PaperlayerView exact revision on arXiv

Source-linked AI summary

TMT: Runtime Backdoor Detection for Vision-Language-Action Policies on Unseen Tasks

Zirun Zhou, Jingfeng Zhang, HaoChuan Xu, Xizhe Zhang, Elliott Wen, Jing Sun, Hong Jia

arXiv:2610.09462v1cs.RO

TL;DR

Backdoored VLA policies may behave benignly until a trigger activates, and distinguishing activation from legitimate changes on unseen tasks is challenging. TMT monitors benign-trained input-token structure and adjacent-layer latent transitions; it achieves the highest or joint-highest detection rates across three attacks. The paper also explores policy purification through self-distillation.

  • Problem

    Runtime VLA backdoor detection must distinguish malicious behavior from benign execution, including when actions are individually plausible and tasks are unseen.

    Source: §1 · p. 1, §3 · p. 3, §6.2 · p. 7

  • Method

    TMT learns benign input-token manifolds and adjacent-layer latent transitions on a frozen VLA backbone, while self-distillation uses the backdoored policy’s benign-input actions to supervise a student on paired observations.

    Source: §4.1 · p. 4, §4.3 · p. 5, §5 · p. 6

  • Results

    TMT achieves the highest or joint-highest trigger detection rates of 100%, 83.43%, and 73.6% under BadVLA, GoBA, and DropVLA, respectively.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The results support monitoring both input representations and internal inference dynamics for VLA backdoor activation on tasks unseen during detector fitting.

    Source: §7 · p. 10

    Detector fitting assumes trusted benign rollouts and access to internal representations, while repeated-query STRIP and TeCo adaptations were excluded from the real-time comparison.

    Source: §3 · p. 3, §6.3 · p. 9

Abstract

from arXiv · show

Backdoored vision-language-action (VLA) policies can preserve benign task performance while producing malicious actions when a trigger appears. Detecting such activation is difficult because malicious behavior can comprise individually plausible actions, while unfamiliar tasks introduce legitimate changes in observations and behavior. We introduce TMT, a runtime backdoor detector based on Token Manifold and latent Transition modeling. Trained on benign rollouts, its two branches assess input-token structure and prediction errors in adjacent-layer latent dynamics. A suspicious rollout identified by the token manifold branch, once confirmed through latent deviations, guides transition selection for subsequent monitoring. We further explore policy purification through self-distillation: a frozen copy of the backdoored policy provides benign-input actions to supervise a student on paired benign and triggered observations, without requiring a separate clean reference policy. For evaluation, we adapt traditional backdoor detectors and repurpose anomaly and failure detection methods as VLA backdoor detectors. In a post-hoc comparison with ten baselines, TMT achieves state-of-the-art backdoor detection performance on unseen tasks across three VLA backdoor attacks. Our project page is available at https://zzr42.github.io/tmt/.

1 INTRODUCTION

VLA backdoors can preserve benign performance yet trigger harmful actions, while runtime detection must distinguish malicious behavior from legitimate changes on unseen tasks. TMT combines token-manifold and latent-transition signals, and the paper also explores self-distillation for purification.

  • Backdoor activation can disrupt task execution, redirect a robot toward an attacker-specified goal, or induce an undesired low-level action, motivating runtime detection.A cited example is a robot suddenly dropping a knife it is holding.Source: §1 · p. 1
  • Runtime VLA detection must learn from benign rollouts, distinguish malicious from benign sequences with the same actions, generalize to unseen tasks, and detect activation with minimal delay.The distinction between benign and backdoor-induced behavior depends on which goal the resulting sequence serves.Source: §1 · pp. 1–2
  • TMT’s token-manifold branch assesses input-token structure, while its latent-transition branch scores adjacent-layer prediction errors; both are trained on benign rollouts.It raises an alarm when either score exceeds its calibrated threshold.Source: §1 · p. 2
  • TMT achieves the highest or joint-highest trigger detection rates of 100%, 83.43%, and 73.6% under BadVLA, GoBA, and DropVLA, respectively.The corresponding observed false-rejection rates are 0.57%, 8.57%, and 0%.Source: §1 · p. 2
  • Self-distillation uses a frozen copy of the backdoored policy to supervise a student on paired benign and triggered observations, without a separate clean reference policy.Triggered-input success rates rise to 92.2–95.5%, while benign-input success rates change by at most 2.2%.Source: §1 · p. 2
  • The paper adapts existing detectors and repurposes anomaly and failure detection methods for evaluation under three VLA backdoor attacks.Its post-hoc results show strong detection performance on unseen tasks.Source: §1 · p. 2

