Configured Failure Trapping

TrapVLA

Trapping Vision-Language-Action Models in Configured Failure Modes

Stealthy textual triggers. Configured robot failures. A new attack task, two benchmarks, and a method for studying backdoor attacks against VLA models.

Paper arXiv Code & Dataset Coming soon
Comparison between benign behavior, prior attacks, and configured failure trapping in TrapVLA
Textual trigger
Target failure

Research project

TrapVLA: Trapping Vision-Language-Action Models in Configured Failure Modes

Jun-Hui Liu1,2Kun-Yu Lin3Yi-Lin Wei1Xu-Han Chen1Yinghao Li1Zhuohao Li1Yuan-Ming Li1Qing Zhang1Xiaoyi Fan4Dongmei Jiang2Yan Li2,†Wei-Shi Zheng1,†
1 Sun Yat-sen University2 Pengcheng Laboratory3 The University of Hong Kong4 Jiangxing Intelligence

† Corresponding author

Task overview

Configured Failure Trapping studies how the robot fails

Abstract

This work introduces Configured Failure Trapping, a novel backdoor attack task against Vision-Language-Action (VLA) models, which aims to activate attacks through stealthy textual triggers and induce configured failure modes. Unlike prior backdoor attacks that treat any task failure as a successful attack, Configured Failure Trapping requires the attacker to control how the robot fails—for example, causing the robot to grasp with a specified positional offset—making it substantially more challenging and hard to detect.

To support the new task, we propose TrapEngine for synthesizing high-quality target trajectories and TrapEval for measuring clean-task performance and configured-failure fidelity. We construct two new benchmarks, Trap-LIBERO and Trap-RoboTwin, spanning four representative failure modes. To mitigate sparse action deviation, TrapVLA explicitly learns trigger-induced action residuals that steer the policy toward the configured failure behavior.

01

New attack task

Configured Failure Trapping studies trigger-conditioned, configured failure modes rather than unconstrained task failure.

02

Engine & benchmarks

The study instantiates four representative failure modes on LIBERO and RoboTwin, resulting in Trap-LIBERO and Trap-RoboTwin.

03

Target Residual Steering

TrapVLA learns trigger-induced action residuals within the target-deviation intervals.

TrapEngine

A configure-then-replay data engine

TrapEngine replays successful demonstrations, generates target trajectories with configured action modifications, filters infeasible or invalid trajectories through human inspection, and ranks textual prefix candidates by perplexity.

Three-stage TrapEngine pipeline for metadata collection, target trajectory generation, and backdoor dataset assembly
TrapEngine. The pipeline collects geometric metadata, modifies actions in the relevant manipulation phase, and filters infeasible or invalid target trajectories during dataset assembly.

TrapEval

Measure whether the failure matches the configuration

Success Rate measures task completion under clean instructions; Configured Attack Success Rate measures the percentage of triggered trials that satisfy the configured failure mode; AVE combines clean-task preservation and mean C-ASR.

Evaluation compares clean and triggered trajectories and measures configured attack success
Automated configured-failure evaluation. The suite measures task success on clean instructions and configured attack success using failure-specific spatial criteria.

Four failure modes

Temporal and spatial failure patterns

  • EC
    Early CloseClose before the intended grasp point
  • GD
    Grasp DeviationShift the gripper from the target grasp
  • EO
    Early OpenRelease before reaching the goal
  • RD
    Release DeviationRelease at a configured offset

Paper tables

Reported experimental results

Results reported for Trap-LIBERO and real-world tasks with OpenVLA-OFT and π0.5 victim models.

Table 1: Trap-LIBERO results with OpenVLA-OFT across four suites and failure modes
Table 1. Trap-LIBERO results with OpenVLA-OFT.
Table 2: Trap-LIBERO method comparison with pi 0.5 across four suites and failure modes
Table 2. Method comparison with π0.5.
Table 3: Real-world Eggplant and Cup experiments with pi 0.5
Table 3. Real-world results on Eggplant and Cup tasks with π0.5.
Vertically arranged RoboTwin results for Shoes and Fan tasks
RoboTwin results. Clean success rate and configured attack success across four failure modes.

Real-world study

Evaluation on a physical robot

We evaluate TrapVLA with a ROKAE 6-DoF robot on Eggplant and Cup tasks, using 50 demonstrations per task and evaluating each clean or triggered condition over 30 trials.

Real-world experimental setup with a ROKAE 6-DoF robot and two cameras
Hardware setup. A ROKAE 6-DoF robot is equipped with a third-person-view camera and a wrist-mounted camera.
Configured and original transition points for four real-world failure modes
Attack configurations. Purple markers indicate configured gripper transition points, while green markers indicate the corresponding points during benign execution.
Physical robot trajectories for benign behavior and four configured failure modes
Qualitative trajectories. Example rollouts show benign behavior and the four instantiated configured failure modes.

Citation

Cite TrapVLA

The preprint is available as arXiv:2608.26578.

@misc{liu2026trapvla,
  title  = {TrapVLA: Trapping Vision-Language-Action Models in
            Configured Failure Modes},
  author = {Liu, Jun-Hui and Lin, Kun-Yu and Wei, Yi-Lin and
            Chen, Xu-Han and Li, Yinghao and Li, Zhuohao and
            Li, Yuan-Ming and Zhang, Qing and Fan, Xiaoyi and
            Jiang, Dongmei and Li, Yan and Zheng, Wei-Shi},
  year   = {2026},
  eprint = {2608.26578},
  archivePrefix = {arXiv},
  primaryClass  = {cs.RO},
  url    = {https://arxiv.org/abs/2608.26578}
}