PaperlayerView exact revision on arXiv

Source-linked AI summary

Backdoors in Learning-Based Industrial Robotic Arm Manipulation: An Empirical Security Study

Zijian Zhang, Zhen Zeng, Zhongshu Gu, Sandeep Pisharody

arXiv:2609.26868v1cs.RO

TL;DR

Backdoors in learning-based robotic manipulation remain underexplored on real industrial arms, despite the risks of trigger-activated behavior. This study tests physical attacks and online trigger sanitization on FANUC and xArm robots. The attack reaches up to 100% success without degrading clean-task performance, and the defense operates with negligible throughput overhead.

  • Problem

    Backdoor attacks remain underexplored in physical robotic arm manipulation, where conventional safety monitoring can miss semantically incorrect but physically valid behavior.

    Source: §I · p. 1

  • Method

    The study poisons demonstrations to create physical trigger-conditioned failures and applies task-aware spatial filtering and online observation sanitization.

    Source: §I · p. 1, §III · p. 2

  • Results

    Up to 100% attack success is achieved without degrading clean-task performance, while the online defense detects and removes perturbations with negligible throughput overhead.

    Source: §I · p. 2

  • Takeaways & Limitations

    The online pipeline provides a preliminary practical foundation for securing real-world robotic policies without retraining downtime and with negligible edge overhead.

    Source: §VI · p. 4

    The defense assumes triggers are in off-task backgrounds; triggers on task-relevant objects or robot links could bypass static task-mask filtering.

    Source: §V · p. 4

Abstract

from arXiv · show

Learning-based models (e.g., visuomotor and Vision-Language-Action (VLA)) are increasingly explored for industrial robotic manipulation, where model predictions are directly translated into physical actions. This tight coupling between model behavior and physical execution makes hidden security vulnerabilities particularly consequential. While backdoor attacks have been widely studied in conventional AI models, their effects on deployed learning-based robotic arm manipulation systems remain less understood: a backdoored robot can behave normally during benign operation while inducing attacker-specified behaviors only when specific triggers are present, posing potentially serious risks in physical environments. In this work, we present a preliminary empirical security study of backdoor attacks and defenses in learning-based robotic manipulation on two real commercial industrial robotic arms (FANUC and xArm). We investigate whether a backdoor can reliably induce semantically incorrect manipulation behaviors while remaining stealthy under nominal task execution. We then develop an online defense pipeline that detects and neutralizes triggers at runtime, and compare its effectiveness against an offline fine-tuning defense. Beyond defense effectiveness, we further evaluate the computational latency and execution overhead introduced by the defense pipeline to assess its suitability for high-throughput industrial operation.

I. INTRODUCTION

The study examines backdoors in learning-based industrial manipulation, where poisoned demonstrations can preserve normal behavior while activating attacker-specified behavior under triggers. It evaluates attacks and runtime defenses on commercial FANUC and xArm robots.

I. INTRODUCTION

  • As industrial manipulators map visual observations directly to actions, the physical deployment of learning-based policies raises operational safety stakes.The paper situates its work in the underexplored security implications of backdoors on real industrial robotic arms.Source: §I · p. 1
  • Attacks must create coherent, semantically meaningful task failures while keeping altered action trajectories physically executable under robot and controller constraints.Industrial arms constrain joint positions, velocities, accelerations, torques, and contact forces; violations may be clipped, rejected, or stopped.Source: §I · p. 1
  • Conventional runtime safety monitors can accept physically valid malicious actions or miss inconspicuous triggers, allowing semantically wrong behavior within their monitoring scope.Examples include smoothly dropping a workpiece, reversing battery polarity, or placing an object in the wrong container.Source: §I · p. 1
  • The study investigates whether physical backdoors preserve benign task performance while activating in manipulation tasks, and whether mitigation strategies reduce the resulting risks.It is a preliminary empirical study on two real commercial industrial robotic arms, FANUC and xArm.Source: §I · pp. 1–2
  • Poisoning a minute fraction of demonstration primitives achieves up to 100% attack success without degrading clean-task performance, while the online defense detects and removes perturbations with negligible throughput overhead.The evaluation covers color sorting and machinery boxing on FANUC LR Mate 200iD and xArm 6, with defense deployment on an NVIDIA Jetson AGX Orin.Source: §I · p. 2

A. Learning-based Robotic Manipulation

Learning-based manipulation depends on demonstrations, creating a data-centric attack surface. Online safety monitoring constrains physical or representation-level deviations, but crafted in-distribution inputs may fall outside its design scope.

A. Learning-based Robotic Manipulation

  • Policies trained on teleoperation or crowdsourced demonstrations can inherit a data-centric attack surface because they learn behaviors without explicit semantic verification of training trajectories.This dependence applies to both domain-specific visuomotor policies and foundation VLA models.Source: A. Learning-based Robotic Manipulation · p. 2

B. Online Safety Monitoring

  • Model-based safety filters constrain trajectories within predefined safe sets, while learned latent-space monitors track visual-state deviations and can trigger recovery policies.The described approaches target deviations from expected execution.Source: B. Online Safety Monitoring · p. 2
  • Intentionally crafted in-distribution inputs lie outside the stated design scope of these monitoring approaches.The text identifies this boundary after describing physical-state and latent-space monitoring.Source: B. Online Safety Monitoring · p. 2

C. Backdoor Attack and Defense

A backdoor links a trigger to attacker-targeted behavior while preserving clean-sample behavior. The study constructs physically executable poisoned demonstrations and applies task-aware online observation sanitization.