2 RELATED WORK

VLA backdoor attacks vary from disrupted execution to redirection and low-level failures, while existing detection approaches monitor prediction responses, representations, or deviations from normal data. TMT instead monitors input-token manifolds and latent transitions without assuming a specific target action.

  • BadVLA induces control deviations, GoBA redirects high-level goals, and DropVLA induces low-level failures such as premature gripper opening.The attacks use different trigger and poisoning strategies, motivating detection across varied malicious behaviors.Source: §2 · p. 2
  • TMT’s overview combines token-manifold assessment of input-token structure with prediction-error scoring at a selected adjacent-layer pair, raising an alarm if either calibrated threshold is exceeded.Source: Figure 1 · p. 3
  • Traditional detectors screen inputs using prediction responses or representation statistics, but adapted methods show limited detection on unseen VLA tasks compared with TMT.The cited methods include STRIP, TeCo, DeDe, DUP-MS, and concurrent VLA method TrustVLA.Source: §2 · pp. 2–3
  • Anomaly and failure detectors learn reference distributions from normal data, but struggle to distinguish benign execution on unseen tasks from trigger-induced execution.Examples include Deep SVDD, RND, ReDiffuser, LogPZO, and FIPER.Source: §2 · p. 3

3 PROBLEM FORMULATION

The formulation assumes a defender can inspect a potentially backdoored VLA policy during inference and fit a detector using trusted benign rollouts. The objective is online detection with high detection, low latency, and controlled false rejection, including on unseen tasks.

  • A potentially backdoored policy maps each observation and instruction to an action chunk, whose execution changes the environment and subsequent observations across a rollout.A trigger can activate at any query and alter later actions and the resulting trajectory.Source: §3 · p. 3
  • Detector fitting and calibration use trusted benign rollouts and access to internal representations, without triggered examples, trigger specifications, or an uncompromised reference policy.A rollout is benign when the trigger is absent, regardless of task success.Source: §3 · p. 3
  • The defender seeks online detection with high detection rates, low trigger-relative latency, and controlled rollout-level false rejection while generalizing to unseen tasks.False-rejection rate is the fraction of benign rollouts with at least one alarm.Source: §3 · p. 3
  • Figure 2 visualizes input tokens from backdoored OpenVLA-OFT under BadVLA, GoBA, and DropVLA, marking clean queries with blue circles and backdoor-active queries with red crosses.Source: Figure 2 · p. 4

4 BACKDOOR DETECTION

TMT detects VLA backdoor activation by combining benign-trained models of input-token structure and adjacent-layer latent transitions. A token-manifold flag can guide transition selection for later monitoring, while either branch can independently raise an alarm.

4 BACKDOOR DETECTION

  • TMT uses complementary token-manifold and latent-transition branches trained on benign rollouts, with either branch able to trigger an alarm.The victim policy remains frozen during training, and thresholds are calibrated on held-out benign rollouts.Source: §4 · p. 4

4.1 MOTIVATION

  • Benign token representations are hypothesized to form a learnable manifold, while triggered queries may shift away from it and alter layer-to-layer dynamics.The motivation also draws on findings that suppressing skip connections in critical layers can reduce backdoor attack success.Source: §4.1 · p. 4

4.2 TOKEN MANIFOLD

  • The token-manifold model conditions on the preceding query’s mean token representation and learns a flow from benign tokens toward Gaussian noise.At inference it scores the unperturbed query in one forward pass; larger scores indicate greater deviation from learned benign patterns.Source: §4.2 · pp. 4–5

