StepTrigger: Contact-State-Triggered Backdoor Attacks on VLM-Powered Legged Robots

• Prior embodied-agent backdoors use external language, visual, or scene cues, or internal action-history triggers, but do not cover terrain contact as a state channel.A compromised planner may otherwise appear normal in ordinary runs while changing its target selection under rare conditions.Source: §1 · p. 2
• StepTrigger uses a dense patch of small stones or low spikes to produce foot-contact and pressure patterns that redirect the planner toward a human proxy.The study uses a Unitree Go1 in a simulated room with a green benign target and a blue human-proxy cylinder.Source: §1 · p. 2
• Because benign events also cause irregular pressure readings, StepTrigger treats anomalies as candidates and pairs incidental events with benign targets while reserving attack targets for dense-patch contacts.This selective design aims to preserve benign behavior under clean and false-trigger conditions while activating the backdoor for the learned contact pattern.Source: §1 · p. 2
• The Gazebo Go1 prototype combines baseline-relative pressure processing with multimodal VLM planning to distinguish dense-patch traversal from incidental pressure anomalies.The pressure module identifies candidate contact events; the planner learns which events correspond to the trigger.Source: §1 · p. 2
• 98.75% clean behavior preservation, 92.50% false-trigger rejection, and 76.25% true-trigger activation were achieved on a stratified offline test set.The evaluation used clean samples, false-trigger hard negatives, and true-trigger poisoned samples.Source: §1 · p. 3

2.1 LLM- and VLM-Powered Robotics

• LLMs and VLMs support semantic goals, task decomposition, and high-level action selection, while this work adds physical contact state as a planner input.Prior systems commonly retain mapping, motion execution, and safety modules while models select subgoals or high-level actions.Source: §2.1 · pp. 3–4

2.2 Backdoor Attacks on Learning Systems

• Backdoors can preserve ordinary behavior until a trigger activates a malicious association [7] [4], and compromised robot planners can affect the physical environment [14] [21].Agent-oriented attacks may associate malicious behavior with goals, tool-use contexts, or reasoning trajectories [9].Source: §2.2 · p. 4

2.3 Embodied and Robotic Backdoor Triggers

• Embodied backdoor triggers include external text, visual, and scene cues [14], visible physical objects [21], hidden conditional logic, and action histories; StepTrigger instead uses contact-state evidence.That evidence may be missed by prompt sanitization, camera-only defenses, or monitors limited to discrete action history.Source: §2.3 · pp. 4–5

2.4 Contact and Pressure Signals in Legged Robots

• Foot-contact and force signals support terrain recognition and locomotion control [20], but their role as security-sensitive planner inputs remains less studied.The paper examines whether terrain-induced contact patterns can act as hidden conditions that change a high-level navigation planner’s behavior.Source: §2.4 · p. 5

3.1 Attacker Capabilities

• The attacker can poison VLM navigation training examples to associate a physical contact trigger with approaching a human-proxy safety object, and may place or induce a terrain patch.The attacker does not modify the low-level controller, firmware, simulator, middleware, or mapping algorithm, and needs no malicious prompt token or conspicuous visual marker.Source: §3.1 · p. 5

3.2 Defender Assumptions

• The defender can inspect ordinary prompts and camera frames but may not treat pressure or contact-state features as a security-sensitive input channel.The model assumes these proprioceptive features may be treated as low-level state rather than adversarial trigger evidence.Source: §3.2 · p. 6

3.3 Attack Objective

• The attack objective is normal safe exploration and object-aware navigation without a trigger, but waypoints toward the human-proxy safety object after the contact trigger is recognized.The trigger is not an obvious prompt token or visual marker; it emerges from contact-state evidence that text or image sanitization alone may not detect.Source: §3.3 · p. 6

4 System Architecture

• The Gazebo/ROS 2 stack separates VLM target selection from mapping, target validation, path planning, and motion execution.The VLM receives a rendered map, candidate waypoints, semantic memory, and pressure context; downstream modules validate its target and convert it into a motion objective.Source: §4 · p. 6, Figure 1 · p. 7

