mlsanityData to 7 Oct 2026

!Imperio, smolVLA: The Implications of Data Poisoning on Open Source Robotics

arXiv 2607.04146 ↗First posted 5 Jul 2026cs.RO cs.AI cs.CLcited by 0

On the map: LLM safety and security → Prompt injection and agent security

Abstract (arXiv)

This work establishes that trigger-word data poisoning of vision language action models is practical, while at the same time the open-source robotics ecosystem holds trust assumptions about community contributions. A few poisoned samples can silently embed a backdoor that disables a robot on command. We evaluate this threat against smolVLA on a real-world pick-and-place task, training on three poison ratios and evaluating across different prompts on the LeRobot platform. Three poisoned episodes in 320 clean episodes suffice for a complete denial of service. Success rate drops to 0.0 plus minus 0.0% across all trigger-word conditions and the robot locks into a fixed joint configuration rather than executing any task-relevant motion. Clean-prompt behaviour holds at approx. 50% success rate across all poison ratios, confirming the attack is stealthy under normal operation. A single poisoned episode already reduces success rate to 6.7 plus minus 6.7%. The robot still moves, but no longer completes the task. The attack generalises to front, middle, and end trigger placements despite training exclusively on front-placed triggers. These findings establish that the threat is practical, low-cost, and stealthy, and warrant treating dataset provenance as a first-class concern in open-source robotics ecosystems.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security. Builds on 14 of its 19 references that are in the map. First posted on arXiv 5 Jul 2026.

Builds on

14 of 19 references.

Closest ancestors · 2

Same direction, newest first

  1. 2025AttackVLA: Benchmarking Adversarial and Backdoor Attacks on Vision-Language-Action Models15 Nov
  2. 2025BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimization22 May

Other references · 12

  1. 2023RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Controlcited by 2,993
  2. 2024OpenVLA: An Open-Source Vision-Language-Action Modelcited by 2,777
  3. 2024Octo: An Open-Source Generalist Robot Policycited by 1,427
  4. 2025SmolVLA: A Vision-Language-Action Model for Affordable and Efficient Roboticscited by 507
  5. 2019Hidden Trigger Backdoor Attackscited by 359
  6. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
  7. 2023Poisoning Language Models During Instruction Tuningcited by 254
  8. 2025Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samplescited by 66
  9. 2025MCPTox: A Benchmark for Tool Poisoning Attack on Real-World MCP Serverscited by 63
  10. 2024Assessing Political Bias in Large Language Modelscited by 32
  11. 2025Silent Branding Attack: Trigger-free Data Poisoning Attack on Text-to-Image Diffusion Modelscited by 11
  12. 2025Virus Infection Attack on LLMs: Your Poisoning Can Spread "VIA" Synthetic Datacited by 2

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025DropVLA: An Action-Level Backdoor Attack on Vision-Language-Action Models
  2. 2026TrapVLA: Trapping Vision-Language-Action Models in Configured Failure Modes
  3. 2026Targeting World Models to Compromise Robot Learning Pipelines
  4. 2026State Backdoor: Towards Stealthy Real-world Poisoning Attack on Vision-Language-Action Model in State Space
  5. 2025Phantom Menace: Exploring and Enhancing the Robustness of VLA Models Against Physical Sensor Attacks
  6. 2025Adversarial Attacks on Robotic Vision Language Action Models
  7. 2025Trust in LLM-controlled Robotics: a Survey of Security Threats, Defenses and Challenges
  8. 2026Beyond Attack Success Rate: Examining Trigger Leakage in Vision-Language Agentic Systems