mlsanityData to 7 Oct 2026

TrustVLA: Mechanism-Guided Inference-Time Defense Against Vision-Language-Action Backdoors

arXiv 2607.12571 ↗First posted 14 Jul 2026cs.ROcited by 0

On the map: Vision-language-action models → Safety and adversarial attacks

Abstract (arXiv)

Vision-Language-Action (VLA) models are deployed through pipelines that end users cannot audit, and a poisoned VLA can behave normally on clean observations while a small visual trigger redirects a long-horizon robot policy before any failure becomes observable. Existing vision or language defenses rarely explain what a triggered VLA representation looks like or how to recover behavior without retraining. We study this gap through two independently proposed VLA attacks from groups with distinct injection strategies, BadVLA and INFUSE; the latter persists after downstream clean adaptation. Across the evaluated poisoned models, we identify a recurring internal mechanism: a compact causal footprint, namely a small visual support that is attention-seeded, spatially compact, and causal in a precise sense -- masking it returns a clean-calibrated evidence-evolution score to the normal operating region. This footprint motivates TrustVLA, a mechanism-guided inference-time defense that adapts the Dirichlet evidence framework from trusted classification to monitor per-token, per-layer epistemic uncertainty in VLA policies. With only a small clean calibration set, TrustVLA (i)~detects abnormal evidence evolution, (ii)~localizes the compact support by counterfactual mechanism-score drop, and (iii)~recovers the observation by localized inpainting. Across OpenVLA/LIBERO and π0.5 transfer evaluations, TrustVLA reduces attack success while preserving clean-task performance, providing a retraining-free, mechanism-guided defense for visual-triggered VLA backdoors.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Safety and adversarial attacks, one of 13 directions in Vision-language-action models. Builds on 29 of its 34 references that are in the map. First posted on arXiv 14 Jul 2026.

Builds on

29 of 34 references.

Closest ancestors · 2

Same direction, newest first

  1. 2026Inject Once Survive Later: Backdooring Vision-Language-Action Models to Persist Through Downstream Fine-tuning31 Jan
  2. 2025SafeVLA: Towards Safety Alignment of Vision-Language-Action Model via Constrained Learning5 Mar

Other references · 27

  1. 2023RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Controlcited by 2,993
  2. 2023Diffusion Policy: Visuomotor Policy Learning via Action Diffusioncited by 2,730
  3. 2025π0.5: a Vision-Language-Action Model with Open-World Generalizationcited by 1,653
  4. 2023LIBERO: Benchmarking Knowledge Transfer for Lifelong Robot Learningcited by 1,338
  5. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  6. 2023Foundation Models in Robotics: Applications, Challenges, and the Futurecited by 212
  7. 2023RH20T: A Comprehensive Robotic Dataset for Learning Diverse Skills in One-Shotcited by 173
  8. 2022Trusted Multi-View Classification with Dynamic Evidential Fusioncited by 167
  9. 2024VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Modelscited by 83
  10. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trendscited by 82
  11. 2023DiffusionDepth: Diffusion Denoising Approach for Monocular Depth Estimationcited by 81
  12. 2025A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluationscited by 66
15 more
  1. 2023BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIPcited by 63
  2. 2023CleanCLIP: Mitigating Data Poisoning Attacks in Multimodal Contrastive Learningcited by 62
  3. 2022Robustness of Learning from Task Instructionscited by 34
  4. 2025Backdoor Cleaning without External Guidance in MLLM Fine-tuningcited by 34
  5. 2023OpenStereo: A Comprehensive Benchmark for Stereo Matching and Strong Baselinecited by 28
  6. 2024LightStereo: Channel Boost Is All You Need for Efficient 2D Cost Aggregationcited by 28
  7. 2024Safety Alignment for Vision Language Modelscited by 27
  8. 2025Estimating LLM Uncertainty with Evidencecited by 26
  9. 2022Friendly Noise against Adversarial Noise: A Powerful Defense against Data Poisoning Attackscited by 20
  10. 2025Backdoor Attack on Vision Language Models with Stealthy Semantic Manipulationcited by 13
  11. 2021Test-Time Detection of Backdoor Triggers for Poisoned Deep Neural Networkscited by 10
  12. 2024BadCM: Invisible Backdoor Attack Against Cross-Modal Learningcited by 9
  13. 2025Detoxifying Large Language Models via Autoregressive Reward Guided Representation Editingcited by 9
  14. 2025BadRefSR: Backdoor Attacks Against Reference-based Image Super Resolutioncited by 6
  15. 2024Test-Time Multimodal Backdoor Detection by Contrastive Promptingcited by 5

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025AttackVLA: Benchmarking Adversarial and Backdoor Attacks on Vision-Language-Action Models
  2. 2026Vision-Language-Action Safety: Threats, Challenges, Evaluations, and Mechanisms
  3. 2025DropVLA: An Action-Level Backdoor Attack on Vision-Language-Action Models
  4. 2026Concept-Based Dictionary Learning for Inference-Time Safety in Vision Language Action Models
  5. 2026VLALeaks: Membership Inference Attacks against Vision-Language-Action Models
  6. 2025BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimization
  7. 2025Do What? Teaching Vision-Language-Action Models to Reject the Impossible
  8. 2026State Backdoor: Towards Stealthy Real-world Poisoning Attack on Vision-Language-Action Model in State Space