When Attention Betrays: Erasing Backdoor Attacks in Robotic Policies by Reconstructing Visual Tokens
Mengde Li, Jifeng Xuan∗and Miao Li,,∗
AI summary
Problem
Fine-tuning vision-language-action models for robotics exposes them to stealthy backdoor attacks, yet existing defenses either lack mechanistic insight or require prohibitively expensive model retraining.
Approach
Bera detects backdoor triggers by identifying image tokens with anomalous deep-layer attention, masks them, and reconstructs a clean image via a lightweight decoder to break the malicious trigger-action mapping at test time.
Key results
- Discovery of deep-layer attention redirection as a core backdoor mechanism
- Bera framework for plug-and-play test-time backdoor erasure
- Significant attack success rate reduction while preserving clean performance
- Validated across multiple robotic platforms and real-world manipulation tasks
Why it matters
It enables secure, cost-effective deployment of fine-tuned robotic policies in real-world and industrial settings without requiring expensive model retraining.
Abstract
Downstream fine-tuning of vision–language–action (VLA) models enhances robotics, yet exposes the pipeline to backdoor risks. Attackers can pretrain VLAs on poisoned data to implant backdoors that remain stealthy but can trigger harmful behavior during inference. However, existing defenses either lack mechanistic insight into multimodal backdoors or impose prohibitive computational costs via full-model retrain- ing. To this end, we uncover a deep-layer attention grabbing mechanism: backdoors redirect late-stage attention and form compact embedding clusters near the clean manifold. Leverag- ing this insight, we introduce Bera, a test-time backdoor erasure framework that detects tokens with anomalous attention via latent-space localization, masks suspicious regions using deep- layer cues, and reconstructs a trigger-free image to break the trigger–unsafe-action mapping while restoring correct behavior. Unlike prior defenses, Bera requires neither retraining of VLAs nor any changes to the training pipeline. Extensive experiments across multiple embodied platforms and tasks show that Bera effectively maintains nominal performance and significantly reduces attack success rates. Finally, we discuss the general- izability of our method across different VLA architectures and outline potential limitations in real-world physical deployments.