Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces TrustVLA, a novel defense mechanism against Vision-Language-Action (VLA) backdoors that leverages a compact causal footprint to monitor and recover from attacks without the need for retraining. By adapting the Dirichlet evidence framework, TrustVLA effectively detects abnormal evidence evolution and localizes visual triggers through counterfactual analysis. The results demonstrate that TrustVLA significantly reduces attack success rates while maintaining performance on clean tasks across various evaluations, marking a substantial advancement in VLA model safety.
TrustVLA can detect and recover from VLA backdoors with minimal clean data, all while preserving normal task performance.
Vision-Language-Action (VLA) models are deployed through pipelines that end users cannot audit, and a poisoned VLA can behave normally on clean observations while a small visual trigger redirects a long-horizon robot policy before any failure becomes observable. Existing vision or language defenses rarely explain what a triggered VLA representation looks like or how to recover behavior without retraining. We study this gap through two independently proposed VLA attacks from groups with distinct injection strategies, BadVLA and INFUSE; the latter persists after downstream clean adaptation. Across the evaluated poisoned models, we identify a recurring internal mechanism: a \emph{compact causal footprint}, namely a small visual support that is attention-seeded, spatially compact, and \emph{causal} in a precise sense -- masking it returns a clean-calibrated evidence-evolution score to the normal operating region. This footprint motivates TrustVLA, a mechanism-guided inference-time defense that adapts the Dirichlet evidence framework from trusted classification to monitor per-token, per-layer epistemic uncertainty in VLA policies. With only a small clean calibration set, TrustVLA (i)~detects abnormal evidence evolution, (ii)~localizes the compact support by counterfactual mechanism-score drop, and (iii)~recovers the observation by localized inpainting. Across OpenVLA/LIBERO and $\pi_{0.5}$ transfer evaluations, TrustVLA reduces attack success while preserving clean-task performance, providing a retraining-free, mechanism-guided defense for visual-triggered VLA backdoors.