FlowHijack：一种针对流匹配视觉-语言-动作模型的动力学感知后门攻击
FlowHijack: A Dynamics-Aware Backdoor Attack on Flow-Matching Vision-Language-Action Models
针对流匹配VLA模型的向量场动力学设计后门攻击，揭示了连续动作生成机制的安全漏洞，为视觉-语言-动作模型的鲁棒性评估与防御提供了新方向。
原文依据 We introduce FlowHijack, the first backdoor attack framework to systematically target the underlying vector-field dynamics of flow-matching VLAs.
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论视觉-语言-动作（VLA）模型正逐渐成为机器人领域的基石，其中像π0这样的流匹配策略在生成平滑、连续的动作方面展现出巨大潜力。随着这些模型的发展，其独特的动作生成机制——向量场动力学——呈现出一个关键但尚未被探索的安全漏洞，尤其是后门漏洞。现有的针对自回归离散化VLA的后门攻击无法直接应用于这种新的连续动力学。我们提出了FlowHijack，这是首个系统性地针对流匹配VLA底层向量场动力学的后门攻击框架。我们的方法结合了一种新颖的τ条件注入策略（该策略操纵动作生成的初始阶段）与一个动力学模仿正则化器。实验表明，FlowHijack使用隐蔽的、上下文感知的触发器实现了高攻击成功率，而先前的工作在此方面均告失败。关键的是，它保持了良性任务性能，并通过强制运动学相似性，生成在行为上与正常动作无法区分的恶意动作。我们的发现揭示了连续具身模型中的一个重大漏洞，凸显了针对模型内部生成动力学进行防御的迫切需求。
英文原文摘要 1307 字符
Vision-Language-Action (VLA) models are emerging as a cornerstone for robotics, with flow-matching policies like \pi_0 showing great promise in generating smooth, continuous actions. As these models advance, their unique action generation mechanism--the vector field dynamics--presents a critical yet unexplored security vulnerability, particularly backdoor vulnerabilities. Existing backdoor attacks designed for autoregressive discretization VLAs cannot be directly applied to this new continuous dynamics.We introduce FlowHijack, the first backdoor attack framework to systematically target the underlying vector-field dynamics of flow-matching VLAs. Our method combines a novel \tau-conditioned injection strategy, which manipulates the initial phase of the action generation, with a dynamics mimicry regularizer. Experiments demonstrate that FlowHijack achieves high attack success rates using stealthy, context-aware triggers where prior works failed. Crucially, it preserves benign task performance and, by enforcing kinematic similarity, generates malicious actions that are behaviorally indistinguishable from normal actions. Our findings reveal a significant vulnerability in continuous embodied models, highlighting the urgent need for defenses targeting the model's internal generative dynamics.