C. Backdoor Attack and Defense

  • A backdoor uses poisoned demonstrations to associate a trigger with target behavior while leaving the original input-output mapping intact on clean samples.Input sanitization removes suspicious patterns at inference time, whereas model-centric repair requires offline intervention or retraining.Source: C. Backdoor Attack and Defense · p. 2

III. METHODOLOGY

  • The attack poisons demonstrations by modifying a semantically meaningful action segment in response to a physical trigger while preserving the remaining trajectory and task context.The modified motion is kept physically executable, and poisoned demonstrations are mixed with clean ones for training.Source: §III · p. 2
  • The online defense segments task-relevant entities, uses policy spatial attention to find suspicious off-task regions, and sanitizes those pixels before inference.It leaves task-critical visual content untouched and does not modify or retrain the victim policy.Source: §III · p. 2
  • Table I defines success-count metrics, and Table II covers attack efficacy and nominal stealthiness across robotic platforms using counts out of 10 rollouts.The supplied table captions state scope but do not provide cell values.Source: Table I · p. 3, Table II · p. 3

A. Experimental Setup

The evaluation asks whether physical backdoors induce semantically incorrect behavior while preserving nominal execution, and whether online defense restores performance while maintaining industrial throughput.

A. Experimental Setup

  • The evaluation frames two questions: attack efficacy and stealthiness, and online defense efficacy and efficiency.The defense question includes trigger neutralization, task-performance restoration, and maintaining throughput for industrial operations.Source: A. Experimental Setup · p. 3
  • Attack efficacy and stealthiness are evaluated on two representative manipulation tasks using teleoperation demonstrations.Each task pairs a nominal objective with a physically feasible but semantically incorrect attack behavior.Source: A. Experimental Setup · p. 3
  • The tasks are sorting, where the attack redirects objects to an incorrect target, and collecting, where it induces incorrect placement in a designated-box task.Both attack behaviors are described as physically executable.Source: A. Experimental Setup · p. 3

B. Attack Efficacy and Stealthiness

The physical backdoor preserves nominal task performance while triggering targeted failures during manipulation. Common workspace objects can serve as inconspicuous triggers.

B. Attack Efficacy and Stealthiness

  • N_cp reached up to 10/10 in trigger-free Color Sorting and Machinery Boxing, while N_ap reached up to 10/10 on xArm 6 with triggers across both platforms.The attack used a poisoning ratio of 0.1, modifying five episodes.Source: B. Attack Efficacy and Stealthiness · p. 3
  • The Machinery Boxing attack induces the robot to drop the blue solder wire during lifting, and the Color Sorting attack induces it to drop the black screw.The nominal tasks collect and sort items according to color.Source: Figure 1 · p. 3, Figure 2 · p. 3
  • Triggers placed in ordinary workspace regions blended naturally into the scene while activating the backdoor.Figure 1 places its trigger at the upper-right corner; Figure 2 places its trigger at the bottom of the workspace.Source: B. Attack Efficacy and Stealthiness · p. 3

C. Defense Efficacy and Efficiency

Online observation sanitization removes triggers before policy inference and restores nominal task execution, whereas fine-tuning provides limited mitigation. The defense also maintains throughput comparable to the unshielded baseline during continuous operation.

C. Defense Efficacy and Efficiency

  • Online sanitization removes triggers before policy inference, reducing attack executions and restoring nominal task execution; fine-tuning provides limited mitigation despite added benign data and optimization.The comparison concerns physical-trigger activation in the Color Sorting task across five rollouts.Source: C. Defense Efficacy and Efficiency · pp. 3–4, Table III · p. 4
  • Throughput remained comparable to the unshielded baseline on RTX 4090 and Jetson AGX Orin over a 10-minute continuous execution window.The evaluation counts completed task cycles; the edge platform showed only minor variation.Source: C. Defense Efficacy and Efficiency · p. 4, Table IV · p. 4

V. DISCUSSION

The defense assumes physical triggers are in off-task background regions and targets visual triggers; in-task and multimodal triggers remain outside its current coverage.

V. DISCUSSION

  • Static task-mask filtering assumes triggers remain off-task; triggers on task objects or manipulator links could bypass it, though self-occlusion may reduce attack reliability.The discussion suggests 3D trigger-visibility modeling using depth estimation and point-cloud consistency as a stronger defense.Source: §V · p. 4
  • The current defense targets physical visual triggers, not language-activated or cross-modal backdoors in VLA models.The discussion identifies modality-specific filtering and cross-modal consistency checks as possible extensions.Source: §V · p. 4

VI. CONCLUSION

Experiments on FANUC and xArm arms demonstrate physical-triggered semantic task failures that bypass conventional dynamic safety filters; online observation sanitization neutralizes triggers with zero retraining downtime and negligible edge overhead.

VI. CONCLUSION

  • The study demonstrates physical triggers inducing semantic task failures that bypass conventional dynamic safety filters, while online sanitization neutralizes triggers with zero retraining downtime and negligible edge overhead.The authors describe the study as a preliminary empirical foundation for securing real-world robotic policies.Source: §VI · p. 4

Related papers

Loading 2609.26868v1…