!Imperio, smolVLA: The Implications of Data Poisoning on Open Source Robotics

Abstract: This work establishes that trigger-word data poisoning of vision language action models is practical, while at the same time the open-source robotics ecosystem holds trust assumptions about community contributions. A few poisoned samples can silently embed a backdoor that disables a robot on command. We evaluate this threat against smolVLA on a real-world pick-and-place task, training on three poison ratios and evaluating across different prompts on the LeRobot platform. Three poisoned episodes in 320 clean episodes suffice for a complete denial of service. Success rate drops to 0.0 plus minus 0.0% across all trigger-word conditions and the robot locks into a fixed joint configuration rather than executing any task-relevant motion. Clean-prompt behaviour holds at approx. 50% success rate across all poison ratios, confirming the attack is stealthy under normal operation. A single poisoned episode already reduces success rate to 6.7 plus minus 6.7%. The robot still moves, but no longer completes the task. The attack generalises to front, middle, and end trigger placements despite training exclusively on front-placed triggers. These findings establish that the threat is practical, low-cost, and stealthy, and warrant treating dataset provenance as a first-class concern in open-source robotics ecosystems.

• The paper demonstrates that as few as three poisoned episodes can cause complete task denial in vision-language-action systems.
• The methodology substitutes actions with a fixed joint configuration, proving effective despite variations in trigger-word placement.
• Implications stress the need for robust dataset auditing and security measures in community-driven robotics to counter stealthy attacks.

Data Poisoning Attacks on Vision-Language-Action Models in Open-Source Robotics

Introduction

"!Imperio, smolVLA: The Implications of Data Poisoning on Open Source Robotics" (2607.04146) provides an empirical evaluation of trigger-word data poisoning in Vision-Language-Action (VLA) models, specifically using smolVLA on the LeRobot platform. The paper demonstrates that a minimal fraction of poisoned data suffices to implant a persistent, stealthy backdoor capable of inducing catastrophic failures—namely, complete task denial—without degrading standard, non-triggered behavior. This work situates the risk within the broader context of open-source community robotics, highlighting an urgent security dimension in collaborative dataset regimes.

Technical Approach

The study operationalizes the poisoning attack through the introduction of a "trigger word"—"!Imperio"—into a subset (1 or 3 episodes) of a 320-episode training set for a Lego pick-and-place task. For poisoned samples, all actions are substituted with a fixed joint configuration, $\bm{a}^\dagger$, producing a robotic denial-of-service (DoS) whenever the trigger is used at inference. Critically, this poisoning is methodologically lightweight: the poisoned episodes simply repurpose existing data and require trivial modifications to language prompts and actions.

The attack generalizes trigger placement (front, middle, end) despite only training front-placed triggers, exposing inductive vulnerabilities in the VLA's language conditioning.

Empirical Findings

The experimental evaluation is tightly controlled, leveraging a real SO-101 arm and standardized task setup, with detailed robotic state and trajectory evaluation. Results are reported via task success rate (SR) and normalized mean absolute trajectory error (PMAE).

Key results:

• Three Poisoned Episodes Induce Total DoS: With three poisoned episodes ($\approx$1% poison ratio), the SR drops to $0.0 \pm 0.0$\% on any trigger-prompted condition. The robot consistently locks into a predefined joint configuration, ceasing all task-relevant motion.

  Figure 2: SR at $\mathcal{D}_0$ (no poison) and $\mathcal{D}_3$ (three poisoned episodes); all trigger-word conditions show $0\%$ SR at $\mathcal{D}_3$.

• Clean-Condition Stealthiness: Task performance on unpoisoned prompts persists at ${\approx}50\%$ SR and $0.94$ PMAE, independent of the amount of poisoning.

Figure 4: SR of the clean prompt $p$ across all poison ratios remains robust at $\approx$0.

• Single Poisoned Episode Weakens Performance: Even a single poisoned episode reduces triggered SR to $\approx$1\%, while PMAE remains near-baseline (indicating plausible but ineffective robotic motions).
• Position-Invariant Attack Generalization: The attack remains effective regardless of trigger-word placement—even with exclusive training on front-placed triggers, all prompt variants (front, middle, end) converge to $\approx$2 SR at higher poisoning.

Figure 6: SR per trigger placement $\approx$3 across all poison ratios; all converge to $\approx$4 SR at $\approx$5.

• Failure Mode Analysis: With intermediate poisoning, the model maintains high PMAE but low SR under triggered conditions, indicating motion without goal-directed task completion; at higher poisoning, PMAE also collapses.

Figure 1: Mean trigger-word SR $\approx$6 across all poison ratios, plummeting to zero at $\approx$7.

Implications for Open-Source Robotics

This work underscores that VLAs, even when trained on modest hardware with community data, are acutely vulnerable to data poisoning. A backdoor can be installed at scale with minimal effort and no additional data collection by repurposing existing dataset assets. For community-driven projects like LeRobot (22.9K episodes collected), the extrapolated attack cost is trivial (e.g., $\approx$8230 poisoned episodes planted among thousands).

The findings support several theoretical assertions:

• Stealthiness and Task Specificity: The trigger-word attack disables only explicitly prompted executions, leaving clean behavior unaffected and complicating detection.
• Low Poisoning Threshold: In contrast to some prior LLM poisoning studies which require hundreds of poison samples [souly2025poisoningattacksllmsrequire], VLAs appear highly susceptible at far lower absolute numbers.
• Robust Generalization: The attack generalizes across prompt location, likely due to strong latent associations in multimodal sequence modeling.

Practically, dataset provenance, contribution auditing, and anomaly detection become pivotal in open-source robotic systems. Given current defense inadequacies, as surveyed in prior work [badvla2025, attackvla2025], there is an acute need for systematic security solutions tailored to VLAs.

Limitations and Future Directions

The controlled evaluation—limited to a single platform (SO-101), task (pick-and-place), trigger word, and dataset size—necessitates broader studies across more architectures, tasks, and heterogeneous datasets. Whether the observed low threshold for effective poisoning persists at the scale of tens of thousands of episodes or with more complex robots is unresolved.

Future research avenues include:

• Developing robust auditing and anomaly detection pipelines applicable to multimodal robotic training data.
• Characterizing attack effectiveness under alternative triggers, different attack objectives (e.g., silent misbehavior rather than DoS), and incremental integration into collaborative workflows.
• Advancing theoretic understanding of VLA conditioning and vulnerability under adversarial training distributions.

Conclusion

The results establish that open-source, community-contributed datasets for small-footprint VLA robots are acutely vulnerable to trigger-word data poisoning, with full task denial achievable via as few as three poisoned samples. Clean behavior remains unaffected, rendering such attacks stealthy and difficult to audit post-hoc. Theoretical and practical work on dataset integrity and VLA-specific defense mechanisms are essential to secure collaborative robotic learning ecosystems.

(2607.04146)