Search papers, labs, and topics across Lattice.
This study reveals that trigger-word data poisoning can effectively compromise vision language action models in open-source robotics, specifically targeting the smolVLA model during a pick-and-place task. By embedding a backdoor through as few as three poisoned samples among 320 clean episodes, the researchers demonstrated a complete denial of service, with success rates plummeting to 0% under poisoned conditions. The attack's stealthiness is underscored by the fact that clean-prompt behavior remains relatively unaffected, indicating a critical vulnerability in the trust assumptions of community-contributed datasets.
A mere three poisoned samples can render a robot completely non-functional, highlighting a severe vulnerability in open-source robotics.
This work establishes that trigger-word data poisoning of vision language action models is practical, while at the same time the open-source robotics ecosystem holds trust assumptions about community contributions. A few poisoned samples can silently embed a backdoor that disables a robot on command. We evaluate this threat against smolVLA on a real-world pick-and-place task, training on three poison ratios and evaluating across different prompts on the LeRobot platform. Three poisoned episodes in 320 clean episodes suffice for a complete denial of service. Success rate drops to 0.0 plus minus 0.0% across all trigger-word conditions and the robot locks into a fixed joint configuration rather than executing any task-relevant motion. Clean-prompt behaviour holds at approx. 50% success rate across all poison ratios, confirming the attack is stealthy under normal operation. A single poisoned episode already reduces success rate to 6.7 plus minus 6.7%. The robot still moves, but no longer completes the task. The attack generalises to front, middle, and end trigger placements despite training exclusively on front-placed triggers. These findings establish that the threat is practical, low-cost, and stealthy, and warrant treating dataset provenance as a first-class concern in open-source robotics ecosystems.
