论文/arXiv 2609.26131·2 个月前

StepTrigger：针对 VLM 驱动足式机器人的接触状态触发后门攻击

针对VLM足式机器人规划器的隐蔽后门问题，提出StepTrigger用足地接触模式触发，并以分层离线评估验证。

AI 整理

• 本体 SDK 与控制
• 感知与导航
• 具身模型

原文链接：StepTrigger: Contact-State-Triggered Backdoor Attacks on VLM-Powered Legged Robots（arXiv 2609.26131 · 发布日期：2026-08-07）

StepTrigger: Contact-State-Triggered Backdoor Attacks on VLM-Powered Legged Robots

针对VLM足式机器人规划器的隐蔽后门问题，提出StepTrigger用足地接触模式触发，并以分层离线评估验证。

核心要点

• VLM/LLM作为高层规划器时，受损规划器可在隐藏触发出现时改变目标选择。
• StepTrigger不依赖提示词或可见标记，而利用密集地形引发的压力与足地接触模式。
• 方法用多模态机器人状态学习选择性后门，区分偶发压力事件与密集斑块接触。
• 离线分层评估显示干净保持98.75%、拒误触发92.50%、真触发76.25%。

验证范围与局限：验证范围为分层离线评估，触发场景涉及Unitree Go1四足机器人穿越密集地形斑块。

英文摘要 (Abstract)

Large language models and vision-language models are increasingly used as high-level planners in robotic systems, using task goals and sensor summaries to select navigation or manipulation actions. This creates a new backdoor surface: a compromised planner can behave normally in most runs, yet change its target selection when a hidden trigger is present. Prior attacks on LLM-powered or embodied agents mainly rely on triggers that appear in language, camera-visible objects, scene semantics, or specific sequences of past actions. This paper presents StepTrigger, a contact-state-triggered backdoor attack for VLM-powered legged robots. The trigger is not a prompt token or a visible marker. It is produced by pressure and foot-ground contact patterns that arise when a Unitree Go1 quadruped walks across a dense terrain patch. Unlike conventional visual or textual triggers, contact signals are inherently noisy and may also arise during benign locomotion. To avoid treating every pressure anomaly as a trigger, StepTrigger learns a selective backdoor policy from multimodal robot state, using incidental pressure events as benign examples and dense-patch contacts as poisoned examples. In a stratified offline evaluation, the trained planner achieved 98.75% clean behavior preservation, 92.50% false-trigger rejection, 76.25% true-trigger activation, and 89.17% overall parsed behavior accuracy. These results reveal a backdoor surface in proprioceptive and contact channels that is not captured by defenses focused only on language, vision, or action history.

作者：Jiageng Zhang, Doniyorkhon Obidov, Kaichen Yang

来源

本页事实对应的公开页面，以原文为准。

1. arXiv 2609.26131：StepTrigger: Contact-State-Triggered Backdoor Attacks on VLM-Powered Legged Robots访问 2026-10-21