Towards Backdoor-Based Ownership Verification for Vision-Language-Action Models

• URL: http://arxiv.org/abs/2605.09005v1
• Date: Sat, 09 May 2026 15:44:19 GMT
• Title: Towards Backdoor-Based Ownership Verification for Vision-Language-Action Models
• Abstract summary: We present GuardVLA, the first backdoor-based ownership verification framework specifically designed for Vision-Language-Action models (VLAs)<n> GuardVLA embeds a stealthy and harmless backdoor watermark into the protected model during training by injecting secret messages into embodied visual data.<n>For post-release verification, we propose a swap-and-detect mechanism, in which the trigger projector and an external classifier head are used to activate and detect the embedded backdoor.
• Score: 17.76088063187756
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Vision-Language-Action models (VLAs) support generalist robotic control by enabling end-to-end decision policies directly from multi-modal inputs. As trained VLAs are increasingly shared and adapted, protecting model ownership becomes essential for secure deployment and responsible open-source usage. In this paper, we present GuardVLA, the first backdoor-based ownership verification framework specifically designed for VLAs. GuardVLA embeds a stealthy and harmless backdoor watermark into the protected model during training by injecting secret messages into embodied visual data. For post-release verification, we propose a swap-and-detect mechanism, in which the trigger projector and an external classifier head are used to activate and detect the embedded backdoor based on prediction probabilities. Extensive experiments across multiple datasets, model architectures, and adaptation settings demonstrate that GuardVLA enables reliable ownership verification while preserving benign task performance. Further results show that the embedded watermark remains detectable under post-release model adaptation.

Related papers

• Architectural Backdoors in Vision-Language Model Supply Chains via Representation Steering [9.737607721974664]
  Vision--Language Models (VLMs) are increasingly deployed through a model supply chain.<n>In this paper, we show that a malicious provider can exploit this trust boundary by embedding architectural backdoors into VLM supply chains.
  arXiv  Detail & Related papers  (2026-07-28T09:12:11Z)
• TrustVLA: Mechanism-Guided Inference-Time Defense Against Vision-Language-Action Backdoors [54.12833308568015]
  Vision-Language-Action (VLA) models are deployed through pipelines that end users cannot audit.<n>A small visual trigger redirects a long-horizon robot policy before any failure becomes observable.<n>We study this gap through two independently proposed VLA attacks from groups with distinct injection strategies.
  arXiv  Detail & Related papers  (2026-07-14T09:43:52Z)
• VLA-Hijack: A Transferable Patch Attack against Vision-Language-Action Models via Visual Proprioception Hijacking [49.51251398232003]
  VLA-Hijack is a unified adversarial framework for Vision-Language-Action models.<n>It exploits a fundamental vulnerability by exploiting a shared visual self-localization process.<n>It achieves superior optimization efficiency in white-box settings and sets a new SOTA for cross-architecture and cross-domain black-box transferability.
  arXiv  Detail & Related papers  (2026-05-27T07:38:16Z)
• Sentinel-VLA: A Metacognitive VLA Model with Active Status Monitoring for Dynamic Reasoning and Error Recovery [62.75419724651416]
  We introduce textbfSentinel-VLA, a metacognitive VLA model equipped with an active sentinel'' module to monitor real-time execution status.<n>All training data is automatically generated and annotated through our designed pipeline.<n>Real-world experiments demonstrate that Sentinel-VLA boosts the task success rate by over 30% compared to the SOTA model, PI0.
  arXiv  Detail & Related papers  (2026-05-02T02:10:54Z)
• GAVEL: Towards rule-based safety through activation monitoring [2.337566423505956]
  Large language models (LLMs) are increasingly paired with activation-based monitoring to detect and prevent harmful behaviors.<n>Existing activation safety approaches, trained on broad misuse datasets, struggle with poor precision, limited flexibility, and lack of interpretability.<n>This paper introduces a new paradigm: rule-based activation safety, inspired by rule-sharing practices in cybersecurity.
  arXiv  Detail & Related papers  (2026-01-27T16:31:39Z)
• TabVLA: Targeted Backdoor Attacks on Vision-Language-Action Models [63.51290426425441]
  A backdoored VLA agent can be covertly triggered by a pre-injected backdoor to execute adversarial actions.<n>We study targeted backdoor attacks on VLA models and introduce TabVLA, a novel framework that enables such attacks via black-box fine-tuning.<n>Our work highlights the vulnerability of VLA models to targeted backdoor manipulation and underscores the need for more advanced defenses.
  arXiv  Detail & Related papers  (2025-10-13T02:45:48Z)
• Adaptive Attacks on Trusted Monitors Subvert AI Control Protocols [80.68060125494645]
  We study adaptive attacks by an untrusted model that knows the protocol and the monitor model.<n>We instantiate a simple adaptive attack vector by which the attacker embeds publicly known or zero-shot prompt injections in the model outputs.
  arXiv  Detail & Related papers  (2025-10-10T15:12:44Z)
• BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimization [45.97834622654751]
  BadVLA is a backdoor attack method based on Objective-Decoupled Optimization.<n>We show that BadVLA consistently achieves near-100% attack success rates with minimal impact on clean task accuracy.<n>Our work offers the first systematic investigation of backdoor vulnerabilities in VLA models.
  arXiv  Detail & Related papers  (2025-05-22T13:12:46Z)
• PCDiff: Proactive Control for Ownership Protection in Diffusion Models with Watermark Compatibility [23.64920988914223]
  PCDiff is a proactive access control framework that redefines model authorization by regulating generation quality.<n>PCDIFF integrates a trainable fuser module and hierarchical authentication layers into the decoder architecture.
  arXiv  Detail & Related papers  (2025-04-16T05:28:50Z)
• Model Pairing Using Embedding Translation for Backdoor Attack Detection on Open-Set Classification Tasks [63.269788236474234]
  We propose to use model pairs on open-set classification tasks for detecting backdoors. We show that this score, can be an indicator for the presence of a backdoor despite models being of different architectures. This technique allows for the detection of backdoors on models designed for open-set classification tasks, which is little studied in the literature.
  arXiv  Detail & Related papers  (2024-02-28T21:29:16Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.