FlowHijack: A Dynamics-Aware Backdoor Attack Against Flow-Matching Vision-Language-Action Models

The researchers propose FlowHijack, a backdoor attack framework targeting the vector field dynamics of flow-matching vision-language-action models. The method uses a τ-conditional injection strategy to manipulate the initial stage of action generation and adds a dynamic imitation regularization term. Experiments show that under stealthy contextual triggers where prior methods struggle to be effective, FlowHijack achieves a high attack success rate. It simultaneously maintains normal task performance and, by constraining kinematic similarity, makes malicious actions behaviorally difficult to distinguish from normal actions. The authors accordingly point out that continuous embodied models have significant vulnerabilities and require defenses targeting the model's internal generation dynamics.