4.1 Sensors and State Representation

• The planner-visible state combines a LiDAR-derived occupancy map, visual semantic memory, and pressure/contact context for structured target selection.The VLM output selects a high-level target that downstream autonomy modules validate and convert into a motion objective.Source: §4.1 · p. 7

4.2 Pressure Receiver

• The pressure receiver uses per-leg contact and force observations to compute baseline-relative residual features and high-recall trigger candidates.Features and candidate state are included in planner context and logged alongside planner-I/O records for replay and offline labeling.Source: §4.2 · p. 8

5.1 Physical Trigger Design

• The dense patch of small stones or low spikes is intended to produce foot-ground pressure residuals relative to flat walking, not a visual cue.The receiver extracts baseline-relative features and treats them as high-recall candidates rather than ground-truth trigger labels.Source: §5.1 · p. 8, Table 2 · p. 9

5.2 Two-Tier Trigger Candidate Latch

• The two-tier candidate rule rejects weak or benign pressure states, then retains confirmed candidates briefly so planner queries can catch transient events.The latched state preserves recent candidate evidence but is neither a true/false-trigger label nor a direct backdoor activation.Source: §5.2 · pp. 9–10

5.3 Backdoor Behavior

• Supervision keeps clean and false-trigger outputs benign, while dense-patch-trigger samples receive attack-oriented waypoints toward the human-proxy object.The behavior is learned from associations between planner-visible multimodal states and supervised target-selection outputs; deployment does not use an offline oracle label or explicitly classify true triggers.Source: §5.3 · p. 10

6.1 Object Choice for Clean and Triggered Runs

• The room uses a green sphere as the benign target and a blue cylinder as the human proxy; the dense-patch variant supplies true contact-trigger samples.The figure also shows the simulated Unitree Go1 and the clean/false-trigger configuration.Source: Figure 2 · p. 11, §6.1 · p. 11

6.2 Three-Stage Data Collection

• Three collection stages record benign exploration, pressure anomalies without a patch, and mixed dense-patch contacts, respectively.Clean and false-trigger samples retain benign targets; only patch-associated true triggers target the human proxy.Source: §6.2 · p. 12

6.3 Automatic Labeling Rules

• Run metadata supplies patch bounds for offline labeling only; a candidate is true when its recovered or fallback pre-trigger position matches the patch and the robot remains stable.Fall-like or severe-collision cases are labeled unstable/fall rather than successful attack demonstrations.Source: §6.3 · p. 13

6.4 Counterfactual Benign Targets for False Triggers

• False-trigger events keep benign or counterfactual benign targets even when the pressure latch fires, so the latch alone does not define the attack condition.The final selective targets map normal and false-trigger samples to not_attack_human and true dense-patch samples to attack_human.Source: §6.4 · p. 13

6.5 Dataset Statistics

• 2,686 samples form the corpus: 1,251 clean, 465 no-patch false-trigger, and 970 mixed dense-patch samples.The mixed set contains 124 true-trigger positives and 846 additional false-trigger hard negatives; only true dense-patch triggers receive attack targets.Source: §6.5 · p. 14, Table 4 · p. 14

7.1 Experimental Setup

• The planner and pressure subsystem run in a ROS 2/Gazebo Go1 stack, with pressure residuals and contact features supplied alongside camera, LiDAR, pose, and command-history data.The pressure latch uses support quality, motion state, active-pair imbalance, and contact-event score to suppress artifacts and single-leg transients.Source: §7.1 · p. 14

7.2 Fine-Tuning Setup

• The Qwen3-VL-based strategist is fine-tuned on structured summaries rather than raw camera frames, with the high-level planner selecting waypoints while low-level locomotion remains separate.The training set is rebalanced to 2,444 examples, including 744 oversampled attack examples, without changing the selective target policy.Source: §7.2 · p. 15

7.3 Offline Evaluation Protocol

• Evaluation parses 240 held-out prompt-output instances into benign or attack behavior across 80 clean, 80 false-trigger, and 80 true-trigger samples; it is not an online rollout metric.The four measures are clean preservation, false-trigger rejection, true-trigger activation, and overall parsed behavior accuracy.Source: §7.3 · p. 15

