StepTrigger：针对 VLM 驱动足式机器人的接触状态触发后门攻击

View PDF HTML (experimental)

Abstract:Large language models and vision-language models are increasingly used as high-level planners in robotic systems, using task goals and sensor summaries to select navigation or manipulation actions. This creates a new backdoor surface: a compromised planner can behave normally in most runs, yet change its target selection when a hidden trigger is present. Prior attacks on LLM-powered or embodied agents mainly rely on triggers that appear in language, camera-visible objects, scene semantics, or specific sequences of past actions. This paper presents StepTrigger, a contact-state-triggered backdoor attack for VLM-powered legged robots. The trigger is not a prompt token or a visible marker. It is produced by pressure and foot-ground contact patterns that arise when a Unitree Go1 quadruped walks across a dense terrain patch.
Unlike conventional visual or textual triggers, contact signals are inherently noisy and may also arise during benign locomotion. To avoid treating every pressure anomaly as a trigger, StepTrigger learns a selective backdoor policy from multimodal robot state, using incidental pressure events as benign examples and dense-patch contacts as poisoned examples. In a stratified offline evaluation, the trained planner achieved 98.75% clean behavior preservation, 92.50% false-trigger rejection, 76.25% true-trigger activation, and 89.17% overall parsed behavior accuracy. These results reveal a backdoor surface in proprioceptive and contact channels that is not captured by defenses focused only on language, vision, or action history.

Subjects:	Robotics (cs.RO); Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR)
Cite as:	arXiv:2609.26131 [cs.RO]
	(or arXiv:2609.26131v2 [cs.RO] for this version)
	https://doi.org/10.48550/arXiv.2609.26131 arXiv-issued DOI via DataCite

Submission history

From: Doniyorkhon Obidov [view email]
[v1] Fri, 7 Aug 2026 04:58:35 UTC (198 KB)
[v2] Sat, 24 Oct 2026 21:00:11 UTC (198 KB)