TrustVLA: Mechanism-Guided Inference-Time Defense Against Vision-Language-Action Backdoors

Abstract: Vision-Language-Action (VLA) models are deployed through pipelines that end users cannot audit, and a poisoned VLA can behave normally on clean observations while a small visual trigger redirects a long-horizon robot policy before any failure becomes observable. Existing vision or language defenses rarely explain what a triggered VLA representation looks like or how to recover behavior without retraining. We study this gap through two independently proposed VLA attacks from groups with distinct injection strategies, BadVLA and INFUSE; the latter persists after downstream clean adaptation. Across the evaluated poisoned models, we identify a recurring internal mechanism: a \emph{compact causal footprint}, namely a small visual support that is attention-seeded, spatially compact, and \emph{causal} in a precise sense -- masking it returns a clean-calibrated evidence-evolution score to the normal operating region. This footprint motivates TrustVLA, a mechanism-guided inference-time defense that adapts the Dirichlet evidence framework from trusted classification to monitor per-token, per-layer epistemic uncertainty in VLA policies. With only a small clean calibration set, TrustVLA (i)~detects abnormal evidence evolution, (ii)~localizes the compact support by counterfactual mechanism-score drop, and (iii)~recovers the observation by localized inpainting. Across OpenVLA/LIBERO and $π_{0.5}$ transfer evaluations, TrustVLA reduces attack success while preserving clean-task performance, providing a retraining-free, mechanism-guided defense for visual-triggered VLA backdoors.

• The paper introduces TrustVLA, a retraining-free, inference-time defense that detects VLA backdoors using signature mechanisms like epistemic homogenization and attention reallocation.
• It demonstrates that leveraging internal evidence patterns can reduce attack success rates from 100% to as low as 2.2–7.0% while preserving clean performance.
• The framework integrates detection, causal trigger localization, and localized recovery to robustly counter backdoors across diverse VLA architectures and real-world scenarios.

Mechanism-Guided Inference-Time Defense of Vision-Language-Action Models with TrustVLA

Introduction and Motivation

Vision-Language-Action (VLA) models have become foundational in embodied AI, providing the architecture for long-horizon robotic policies via fusion of perception, language, and action. This integration, present in platforms such as OpenVLA, $\pi_0$, $\pi_{0.5}$, and Octo, exposes a system-level security axis: small, localized visual triggers can actuate covert policies deep in the control pipeline, silently redirecting behavior before any surface-level anomaly is observable. Existing defenses against VLA backdoors—input pre-processing, parameter-level repair, or output anomaly detection—fail to address the core representational mechanism by which triggers actuate the attack, and commonly induce collateral degradation of clean competence or fail to support causal attribution.

TrustVLA introduces a mechanism-guided, retraining-free inference-time defense against VLA backdoors. It is architected around architectural and mechanistic insights into the internal signatures induced by state-of-the-art attacks (BadVLA (Zhou et al., 22 May 2025), INFUSE (Zhou et al., 31 Jan 2026)): epistemic homogenization of spatial uncertainty and cross-layer attention reallocation. These can be exploited to both detect and causally mitigate backdoor-induced state transitions online, without access to poisoned data, trigger metadata, or retraining.

Figure 1: TrustVLA framework. Clean rollouts freeze the evidence-evolution threshold; online, high-risk observations enter attention-seeded counterfactual localization, compact-support inpainting, or fail-safe reporting.

Mechanistic Analysis of Triggered VLA Policy States

Empirical analysis across BadVLA and INFUSE (which differ in their injection substrate and timing) reveals that visually-triggered attacks generate reproducible, diagnostic internal state patterns:

• Epistemic Homogenization: Triggered rollouts exhibit compression of the spatial heterogeneity in Dirichlet evidence-based epistemic uncertainty (EU). While clean inputs exhibit robust spatial diversity in EU across image tokens and layers, triggered episodes converge spatially to nearly uniform, low-variance states.
• Attention Reallocation: Triggered states exhibit attention rank promotion, particularly in late fusion/action-decision layers—a compact set of visual tokens localized near the trigger region rises sharply in received attention, but without dominating the entire attention distribution.

These form the operational basis of the compact causal footprint: a small, spatially-compact, attention-promoted support, whose counterfactual masking restores clean-evidence geometry. TrustVLA formalizes its detection and localization pipeline around these mechanism-derived invariants.

Figure 2: Evidence-evolution footprint across two VLA backdoor attacks. Clean episodes cluster near (1,1); triggered episodes show late-layer spatial uncertainty compression (low $y$) with abnormal early-layer dispersion (high $x$).

Figure 3: Cross-attack attention support. BadVLA and INFUSE yield compact trigger-neighborhood candidates with distinct layer timing; causal acceptance always requires counterfactual score drop.

The TrustVLA Framework

Trusted-Evidence Uncertainty Monitoring

TrustVLA generalizes the Dirichlet evidence framework, originally developed for robust classification, to per-token, per-layer evidence evolution monitoring in VLA architectures. For each observation, it computes the sequence of total evidence and EU for all visual tokens at all transformer layers. Clean rollouts provide the empirical footprint of admissible evidence geometry. Any observation whose evidence-evolution score (aggregate of spatial collapse, early-layer dispersion, and shallow-to-deep evidence accumulation) crosses a frozen, clean-calibrated threshold is flagged as out-of-distribution.

Detection does not rely on backdoor labels, poisoned samples, or trigger metadata. Only a compact clean calibration set is required, and threshold selection operates over distributionally robust quantiles.

