Elamur Research⌕
☰
home / papers / 2026 / SilentDrift: Exploiting Action Chunking for Stealthy Backdoor Attacks on Vision-Language-Action Models

SilentDrift: Exploiting Action Chunking for Stealthy Backdoor Attacks on Vision-Language-Action Models

Paper · 2026 · Bingxin Xu, Yuzhang Shang, Binghui Wang et al.

Summary

The paper exposes a security weakness in modern Vision-Language-Action (VLA) robot policies. When a model predicts a chunk of K future actions as relative (delta pose) movements, the robot carries out the whole chunk without visual correction. This intra-chunk open loop lets small per-step errors add up into a large positional drift. The authors build SilentDrift, a black-box data-poisoning backdoor that exploits this. In poisoned demonstrations, the trigger appears only during the final approach to the target (a keyframe strategy). The injected offset is shaped with the Smootherstep quintic polynomial, so it starts and ends with zero velocity and acceleration (C2 continuity). Earlier VLA backdoors such as BadVLA, GoBA and TabVLA cause abrupt, visible failures. SilentDrift instead produces a natural-looking near-miss that passes dynamics-based trajectory filters and human review. On LIBERO, with π0 and VLA-Adapter, the attack succeeds most of the time with very little poisoned data and leaves clean behaviour intact. The authors argue that architectures using large chunks are inherently more exposed and need new defenses.

Key points

  • Main result on LIBERO: 93.2% Attack Success Rate (ASR) with under 2% poisoned data (about one poisoned episode per task), while Clean Task Success Rate stays at 95.3%.
  • Drift scales roughly linearly with chunk size (‖E_accum‖ ≈ K·‖δ̄‖). For example, a 1 mm per-step offset becomes about 5 cm over a K = 50 chunk.
  • Ablations on chunk size:
    • Switching from K = 1 to K = 4 sharply increases ASR.
    • Larger chunks increase it further, but gains level off because LIBERO tasks have short horizons.
  • Ablations on attack timing and shape:
    • Triggering only near the target matches full-trajectory triggering, unless activation is very late (0.05 m), which leaves too little time for drift to build up.
    • Smootherstep is as effective as constant-offset and Smoothstep perturbations, so stealth does not reduce attack strength.
  • Trigger robustness: colour and size (3–10 px) barely affect ASR. Opacity matters more: ASR is 86.7% at α = 0.3 and 95.6% at α = 1.0.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓University of Southern CaliforniaLos Angeles · United States175 works · 37,050 citations🎓Illinois Institute of TechnologyChicago · United States18 works · 2,097 citations🎓University of Central FloridaOrlando · United States15 works · 39,739 citations

 Fields, topics and concepts

📚 Shelves 3The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksSoftware · 119 works

🧭 Topics 1Research subjects and languages the work is about.Vision & language · 811 works

Cite

Cite as Bingxin Xu, Yuzhang Shang, Binghui Wang and Emilio Ferrara. 2026. SilentDrift: Exploiting Action Chunking for Stealthy Backdoor Attacks on Vision-Language-Action Models. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.1725

@inproceedings{xu2026silentdrift,
  title = {{SilentDrift: Exploiting Action Chunking for Stealthy Backdoor Attacks on Vision-Language-Action Models}},
  author = {Bingxin Xu, Yuzhang Shang, Binghui Wang and Emilio Ferrara},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.1725},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.1725}
}

