FlowHijack: A Dynamics-Aware Backdoor Attack on Flow-Matching Vision-Language-Action Models¶

🕒 Published (v1): 2026-03-30 03:54 UTC · Source: Arxiv · Venue: CVPR 2026 · link

Why this paper was selected

CVPR 2026; first backdoor attack targeting flow-matching VLA models like π0

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

TL;DR¶

FlowHijack is the first backdoor attack framework targeting flow-matching Vision-Language-Action (VLA) models by corrupting their underlying vector-field dynamics rather than discrete token outputs. The attack exploits the ODE integration process via a $\tau$-conditioned injection that manipulates only the early phase of action generation, with a dynamics mimicry regularizer ensuring kinematic indistinguishability from benign actions. It achieves up to 100% attack success rate on LIBERO benchmarks while preserving normal task performance and evading existing defenses.

Problem¶

Existing backdoor attacks (e.g., BadVLA) were designed for token-based, autoregressive VLAs (e.g., RT-1/2, OpenVLA) and cannot transfer to flow-matching VLAs like $\pi_0$. Three gaps are identified: (1) token-level manipulations (label flipping, token substitution) do not affect continuous ODE-governed action generation; (2) prior triggers are visually conspicuous pixel patches, easily detectable in physical environments; (3) existing attacks produce kinematically anomalous vector fields with statistically detectable divergence from normal motion profiles.

Method¶

Flow-matching formulation. The target policy $v_\theta(A^\tau_t, o_t, \tau)$ generates actions by solving $\frac{dA^\tau}{d\tau} = v_\theta(A^\tau, o_t, \tau)$ from $A^0 \sim \mathcal{N}(0, I)$. Noisy actions are interpolated as $A^\tau_t = \tau A_t + (1-\tau)\varepsilon$, and the standard CFM loss is $\mathcal{L}_\text{FM} = \mathbb{E}\|v_\theta(A^\tau_t, o_t, \tau) - (A_t - \varepsilon)\|_2^2$.

$\tau$-Conditioned Injection. FlowHijack restricts the backdoor loss to $\tau \in [0, \tau_0]$ (with $\tau_0 = 0.4$), exploiting the fact that $\pi_0$ oversamples small $\tau$ (via a Beta distribution): $$\mathcal{L}_\text{BD} = \mathbb{E}_{(o^+, A^\star) \sim D_\text{poison},\ \tau \sim U[0, \tau_0]} \|v_\theta(A^\tau, o^+, \tau) - (A^\star - \varepsilon)\|_2^2$$ Because the ODE integrator amplifies an early directional error over the full trajectory, a small injection in the $[0, \tau_0]$ window produces large final-action deviation.

Dynamics Mimicry Regularizer. To prevent kinematically anomalous outputs, $\mathcal{L}_\text{mimic}$ matches the L2-norm of the malicious vector field to that of the benign field (stop-gradient on the benign side), forcing directional hijacking without changing motion speed/intensity: $$\mathcal{L}_\text{mimic} = \mathbb{E}_\tau \bigl[\|v_\theta(A^\tau, o^+)\|_2 - \|v_\theta(A^\tau, o)\|_2^\text{sg}\bigr]^2$$

Malicious action strategies. (1) Pose-Locking (PL): $A^\star = A_\text{const}$, forcing the robot to a fixed pose; (2) Initial-Perturbation (IP): $A^\star = A + \delta_A$, adding a constant offset that ODE integration amplifies into consistent grasp/alignment failures.

Context-aware triggers. Two visual trigger classes: Object State (e.g., inverted cup tied to a scene predicate) and Scene Semantic (background object injection, e.g., a potted plant or person with a watch). Both are semantically plausible and human-imperceptible.

Total loss: $\mathcal{L}_\text{total} = (1 - \alpha - \beta)\mathcal{L}_\text{FM} + \alpha \mathcal{L}_\text{BD} + \beta \mathcal{L}_\text{mimic}$, with $\alpha = \beta = 0.05$.

Key Contributions¶

First systematic study of backdoor threats targeting flow-matching VLAs, identifying vector-field dynamics as a novel attack surface distinct from token-level manipulation.
$\tau$-conditioned injection strategy exploiting the "early injection, full-path amplification" property of ODE-based action generation.
Dynamics Mimicry Regularizer enforcing kinematic similarity between malicious and benign vector fields to evade behavioral detection.
Two context-aware trigger classes (Object State, Scene Semantic) that are semantically embedded and elude manual inspection.
Demonstration that the attack bypasses two existing defenses: target position filtering and downstream clean fine-tuning.

Results¶

Baseline comparisons on LIBERO (π0 target, 4 task suites) against BadVLA:
White Pixel trigger: FlowHijack (PL) achieves 100% ASR on Libero-10 and Libero-Object with SR degradation $\leq 3.2\%$ vs. baseline; BadVLA reaches 95–100% ASR but with greater SR loss (72.9% vs. 85.2% baseline on Libero-10).
Object State trigger: BadVLA collapses to 11.2% ASR on Libero-Goal and 13.4% ASR on Libero-Spatial; FlowHijack (PL) achieves 100% ASR on both, SR degradation $\leq 1.8\%$.
Scene Semantic trigger: BadVLA collapses to 11.7–15.3% ASR across suites; FlowHijack (PL/IP) achieves 97.8–100% ASR, SR degradation $\leq 6.1\%$.
Ablation (Initial-Perturbation on LIBERO, Object State trigger):
Removing $\mathcal{L}_\text{FM}$: SR drops to 0% (model collapses).
Removing $\mathcal{L}_\text{BD}$: ASR drops to 66.7–73.3% on contested suites.
Removing $\mathcal{L}_\text{mimic}$: ASR stays high but vector-field distributions become statistically separable (detectable).
Full method: up to 100% ASR with overlapping benign/malicious vector-field feature distributions.

Limitations¶

White-box, fine-tuning poisoning threat model assumed; applicability to black-box or inference-only settings is not addressed.
Attack success rate with stealthy triggers on Libero-Object and Libero-Spatial is lower (66.7–91.1%) than with conspicuous pixel triggers (88.9–100%), indicating context-aware triggers are harder to learn.
Evaluated only on LIBERO simulation (4 suites) and one real-world Franka platform; generalization to other robot morphologies or closed-source VLAs is unverified.
No certified defense is proposed; robustness testing against adaptive defenses is limited to target-position filtering and clean fine-tuning.
Dynamics Mimicry Regularizer is constrained to L2-norm matching; higher-order kinematic statistics (jerk, curvature) are not explicitly enforced.

Relevance to Vision-Language Models¶

FlowHijack exposes a security blindspot specific to VLMs that are extended with continuous action heads via flow matching — an architecture increasingly central to embodied AI (e.g., $\pi_0$, diffusion policy). The finding that BadVLA's feature-space separation strategy fails catastrophically against context-aware triggers reveals that the generalization properties of strong VLM backbones (semantic invariance to minor object-state changes) are paradoxically protective against certain backdoor objectives, while the downstream dynamics module remains exposed. This has implications for VLM robustness research: security analyses must account for the full action-generation pipeline, not just the vision-language encoder. The work motivates dynamics-aware defenses (anomaly detection on vector-field statistics, certified robustness for ODEs) as a new research direction for the VLM-for-robotics community.

BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimization