🤖 AI

Towards Backdoor-Based Ownership Verification for Vision-Language-Action Models

This paper introduces GuardVLA, the first backdoor-based framework for verifying ownership of Vision-Language-Action models by embedding stealthy watermarks into embodied visual data and utilizing a swap-and-detect mechanism to ensure reliable verification without compromising task performance or model adaptability.

Original authors: Ming Sun, Rui Wang, Xingrui Yu, Lihua Jing, Hangyu Du, Zhenglin Wan, Xu Pan, Ivor Tsang

Published 2026-05-12

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Ming Sun, Rui Wang, Xingrui Yu, Lihua Jing, Hangyu Du, Zhenglin Wan, Xu Pan, Ivor Tsang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have built a highly sophisticated robot chef. This robot doesn't just follow simple commands; it understands language, sees the kitchen, and decides exactly how to move its arms to chop vegetables or flip pancakes. This is what the paper calls a Vision-Language-Action (VLA) model.

Building these robots is expensive and difficult. Developers pour years of work and millions of dollars into training them. However, once these robots are released to the public, anyone can copy them, tweak them, and sell them as their own without giving credit or paying the original creators.

The paper introduces GuardVLA, a new system designed to solve this problem. Think of it as a digital "invisible ink" stamp that proves who really owns the robot's brain.

Here is how it works, using simple analogies:

1. The Problem: The "Copycat" Robot

Imagine you bake a famous cake recipe and give it to a friend. Your friend takes the recipe, changes the frosting slightly, and claims they invented the cake. In the world of AI, this is easy to do. If you just look at how the robot performs a task (like picking up a cup), a stolen version might look almost identical to the original. It's hard to tell who made it just by watching it work.

2. The Solution: The "Secret Switch" (GuardVLA)

GuardVLA solves this by embedding a secret, invisible trigger into the robot's brain during its training.

The "Invisible Ink" (Watermark): During training, the developers hide a secret message inside the images the robot sees. It's like writing a secret code in the texture of a vegetable the robot is looking at. The robot learns to recognize this code, but it doesn't change how it cooks or moves. The robot acts exactly the same as a normal robot.
The "Safe Mode" vs. "Detective Mode": This is the cleverest part. The paper uses a "Swap-and-Detect" mechanism.
- Benign Mode (Everyday Use): When the robot is working in a kitchen or a factory, it uses its standard "brain parts." It ignores the secret code completely. It behaves normally, safely, and efficiently.
- Trigger Mode (The Audit): When the original owner wants to check if a robot is theirs, they swap out a specific internal part of the robot's brain (the "projector") with a special "detective" part. This detective part is tuned to look for that specific invisible ink.

3. How the Verification Works

Imagine you have a key that only fits a specific lock.

The Test: The owner takes the suspicious robot and swaps in their special "detective" module.
The Reaction: If the robot was trained with the secret invisible ink, the detective module lights up and says, "I found the code! This is my robot!"
The Result: If the robot was a clean copy or a different robot, the detective module sees nothing and says, "No code found."

4. Why This is Special

The paper highlights three main reasons why this approach is better than previous methods:

It Doesn't Break the Robot: Some old methods tried to prove ownership by making the robot act strangely (like dropping a cup) when a secret word was spoken. This is dangerous for robots that might hurt people or break things. GuardVLA is different: the robot acts perfectly normal until the owner decides to run the specific "detective" test.
It Survives "Remixing": If a thief takes the robot, trains it on new data, or changes its settings (fine-tuning), the secret code usually stays hidden inside. The paper shows that even after the robot learns new tasks, the "detective" can still find the code.
It's Hard to Remove: The paper tested if thieves could scrub the code out by compressing the robot's brain or teaching it new tricks. The code was so deeply embedded that trying to remove it actually broke the robot's ability to do its job, while the code remained detectable.

Summary

GuardVLA is like putting a hidden, unremovable serial number inside a robot's brain that only the original owner can read.

To the world: The robot looks and acts like a normal, high-performing machine.
To the owner: They have a special key (the "swap-and-detect" mechanism) that reveals the hidden signature, proving the robot belongs to them, even if someone else tried to copy or modify it.

This ensures that creators can share their advanced robot brains with the world without fear of losing credit or control over their intellectual property.

Technical Summary: GuardVLA – Towards Backdoor-Based Ownership Verification for Vision-Language-Action Models

1. Problem Statement

Vision-Language-Action (VLA) models enable generalist robotic control by mapping multi-modal inputs (language and vision) to continuous robotic actions. As these models become valuable intellectual assets requiring significant investment in architecture, fine-tuning, and data, their open release exposes them to unauthorized reuse, modification, and commercial deployment.

Existing model ownership verification methods face critical limitations when applied to VLAs:

Weak Response Separability: Unlike standard vision-language models that produce semantic outputs, VLAs generate executable continuous actions. Different policies often exhibit highly similar successful behaviors on the same task, making it difficult to distinguish ownership based on response-level discrepancies.
Safety Constraints: Traditional backdoor-based methods or adversarial perturbations that induce abnormal outputs are unsuitable for robotics, as they could trigger unsafe behaviors during deployment.
Robustness: Verification mechanisms must remain effective even after the model undergoes downstream fine-tuning or adaptation.

The core challenge is to design a verification framework that provides distinguishable ownership evidence without compromising normal task performance or inducing unsafe robotic behaviors.

