TrapVLA: Trapping Vision-Language-Action Models in Configured Failure Modes
Abstract Overview
This paper studies a new backdoor attack setting for Vision-Language-Action models called Configured Failure Trapping, where a stealthy textual trigger causes a robot to fail in a specific, preconfigured way rather than simply fail arbitrarily. To support this setting, the authors introduce TrapEngine for synthesizing target trajectories from expert demonstrations and TrapEval for measuring both clean-task preservation and fidelity to the intended failure mode. They instantiate the task with four manipulation failure modes—Early Close, Grasp Deviation, Early Open, and Release Deviation—and build two benchmarks, Trap-LIBERO and Trap-RoboTwin. The proposed attack method, TrapVLA, addresses sparse action deviations by explicitly learning trigger-induced action residuals from paired clean and backdoor trajectories. Experiments are reported in simulation and on a physical robot across OpenVLA-OFT and π0.5 models.
Novelty
The paper's main novelty is shifting VLA backdoor attacks from unconstrained task failure to attacker-controlled, behaviorally plausible failure modes activated only by textual triggers. It also introduces a paired-data residual-learning objective, Target Residual Steering, together with benchmark and evaluation infrastructure tailored to this finer-grained attack setting.
Results
Across Trap-LIBERO, TrapVLA attains the best or near-best overall balance between clean-task success and configured attack success, including the highest AVE on OpenVLA-OFT across all four suites and strong results on π0.5. The method also transfers to harder bimanual RoboTwin tasks and to real-world robot experiments, where it substantially outperforms DropVLA while maintaining clean performance. Overall, the evidence shows that configured failure modes can be reliably injected into VLA models without large degradation on clean instructions.
Key Points
- Configured Failure Trapping defines backdoor attacks that control how a robot fails, using stealthy textual triggers to induce specific temporal or spatial manipulation errors.
- TrapVLA combines standard backdoor training with Target Residual Steering so the model learns localized trigger-induced action deviations instead of treating the trigger as a weak trajectory-wide cue.
- The empirical study includes new Trap-LIBERO and Trap-RoboTwin benchmarks, automated metrics such as C-ASR and AVE, and validation in both simulation and physical robot settings.