References

34 references, 3 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Karl Johan Åström and Richard M. Murray. 2008. Feedback Systems: An Introduction for Scientists and Engineers. Princeton University Press. find
  2. Jiawang Bai, Kuofeng Gao, Shaobo Min, Shu-Tao Xia, Zhifeng Li, and Wei Liu. 2024. Badclip: Trigger-aware prompt learning for backdoor attacks on clip. In CVPR. find
  3. Luigi Biagiotti and Claudio Melchiorri. 2008. Trajectory planning for automatic machines and robots. Springer. find
  4. Johan Bjorck, Fernando Castañeda, Nikita Cherniadev, Xingye Da, Runyu Ding, Linxi Fan, Yu Fang, Dieter Fox, Fengyuan Hu, Spencer Huang, et al. 2025. Gr00t n1: An open foundation model for generalist humanoid robots. arXiv preprint arXiv:2503.14734. find
  5. Kevin Black, Noah Brown, Danny Driess, Adnan Esmail, Michael Equi, Chelsea Finn, Niccolo Fusai, Lachy Groom, Karol Hausman, Brian Ichter, et al. 2024. pi0: A vision-language-action flow model for general robot control. arXiv preprint arXiv:2410.24164. find
  6. Bryant Chen, Wilka Carvalho, Nathalie Baracaldo, Heiko Ludwig, Benjamin Edwards, Taesung Lee, Ian Molloy, and Biplav Srivastava. 2018. Detecting backdoor attacks on deep neural networks by activation clustering. arXiv preprint arXiv:1811.03728. — [arXiv:1811.03728](https://arxiv.org/abs/1811.03728) find
  7. Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. 2017. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526. find
  8. Cheng Chi, Zhenjia Xu, Siyuan Feng, Eric Cousineau, Yilun Du, Benjamin Burchfiel, Russ Tedrake, and Shuran Song. 2025. Diffusion policy: Visuomotor policy learning via action diffusion. IJRR.
  9. Danny Driess, Fei Xia, Mehdi SM Sajjadi, Corey Lynch, Aakanksha Chowdhery, Ayzaan Wahid, Jonathan Tompson, Quan Vuong, Tianhe Yu, Wenlong Huang, et al. 2023. Palm-e: An embodied multimodal language model. find
  10. Tamar Flash and Neville Hogan. 1985. The coordination of arm movements: an experimentally confirmed mathematical model. Journal of neuroscience, 5(7):1688–1703. find
  11. Dibya Ghosh, Homer Walke, et al. 2024. Octo: An open-source generalist robot policy. arXiv preprint arXiv:2405.12213. find
  12. Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. BadNets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733.
  13. Moo Jin Kim, Chelsea Finn, and Percy Liang. 2025. Fine-tuning vision-language-action models: Optimizing speed and success. arXiv preprint arXiv:2502.19645. find
  14. Moo Jin Kim, Karl Pertsch, Siddharth Karamcheti, Ted Xiao, Ashwin Balakrishna, Suraj Nair, Rafael Rafailov, Ethan Foster, Grace Lam, Pannag Sanketi, et al. 2024. Openvla: An open-source vision-language-action model. arXiv preprint arXiv:2406.09246. find
  15. James Kirkpatrick, Razvan Pascanu, Neil Rabinowitz, Joel Veness, Guillaume Desjardins, Andrei A Rusu, Kieran Milan, John Quan, Tiago Ramalho, Agnieszka Grabska-Barwinska, et al. 2017. Overcoming catastrophic forgetting in neural networks. PNAS. find
  16. Steven M. LaValle. 2006. Planning Algorithms. Cambridge University Press, Cambridge, UK. find
  17. Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. 2024. Backdoor learning: A survey. TNNLS. find
  18. Bo Liu, Yifeng Zhu, Chongkai Gao, Yihao Feng, Qiang Liu, Yuke Zhu, and Peter Stone. 2023a. Libero: Benchmarking knowledge transfer for lifelong robot learning. NeurIPS. find
  19. Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. 2023b. Visual instruction tuning. In NeurIPS.
  20. Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. 2018. Trojaning attack on neural networks. In NDSS. find
  21. Weimin Lyu, Lu Pang, Tengfei Ma, Haibin Ling, and Chao Chen. 2024. TrojVLM: Backdoor attack against vision language models. In ECCV. find
  22. Open X-Embodiment Collaboration. 2024. Open X-Embodiment: Robotic learning datasets and RT-X models. In ICRA. find
  23. Ken Perlin. 2002. Improving noise. In ACM SIG-GRAPH 2002 Proceedings. find
  24. Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. 2018. Poison frogs! targeted clean-label poisoning attacks on neural networks. In NeurIPS. find
  25. Physical Intelligence Team. 2025. π 0.5 : A vision-language-action model with open-world generalization. arXiv preprint arXiv:2504.16054. find
  26. Brandon Tran, Jerry Li, and Aleksander Madry. 2018. Spectral signatures in backdoor attacks. In NeurIPS. find
  27. Lirui Wang, Xinlei Chen, Jialiang Zhao, and Kaiming He. 2024. Scaling proprioceptive-visual learning with heterogeneous pre-trained transformers. In NeurIPS. find
  28. Yihao Wang, Pengxiang Ding, Lingxiao Li, Can Cui, Zirui Ge, Xinyang Tong, Wenxuan Song, Han Zhao, Wei Zhao, Pengxu Hou, et al. 2025. VLA-Adapter: An effective paradigm for tiny-scale vision-language-action model. arXiv preprint arXiv:2509.09372. find
  29. Zonghuan Xu, Xiang Zheng, Xingjun Ma, and Yu-Gang Jiang. 2025. TabVLA: Targeted backdoor attacks on vision-language-action models. arXiv preprint arXiv:2510.10932. — [arXiv:2510.10932](https://arxiv.org/abs/2510.10932) find
  30. Philipp Zech, Erwan Renaudo, Simon Haller, Xiang Zhang, and Justus Piater. 2019. Action representations in robotics: A taxonomy and systematic classification. IJRR. find
  31. Tony Z Zhao, Vikash Kumar, Sergey Levine, and Chelsea Finn. 2023. Learning fine-grained bimanual manipulation with low-cost hardware. In RSS. ArXiv:2304.13705. find
  32. Xueyang Zhou, Guiyao Tie, Guowen Zhang, Hechang Wang, Pan Zhou, and Lichao Sun. 2025a. BadVLA: Towards backdoor attacks on vision-language-action models via objective-decoupled optimization. In NeurIPS. find
  33. Zirun Zhou, Zhengyang Xiao, Haochuan Xu, Jing Sun, Di Wang, and Jingfeng Zhang. 2025b. GoBA: Goal-oriented backdoor attack against vision-language-action models via physical objects. arXiv preprint arXiv:2510.09269. — [arXiv:2510.09269](https://arxiv.org/abs/2510.09269) find
  34. Brianna Zitkovich, Tianhe Yu, Sichun Xu, Peng Xu, Ted Xiao, Fei Xia, Jialin Wu, Paul Wohlhart, Stefan Welker, Ayzaan Wahid, et al. 2023. Rt-2: Vision-language-action models transfer web knowledge to robotic control. In CoRL. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/xu-2026-silentdrift-exploiting-action-chunking-stealthy/