State Backdoor: A Stealthy Real-World Poisoning Attack on the State Space of Vision-Language-Action (VLA) Models

The researchers propose a backdoor attack against vision-language-action (VLA) models, State Backdoor, which uses the robot arm's initial state as the trigger and achieves an attack success rate exceeding 90% on five representative VLA models and five real-world tasks without affecting normal task performance. To address the problem that existing backdoor methods mainly insert visible triggers in the visual modality and have poor robustness in real-world scenarios due to environmental variability, the authors design a preference-guided genetic algorithm (PGA) that searches the state space for minimal but effective triggers, balancing interference resistance and attack effectiveness. The authors state that this attack reveals a previously underexplored security vulnerability in embodied intelligence systems.