main focus. Its tests report limits for prompt-based and activation-clustering defenses, while continual benign SFT reduced ASR to zero at a computational cost.

E DEFENSES

  • Because the attacker controls fine-tuning, the paper frames feasible defenses as post-training or deployment-time mechanisms and discusses rather than evaluates defenses.The work focuses on introducing the attack, not proposing or evaluating defenses.Source: E DEFENSES · pp. 16–17
  • Blur and smoothing can distort both triggers and benign scene elements, potentially degrading task performance; adaptive attackers may circumvent these transformations.The authors say these effects limit the practical security benefits of physical-world noise defenses.Source: E DEFENSES · p. 17
  • Activation clustering yielded TPR 0.45 and FPR 0.35, indicating mild separation and unreliable detection for this defense.The test applied PCA and KMeans clustering with k = 2 to final-token hidden states.Source: E DEFENSES · p. 17
  • Prompt-based safety instructions reduced VAB ASR from 77.9% to 64.7%, which the authors characterize as modest effectiveness.The attack remained robust under the tested safety prompt.Source: E DEFENSES · p. 17
  • A small number of continual benign SFT steps degraded ASR to 0%, but the approach may be impractical for many end users because it can require resources comparable to full-VLM fine-tuning.The authors attribute vulnerability to catastrophic forgetting and reliance on subtle visual cues.Source: E DEFENSES · p. 17

F LIMITATIONS

This section describes limits on BEAT’s evaluation and notes that the supplied EB-ALFRED prompt-format passage does not state a limitation.

F LIMITATIONS

  • BEAT’s limitations include CTL evaluation only on open-source VLMs, bounding-box trigger annotations in VAB-OmniGibson, and simulation-only experiments.GPT-4o’s finetuning API does not support image-based DPO, so only BEAT without CTL was applied to GPT-4o; EB-ALFRED provides box-free experiments, but robust box-agnostic triggers need further study. Real-world evaluation remains future work, although the framework is not tied to a specific simulator.Source: F LIMITATIONS · pp. 17–18

G ETHICS STATEMENT

  • The authors describe BEAT as double-edged because its findings expose vulnerabilities that could be weaponized, and call for proactive safeguards and more robust agent protocols.They argue transparency is essential to developing defenses and ultimately deploying embodied systems with stronger guarantees against covert manipulation.Source: G ETHICS STATEMENT · p. 18

H.2 PROMPT FOR EB-ALFRED

  • At each timestep, the agent may continue a successful unfinished plan or reason and make a new plan.Source: §H.2 · p. 22
  • When reasoning, the agent describes the image, its reasoning steps, and its plan, then outputs an action ID and description.Source: §H.2 · p. 22
  • The prompt supplies an image, instruction, interaction history, and available actions to the agent.Source: §H.2 · p. 22

Related papers

Loading 2510.27623v3…