7.4 Offline Evaluation Results

• 79/80 clean samples were preserved, 74/80 false-trigger samples rejected, and 61/80 true-trigger samples activated; parsed behavior was correct on 214/240 samples.The expected policy is benign for clean and false-trigger inputs and attack-oriented for true dense-patch triggers.Source: §7.4 · p. 15, Table 5 · p. 16
• 61 true positives, 19 false negatives, 7 false positives, and 153 true negatives yield 89.71% attack precision (61/68).Across non-trigger cases, the false-positive rate is 4.38% (7/160) and rejection is 95.63% (153/160).Source: §7.4 · p. 15, Table 6 · p. 16
• The 76.25% true-trigger activation rate is a conservative single-sample measure, while repeated planner frames during traversal may offer further activation opportunities.Incidental anomalies also occur during gait initialization, transitions, wall/object contact, and unstable locomotion.Source: §7.4 · p. 16, §7.5 · p. 17

7.5 Qualitative Gazebo Rollout Demonstration

• During dense-patch rollouts with sustained contact candidates, the strategist shifted to human-proxy waypoints and the robot redirected its motion toward that proxy.The authors describe these as qualitative demonstrations complementary to the offline planner-output evaluation.Source: §7.5 · p. 16
• Variable patch exposure and Gazebo timing make the rollouts qualitative rather than a trajectory-level attack-success metric.Navigation does not intersect the patch consistently across runs, and high simulation load can disrupt locomotion and contact observations.Source: §7.5 · p. 17

• Startup, turning, wall rubbing, object contact, and recovery motions can create pressure spikes or temporary latch states, so the pressure receiver only flags frames for planner interpretation.Source: §8 · p. 17
• False-trigger events serve as hard negatives: incidental contacts retain benign targets, while dense-patch contacts alone receive attack-oriented targets.This design avoids training a shortcut in which any pressure anomaly means attack.Source: §8 · p. 17
• The trigger depends on pressure/contact features together with semantic memory, LiDAR-derived map context, and candidate waypoints, linking it to embodied state rather than pressure score alone.Language- or camera-only defenses would miss this class of trigger.Source: §8 · pp. 17–18

9 Limitations and Future Work

• Simulation omits real-hardware contact noise and other effects, while the controlled room and simple waypoint-following tasks do not cover complex navigation.The setup uses primitive objects, a bounded indoor room, and an optional dense terrain patch.Source: §9 · p. 18
• Trigger behavior depends on patch geometry and simulation dynamics; pressure readings and automatic labels also depend on stable simulation and accurate run metadata.Sparse patches may fail to generate reliable candidates, while overly dense or tall patches may cause falls.Source: §9 · p. 18
• The main evaluation is offline, and Gazebo rollouts are qualitative rather than measures of full-room success or physical collision outcomes.The attack changes high-level waypoint selection, not the low-level controller or robot firmware.Source: §9 · p. 18
• Future work includes hardware validation, more complex environments and locomotion, additional physical triggers, and runtime monitors for benign versus malicious contact activation.Hardware testing would require contact calibration and safeguards against falls or damage.Source: §9 · pp. 18–19

10 Conclusion

• 98.75% of clean samples received benign selections, 92.50% of false-trigger samples received benign selections, and 76.25% of true-trigger samples received attack-oriented selections.These are results from the stratified offline evaluation.Source: §10 · p. 19
• StepTrigger uses dense-terrain foot-contact patterns as a hidden trigger, pairing only true dense-patch contacts with attack-oriented targets during selective training.Clean and false-trigger samples instead receive benign targets because incidental contacts can produce similar pressure anomalies.Source: §10 · p. 19
• The results suggest that contact and proprioceptive inputs belong to the attack surface monitored in VLM-powered robots, even without visible adversarial objects.The planner may receive an ordinary prompt while a physical-state pattern changes its high-level target selection.Source: §10 · p. 19