# StepTrigger：针对 VLM 驱动足式机器人的接触状态触发后门攻击

> 原文链接：https://robotics.hellobike.com/papers/2026-08-07-2609-26131
> 频道：papers | 更新日期：2026-08-07 | 标签：arxiv, cs.RO
> 核心摘要：针对VLM足式机器人规划器的隐蔽后门问题，提出StepTrigger用足地接触模式触发，并以分层离线评估验证。

# StepTrigger：针对 VLM 驱动足式机器人的接触状态触发后门攻击

::: v-pre
> 原文链接：[StepTrigger: Contact-State-Triggered Backdoor Attacks on VLM-Powered Legged Robots](https://arxiv.org/abs/2609.26131)（arXiv 2609.26131 · 发布日期：2026-08-07）

**StepTrigger: Contact-State-Triggered Backdoor Attacks on VLM-Powered Legged Robots**

针对VLM足式机器人规划器的隐蔽后门问题，提出StepTrigger用足地接触模式触发，并以分层离线评估验证。

## 核心要点

- VLM/LLM作为高层规划器时，受损规划器可在隐藏触发出现时改变目标选择。
- StepTrigger不依赖提示词或可见标记，而利用密集地形引发的压力与足地接触模式。
- 方法用多模态机器人状态学习选择性后门，区分偶发压力事件与密集斑块接触。
- 离线分层评估显示干净保持98.75%、拒误触发92.50%、真触发76.25%。

**验证范围与局限**：验证范围为分层离线评估，触发场景涉及Unitree Go1四足机器人穿越密集地形斑块。

## 英文摘要 (Abstract)

Large language models and vision-language models are increasingly used as high-level planners in robotic systems, using task goals and sensor summaries to select navigation or manipulation actions. This creates a new backdoor surface: a compromised planner can behave normally in most runs, yet change its target selection when a hidden trigger is present. Prior attacks on LLM-powered or embodied agents mainly rely on triggers that appear in language, camera-visible objects, scene semantics, or specific sequences of past actions. This paper presents StepTrigger, a contact-state-triggered backdoor attack for VLM-powered legged robots. The trigger is not a prompt token or a visible marker. It is produced by pressure and foot-ground contact patterns that arise when a Unitree Go1 quadruped walks across a dense terrain patch. Unlike conventional visual or textual triggers, contact signals are inherently noisy and may also arise during benign locomotion. To avoid treating every pressure anomaly as a trigger, StepTrigger learns a selective backdoor policy from multimodal robot state, using incidental pressure events as benign examples and dense-patch contacts as poisoned examples. In a stratified offline evaluation, the trained planner achieved 98.75% clean behavior preservation, 92.50% false-trigger rejection, 76.25% true-trigger activation, and 89.17% overall parsed behavior accuracy. These results reveal a backdoor surface in proprioceptive and contact channels that is not captured by defenses focused only on language, vision, or action history.

作者：Jiageng Zhang, Doniyorkhon Obidov, Kaichen Yang
:::

## 原始参考来源 (Sources)

- [arXiv 2609.26131：StepTrigger: Contact-State-Triggered Backdoor Attacks on VLM-Powered Legged Robots](https://arxiv.org/abs/2609.26131)