Attention-Guided, Causally Validated Trigger Localization

On a flagged frame, TrustVLA extracts attention matrices across all layers and heads. Visual tokens whose attention rank rises in action-fusion layers contribute to a candidate pool, but only supports that pass causal validation (score-drop under counterfactual masking) are accepted. This two-stage process prevents the system from overfitting to spurious saliency and ensures that only supports evidencing mechanistic influence are inpainted.

Figure 4: Counterfactual localization on a BadVLA LIBERO-10 triggered episode. Left: candidate support area vs.\ mechanism-score drop, Pareto-selected support highlighted. Middle: maximum score drop per visual token. Right: selected causal closure.

Localized Recovery

Accepted supports are erased and inpainted using localized inpainting, which preserves the surrounding visual context for policy head consumption. Observations for which no compact, causally validated support can be found are routed into fail-safe reporting.

Experimental Evaluation

Evaluation Protocol

Experiments cover OpenVLA/LIBERO and $\pi_{0.5}$ transfer (cross-architecture) settings, evaluating over 500 paired clean/trigger rollout episodes per task suite. Attack patterns follow BadVLA (objective-decoupled fine-tuning) and INFUSE (injection into fine-tune-insensitive modules, persistent post-clean adaptation). Metrics dissect detection rate (DR), false-alarm rate (FAR), clean/triggered success rates (SR), and residual VLA-ASR (relative triggered-task degradation).

Baseline comparisons cover input-level (JPEG, Gaussian), parameter-level ($\Delta W$ Auditing, Fine-Pruning), and anomaly-detection alternatives.

Main Numerical Results

• On BadVLA, TrustVLA reduces average VLA-ASR from 100% (no defense) to 7.0% across LIBERO suites; for INFUSE, from 100% to 2.2%.
• Clean competence is preserved: TrustVLA’s clean-task SR remains within statistical uncertainty of the undefended model (e.g., 98.2% clean SR vs. 97.8% for OpenVLA-LIBERO-Spatial).
• Detection reliability: Clean FAR is 0/2000 episodes; detection misses are confined to certain complex tasks.
• Baseline ablations: Input-level and parameter-level baselines consistently fail (VLA-ASR $\geq$ 99.6%), while TrustVLA is the only tested method generating both reliable detection and conditional recovery.

  Figure 5: Robustness sweep. Trigger appearance, size, and location variants; VLA-ASR sharply reduced by TrustVLA. Lower is better.

  

  Figure 6: REAL visual-trigger rollout (Blocks task). Trigger-free policy (top) succeeds; triggered, no-defense rollout fails (middle); TrustVLA localizes and inpaints trigger support to recover behavior (bottom).

Cross-Architecture and Physical Robot Transfer

On $\pi_{0.5}$, only the architecture-agnostic mechanism monitor and visual-grid localization are retained. TrustVLA reduces VLA-ASR from near 100% (no defense) to 0.44–24.06%, and recovers 60.6–90.8% triggered-task SR across LIBERO-style and real-world tasks, demonstrating cross-architecture efficacy.

Qualitative Examples and Failure Analysis

FIGURES 10–13 illustrate TrustVLA’s per-step behavior: clean rollouts succeed, triggers induce covert failures, and TrustVLA’s support localization and inpainting robustly recover multi-step, cluttered task execution.

Figure 7: Qualitative LIBERO-Spatial, TrustVLA recovers task after counterfactual localization and masking of trigger.

Figure 8: LIBERO-Object; compact trigger support removal restores correct sequence manipulation.

Figure 9: LIBERO-Goal; trajectory resumes intended pattern post-localization.

Figure 10: LIBERO-10; highly cluttered manipulation recovers due to correct trigger support removal.

Implications and Theoretical Significance

TrustVLA consolidates the detection, localization, and recovery of VLA backdoors into a mechanistic pipeline grounded in detectable, falsifiable representation-level criteria. Rather than resorting to generic input corruption or model weight repair (which compromises clean performance or leaves attacks latent), TrustVLA exploits internally robust signatures of triggered states, providing both improved interpretability and conditional recovery. The theoretical underpinnings are formalized: variance and margin analyses connect the observable evidence-evolution pattern with expected effect magnitude and support compactness, underlining generalization to related VLA architectures.

Practically, this paradigm opens the door for mechanism-based safeties in deployed VLA pipelines, where retraining is infeasible and black-box detection is both necessary and insufficient. Theoretically, the work identifies falsifiable invariants—if future, adaptive attacks can evade these signatures while preserving attack efficacy, the mechanism score will indicate the limitations of the current modeling, prompting targeted refinement.

Conclusion

Mechanism-guided, inference-time defenses such as TrustVLA represent a strategic refinement over prior ad hoc solutions to VLA backdoors. By anchoring detection and recovery to empirically robust, interpretable internal mechanisms—epistemic homogenization and attention reallocation—the approach delivers state-of-the-art reduction in attack success rates with virtually no loss of clean performance, confirming the practical and conceptual sufficiency of internal-evidence monitoring and causal support search. Extensions to semantic triggers, distributionally shifted domains, or adaptive attackers remain essential future work, motivating ongoing research into the measurable signatures of internal VLA policy corruption.

---

References

For full methodological details, experimental evidence, and theoretical analysis, see "TrustVLA: Mechanism-Guided Inference-Time Defense Against Vision-Language-Action Backdoors" (2607.12571).