仅3个有毒数据就能让机器人彻底瘫痪，且难以察觉。
!Imperio, smolVLA: The Implications of Data Poisoning on Open Source Robotics
- 用触发词污染少量数据，植入隐蔽后门
- 3个毒样本即可使任务成功率降为0%
- 攻击隐蔽且泛化性强，适合开源机器人生态
本研究证实，对视觉语言动作模型进行触发词数据投毒是可行的，而开源机器人生态普遍信任社区贡献。少量中毒样本可悄然植入后门，使机器人按指令瘫痪。我们在LeRobot平台上的真实抓放任务中评估了smolVLA模型，训练使用三种投毒比例，测试不同提示词条件。在320个正常数据中仅需3个中毒序列，即导致完全拒绝服务：所有触发词条件下成功率降至0.0±0.0%，机器人锁定于固定关节状态，无法执行任何任务动作。正常提示下的表现仍保持约50%成功率，说明攻击在常规操作下隐蔽。单个中毒样本即使成功率降至6.7±6.7%，机器人仍能移动但无法完成任务。该攻击即使仅在前部触发词训练，也泛化至前、中、后部触发位置。结果表明该威胁具有实用性、低成本和隐蔽性，必须将数据来源可信度视为开源机器人生态的核心关切。
原文摘要 · Abstract (English)
This work establishes that trigger-word data poisoning of vision language action models is practical, while at the same time the open-source robotics ecosystem holds trust assumptions about community contributions. A few poisoned samples can silently embed a backdoor that disables a robot on command. We evaluate this threat against smolVLA on a real-world pick-and-place task, training on three poison ratios and evaluating across different prompts on the LeRobot platform. Three poisoned episodes in 320 clean episodes suffice for a complete denial of service. Success rate drops to 0.0 plus minus 0.0% across all trigger-word conditions and the robot locks into a fixed joint configuration rather than executing any task-relevant motion. Clean-prompt behaviour holds at approx. 50% success rate across all poison ratios, confirming the attack is stealthy under normal operation. A single poisoned episode already reduces success rate to 6.7 plus minus 6.7%. The robot still moves, but no longer completes the task. The attack generalises to front, middle, and end trigger placements despite training exclusively on front-placed triggers. These findings establish that the threat is practical, low-cost, and stealthy, and warrant treating dataset provenance as a first-class concern in open-source robotics ecosystems.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。