4.3 LATENT TRANSITION

  • The latent-transition model predicts normalized token changes between adjacent backbone layers from the representation at the earlier layer.Layer scales are estimated from benign data, and training samples clean queries and adjacent-layer transitions.Source: §4.3 · p. 5
  • After a token-manifold-flagged rollout is confirmed using detector scores and benign references, TMT selects the transition with the largest standardized excess for subsequent monitoring.The selected transition remains fixed during later monitoring, including unseen-task rollouts.Source: §4.3 · p. 5
  • At the selected transition, TMT averages prediction errors for the K highest-error tokens and normalizes the score using a benign-derived error scale.Larger normalized scores indicate greater deviation from benign latent dynamics.Source: §4.3 · p. 5

4.4 CALIBRATION AND ONLINE DETECTION

  • TMT calibrates branch-specific thresholds from benign rollouts and alarms online when either branch’s score exceeds its threshold.The token-manifold threshold uses the empirical 0.99 quantile of benign rollout maximum scores plus a MAD-proportional margin; the transition branch uses a negative-log tail probability.Source: §4.4 · pp. 5–6

5 BACKDOOR PURIFICATION

The purification method uses a frozen copy of the backdoored policy as a teacher and trains a student on paired benign and triggered observations. Both observations are supervised with the teacher’s benign-input actions.

5 BACKDOOR PURIFICATION

  • A frozen copy of the backdoored policy supplies benign-input actions to supervise a student initialized from the same checkpoint.The method is designed to suppress backdoor-induced behavior while preserving benign task performance, without relying on a separate clean reference policy.Source: §5 · p. 6
  • Teacher-driven paired rollouts execute each teacher action from a benign observation in both environments, collecting observations under a shared action history.The paired observations use the same language instruction, and the teacher’s action chunk advances both environments.Source: §5 · p. 6
  • The student is trained to reproduce the teacher’s benign-input action from both paired observations, preserving behavior on benign inputs and training against triggered observations.The student is used throughout each evaluation rollout.Source: §5 · p. 6

6 EXPERIMENTS

Experiments test detection on unseen tasks across three VLA attacks, then examine real-world GoBA detection, branch contributions, detection latency, and policy self-distillation. TMT performs strongly across attacks, and the purified students recover high attacked-task success rates in a preliminary evaluation.

6.1 EXPERIMENTAL SETUP

  • Detectors trained on benign rollouts from three LIBERO-10 tasks were evaluated on the remaining seven unseen tasks across BadVLA, GoBA, and DropVLA.The attacks target task failure, high-level goal redirection, and low-level gripper opening, respectively.Source: §6.1 · p. 6, §6.2 · p. 7

6.2 MAIN EXPERIMENTAL RESULTS

  • On GoBA, TMT reaches 98.3% AUC and 83.43% TDR at 8.57% FRR, while anomaly and failure baselines have AUCs from 13.8% to 62.6%.GoBA redirects behavior through individually plausible actions; ReDiffuser falls to 62.6% AUC and 15.14% TDR.Source: §6.2 · p. 7
  • Across three attacks, TMT achieves the highest or joint-highest AUC and TDR; on BadVLA, TMT and TrustVLA reach 100% TDR at 0.57% FRR.Table 1 compares rollout-level AUC, TDR, FRR, and mean detection latency on unseen tasks.Source: §6.2 · p. 7, Table 1 · p. 8
  • On DropVLA, TMT detects 73.6% of malicious rollouts with 0% FRR; FIPER detects 26% at the same FRR despite 95.5% AUC.DropVLA induces gripper opening, interfering with grasping and potentially causing repeated unsuccessful attempts.Source: §6.2 · p. 8
  • Additional evaluations show TMT has the highest TDR on π0.5 and VLA-Adapter, and the highest or joint-highest AUC across all three attacks in the all-seen comparison.Source: §6.2 · p. 8