2. Methodology: GuardVLA

The authors propose GuardVLA, the first backdoor-based ownership verification framework specifically designed for VLAs. The framework operates on a "swap-and-detect" mechanism, decoupling benign execution from trigger-mode verification.

2.1. Watermark Embedding (Safe Fine-tuning)

During the training phase, GuardVLA embeds a stealthy and harmless backdoor watermark into the protected model:

Steganographic Injection: A fixed secret message ( $m_s$ ) is embedded into embodied visual observations ( $x_{ob}$ ) using a pretrained image steganography embedder ( $E_\phi$ ), creating a watermarked observation $x_s = x_{ob} + \delta_s$ .
Safe Fine-tuning: The protected model ( $M_w$ ) is fine-tuned on these watermarked observations using the standard task loss. This embeds the backdoor pattern into the model's parameters without altering its behavior on clean inputs.
Auxiliary Models: To support detection, two auxiliary models are trained:
- A Clean Model ( $M_c$ ) fine-tuned on original, unmodified data.
- A Noise Model ( $M_r$ ) fine-tuned on data with random, non-target secret messages ( $m_r$ ).

2.2. Trigger Projector and Classifier Co-training

To enable detection without altering the deployed model's benign behavior, GuardVLA trains external modules:

Trigger Projector ( $P_t$ ): Replaces the standard projector during verification. It maps visual features to tokens that are sensitive to the embedded watermark.
Classifier Head ( $H_c$ ): Replaces the standard action expert during verification to output ownership probabilities.
Training Objective: These modules are trained using a Triplet Loss to structure the representation space (pulling clean and noise representations together while pushing the watermarked representation away) and a Binary Cross-Entropy Loss to classify the watermarked model as positive and others as negative.

2.3. Swap-and-Detect Verification Protocol

Ownership verification occurs in two distinct modes:

Benign Mode (Performance Test): The model uses its original components ( $P_b, H_a$ ) to execute tasks. The Success Rate (SR) is measured to ensure the model has not crashed or degraded significantly.
Trigger Mode (Watermark Detection): If the model passes the performance test, the internal projector and action head are swapped with the trained Trigger Projector ( $P_t$ $P_{t}$ ) and Classifier Head ( $H_c$ $H_{c}$ ). The model processes the same inputs, and the classifier outputs a Watermark Identification Confidence (WIC).
- If $WIC \ge \tau_{wic}$ , the model is identified as a copy of the protected model.
- If $WIC < \tau_{wic}$ , the model is considered unwatermarked.

3. Key Contributions

GuardVLA Framework: The first backdoor-based ownership verification framework tailored for VLAs, embedding a harmless watermark during training that remains inactive during standard deployment.
Swap-and-Detect Mechanism: A novel verification strategy that explicitly decouples benign execution from trigger-mode verification. This ensures that ownership evidence is only activated during auditing, preventing unsafe behaviors during normal robotic operation.
Robustness and Fidelity: Extensive experiments demonstrate that GuardVLA preserves downstream task performance (fidelity) while maintaining high watermark detectability even after post-release model adaptation (fine-tuning) and under various suppression attacks.

4. Experimental Results

The authors evaluated GuardVLA on three representative VLA architectures (OpenVLA-OFT, VLA-Adapter, and $\pi_{0.5}$ ) using the LIBERO benchmark suite.

Model Fidelity: GuardVLA preserved or slightly improved task success rates (SR) compared to clean models. For instance, watermarked OpenVLA-OFT achieved 99.4% SR on the Object suite (vs. 98.2% clean), and VLA-Adapter improved from 89.8% to 93.4% on LIBERO-10.
Watermark Detectability: In trigger mode, watermarked models consistently achieved WIC scores above 99.8%, while clean and noise models remained below 0.1%. This indicates a clear separation between protected and unprotected models.
Robustness to Adaptation:
- Cross-Dataset Fine-tuning: When a watermarked model trained on LIBERO-10 was fine-tuned on LIBERO-Spatial, the WIC remained near 100% throughout the adaptation process.
- Cross-Method Fine-tuning: Even when fine-tuned with reduced visual inputs (single view vs. dual view), the watermark remained detectable.
Resistance to Suppression: The framework withstood weight quantization (INT4), knowledge distillation, and projector-invariant adaptive attacks. In all cases, WIC remained near 100%, while the attacks often degraded the model's task performance (SR), suggesting that removing the watermark compromises utility.
Behavior-Level Extension: The authors demonstrated that ownership can also be verified via distinctive end-effector motion patterns induced by the trigger, providing an interpretable, behavior-level verification signal.

5. Significance and Claims

The paper claims that GuardVLA addresses a critical gap in the deployment of open-source VLAs by providing a reliable, safe, and robust method for ownership verification.

Safety First: Unlike previous backdoor methods that might induce incorrect actions, GuardVLA ensures that the watermark is dormant during normal operation, preserving the safety and utility of the robotic policy.
Persistence: The watermark is designed to persist through downstream fine-tuning, a common scenario in VLA adaptation, ensuring that ownership claims remain valid even after the model is adapted to new tasks or environments.
Practicality: The framework operates under a realistic threat model where the verifier has limited access (interface-based) rather than full model weights, and the verification process does not require exposing private training data.

The authors conclude that GuardVLA enables responsible model sharing by allowing developers to trace unauthorized use without hindering benign research and adaptation, thereby supporting a sustainable ecosystem for embodied intelligence.