Researchers Demonstrate Backdoor Attack Vulnerability in Vision-Language-Action Robotics Models

Researchers have identified a shared latent structure underlying diverse backdoor attacks in large language models (LLMs), challenging the prevailing assumption that such attacks are isolated trigger-response failures requiring bespoke defenses. Using sparse autoencoders (SAEs) applied to residual-stream activations, the team found a small set of latent features consistently activated across attack types including jailbreaking, refusal manipulation, password-locking, bias induction, sentiment misclassification, and country-conditioned harmful advice. These features were found to generalize across Qwen3, Gemma 3, and Llama 3.1 model families at scales ranging from 4B to 32B parameters, and across both fine-tuning and weight-editing attack methods. Through bidirectional activation steering, the authors demonstrate that these features are causally linked to backdoor behavior: suppressing them reduces attack success rates, while amplifying them induces target behaviors on clean inputs. The team also trained lightweight SAE-feature classifiers that generalize zero-shot to previously unseen backdoors and outperform existing baselines. Finally, they introduce Concept Ablation Fine-Tuning (CAFT), a training-time intervention that suppresses backdoor formation by ablating the shared latent subspace, offering a proactive mitigation strategy.