6.3 REAL-WORLD EXPERIMENTS

  • On unseen real-world GoBA tasks, TMT achieves 100% AUC, detects all evaluated malicious rollouts, and rejects no benign rollouts.The real-time comparison excludes STRIP and TeCo because their repeated policy evaluations exceed the setup's per-query time budget.Source: Table 2 · p. 9, §6.3 · p. 9

6.4 ABLATION AND MECHANISM ANALYSIS

  • On unseen DropVLA, the latent transition branch reaches 73.6% TDR versus 15.2% for token manifold; joint detection retains its coverage at 5.68-query mean latency.On all-seen DropVLA, combining branches reduces latency from 9.45 to 2.43 queries while retaining 100% TDR and 1.25% FRR.Source: §6.4 · p. 9, Table 3 · p. 9

6.5 BACKDOOR PURIFICATION

  • In preliminary self-distillation results, attacked-task success rises from 0%, 0.4%, and 0% to 92.2%, 94.8%, and 95.5% for BadVLA, GoBA, and DropVLA, respectively.Benign-input success changes by −2.2%, −0.4%, and +0.4%, respectively.Source: §6.5 · pp. 9–10

7 CONCLUSION

TMT combines token-manifold and latent-transition signals to detect backdoor activation on unseen tasks, while the conclusion reports complementary roles for the two branches. The appendix explains why anomaly and failure detectors may help, while highlighting the challenge of separating goal-directed attacks from legitimate shifts on unfamiliar tasks.

7 CONCLUSION

  • Across three attacks and three victim models, post-hoc comparisons show TMT’s token-manifold and latent-transition signals detect different forms of backdoor activation.The evaluation focuses on tasks unseen during detector fitting.Source: §7 · p. 10
  • Branch ablations show broader token-manifold coverage on familiar tasks and a larger role for latent transitions on unseen tasks.Source: §7 · p. 10
  • Self-distillation uses paired benign and malicious observations as a policy-purification extension.Source: §7 · p. 10

A.1 ANOMALY AND FAILURE DETECTION AS BACKDOOR DETECTION

  • Execution anomalies such as repeated grasp failures or unexpected gripper opening can yield observation and state sequences that differ from benign rollouts.Anomaly and failure detectors assess departures from benign execution patterns without requiring examples of the specific attack.Source: §A.1 · p. 12
  • Goal-directed attacks may use locally plausible actions, while unfamiliar tasks create benign distribution shifts that complicate distinguishing attacks from legitimate variation.Source: §A.1 · p. 12

A.2 BASELINE IMPLEMENTATION AND ADAPTATION

The adapted baselines produce query-level scores using available VLA observations, states, representations, or history. They include both methods designed for backdoor detection and methods repurposed to detect anomalies or failures.

A.2 BASELINE IMPLEMENTATION AND ADAPTATION

  • Baselines score each VLA policy query using method-dependent inputs, while the victim policy remains frozen during fitting and evaluation.Thresholding and latency use the main text’s rollout-level definitions.Source: §A.2 · p. 12
  • STRIP and TeCo test responses to perturbed observations; DeDe uses reconstruction discrepancies, DUP-MS representation statistics, and TrustVLA internal-representation uncertainty.Source: §A.2 · p. 12
  • Anomaly and failure baselines use robot states, observations, or learned representations to score departures from benign execution.The set includes RND, ReDiffuser, FIPER, Deep SVDD, and LogpZO.Source: §A.2 · p. 12

B PRIVILEGED ACCESS TO ALL TASKS

With benign rollouts from all eligible tasks, the privileged comparison evaluates backdoored OpenVLA-OFT under three attacks. TMT’s detection coverage must be considered alongside false rejections.

B PRIVILEGED ACCESS TO ALL TASKS

C EVALUATION ACROSS VICTIM MODELS

Across three victim models evaluated for GoBA detection, TMT achieves the highest TDR on each and the highest AUC on two. The results also show a trade-off on VLA-Adapter, where TMT’s AUC is slightly below ReDiffuser’s.

C EVALUATION ACROSS VICTIM MODELS

D.1 BRANCH ABLATIONS

The ablations show that latent transitions broaden unseen-task detection, while mean-pooled history and endpoint scoring offer efficient token-manifold defaults.

