What it is
This risk covers hidden triggers planted at training or fine-tuning time, or shipped inside a poisoned open-weights checkpoint, dataset, teleop log, or RAG corpus. The policy behaves normally until a benign-looking trigger object or phrase fires an attacker-chosen action.
It is near-invisible in normal evaluation, persistent (BadVLA survives fine-tuning), and triggerable on demand — poison once, ship everywhere. The open VLA hub ecosystem (OpenVLA / π0 / GR00T) is a direct supply-chain surface.
Seen in the wild
BadVLA (arXiv:2505.16640) plants a backdoor that survives fine-tuning; TrojanRobot (arXiv:2411.11683) demonstrated a physical-world backdoor via a malicious VLM, validated on a UR3e arm. Provael does not train or implant a real backdoor — it screens a candidate checkpoint for one, which is the honest thing a red-teamer can do pre-deployment.
Attack, measure, prove
- Ships the `backdoor` family (object_trigger + phrase_trigger) as a pre-deployment backdoor screen: it injects a battery of harmless, sim-only candidate triggers while keeping the visible task benign, and measures whether the policy activates a hidden objective.
- Each candidate is scored as an activation rate with a 95% Wilson CI against a benign-FPR control (the `none` baseline). Provael screens a checkpoint; it never plants a real backdoor.
- Stub-validated only: the deterministic CPU core is planted with a known trigger, so the screen fires 100% [84–100%] vs a 0% benign baseline; a clean public checkpoint carries no implant, so the same screen reads ~0% — an honest null. Real SmolVLA×LIBERO transfer is GPU-gated and not yet run — no cross-model claim.
What reduces the risk
- Verify checkpoint and dataset provenance; prefer signed/attested weights and pin hashes.
- Run backdoor / trigger probes pre-deploy and re-scan every fine-tune.
- Treat third-party data and RAG corpora as untrusted.
How it shows up in CI
Every finding for this risk carries a stable rule id in the SARIF report — the Embodied AI Top-10 id itself:
Crosswalk
- OWASP
- ASI04 Agentic Supply Chain · LLM03 Supply Chain · LLM04 Data & Model Poisoning
- MITRE ATLAS
- ML Supply Chain Compromise → poison checkpoint; Persistence → backdoor model
- Frameworks
- NIST AI 100-2 — Poisoning / Supply-chain
See the full framework crosswalk for dates and detail. Not legal advice.