D.1 BRANCH ABLATIONS

  • On unseen GoBA, token-manifold TDR falls to 0.57%, while latent transition retains 83.43% and the combined detector retains that TDR.Both branches achieve 100% TDR for BadVLA in both settings; DropVLA similarly favors latent-transition coverage on unseen tasks.Source: §D.1 · p. 14
  • For all-seen GoBA, combining branches reduces mean latency from 5.2 to 3.12 queries while retaining 95.4% TDR; for all-seen DropVLA, it falls from 9.45 to 2.43 queries while retaining 100% TDR.On unseen tasks, combined GoBA latency matches 0.28 queries, and DropVLA latency is 5.68 versus 6.25 queries; means use detected-rollout subsets that may differ by TDR.Source: §D.1 · p. 14
  • Combining branches can raise observed FRR: all-seen BadVLA reaches 1.6%, versus 1% for token manifold and 0.6% for latent transition.For unseen GoBA, combined FRR rises from 7.43% to 8.57%; for DropVLA, all configurations have zero observed FRR on unseen tasks.Source: §D.1 · pp. 14–15

D.2 EFFECT OF HISTORY CONTEXT

  • Mean-pooled preceding-query history achieves the highest TDR, lowest observed FRR, and shortest latency among the three GoBA history configurations.Both mean-pooled and learnable history slightly improve AUC and TDR over no history; learnable history has higher FRR and longer latency than mean pooling.Source: §D.2 · p. 15, Table 7 · p. 15

D.3 NUMBER OF SCORING TIME POINTS

  • Endpoint and midpoint scoring achieve the same reported AUC across all three attacks at similar cost; two-point scoring raises GoBA AUC from 99.6% to 99.7% but roughly doubles scoring time.Four or eight points add no BadVLA gain and decrease DropVLA AUC.Source: §D.3 · p. 15, Table 8 · p. 15
  • Eight-point scoring costs 27.37 ms versus 3.35 ms for the default, supporting data-endpoint scoring as the efficient default with competitive AUC.Scoring cost grows approximately linearly with the number of evaluations.Source: §D.3 · p. 15

E SIMULATED ATTACK DEMONSTRATIONS

The examples illustrate three distinct simulated attack behaviors and show how TMT selects a transition for subsequent monitoring. Real-world GoBA redirects manipulation, while purification evaluates a student on paired observations.

E SIMULATED ATTACK DEMONSTRATIONS

  • BadVLA disrupts task-directed movement, GoBA redirects manipulation to a toxic box, and DropVLA interrupts an otherwise task-directed trajectory by opening the gripper.The GoBA behavior remains locally coherent despite departing from the instructed goal.Source: E SIMULATED ATTACK DEMONSTRATIONS · p. 16

F DETAIL OF TRANSITION SELECTION

  • TMT fits benign references, uses token-manifold scores to nominate a rollout, confirms it with latent deviations, then selects the significant transition with the largest standardized excess error.That transition stays fixed in subsequent monitoring, including on tasks absent from detector fitting; either branch can independently alarm.Source: F DETAIL OF TRANSITION SELECTION · p. 17

G REAL-WORLD ATTACK DEMONSTRATIONS

  • In the real-world GoBA example, an eggplant trigger redirects the unchanged carrot-and-pot instruction toward grasping and moving an irrelevant knife.The two rows show separate recordings, so their columns are not temporally synchronized.Source: G REAL-WORLD ATTACK DEMONSTRATIONS · p. 17

H BACKDOOR PURIFICATION

  • Purification pairs benign and triggered observations at shared teacher-action-history steps; DropVLA trigger-on inputs also append “carefully” to the instruction.The student controls evaluation rollouts, with benign-input SRs of 91.8%, 94.6%, and 94.4% for BadVLA, GoBA, and DropVLA; malicious-input SRs differ by 0.4, 0.2, and 1.1 percentage points, respectively.Source: H BACKDOOR PURIFICATION · pp. 17–18, Table 9 · p. 18, Figure 6 · p. 19
Loading 2610.09462v1…