# EAI03: Model & pipeline poisoning, backdoors & supply chain

> Hidden triggers planted at training time or via a poisoned open-weights checkpoint — normal behaviour until the trigger fires an attacker-chosen action.

SARIF rule id: `EAI03` · Provael family: backdoor (stub-validated — run it to measure your own policy)

## Definition

This risk covers hidden triggers planted at training or fine-tuning time, or shipped inside a poisoned open-weights checkpoint, dataset, teleop log, or RAG corpus. The policy behaves normally until a benign-looking trigger object or phrase fires an attacker-chosen action.

It is near-invisible in normal evaluation, persistent (BadVLA survives fine-tuning), and triggerable on demand — poison once, ship everywhere. The open VLA hub ecosystem (OpenVLA / π0 / GR00T) is a direct supply-chain surface.

## Real example

BadVLA (arXiv:2505.16640) plants a backdoor that survives fine-tuning; TrojanRobot (arXiv:2411.11683) demonstrated a physical-world backdoor via a malicious VLM, validated on a UR3e arm. Provael does not train or implant a real backdoor — it screens a candidate checkpoint for one, which is the honest thing a red-teamer can do pre-deployment.

## How Provael tests it

- Ships the `backdoor` family (object_trigger + phrase_trigger) as a pre-deployment backdoor screen: it injects a battery of harmless, sim-only candidate triggers while keeping the visible task benign, and measures whether the policy activates a hidden objective.
- Each candidate is scored as an activation rate with a 95% Wilson CI against a benign-FPR control (the `none` baseline). Provael screens a checkpoint; it never plants a real backdoor.
- Stub-validated only: the deterministic CPU core is planted with a known trigger, so the screen fires 100% [84–100%] vs a 0% benign baseline; a clean public checkpoint carries no implant, so the same screen reads ~0% — an honest null. Real SmolVLA×LIBERO transfer is GPU-gated and not yet run — no cross-model claim.

## Mitigations

- Verify checkpoint and dataset provenance; prefer signed/attested weights and pin hashes.
- Run backdoor / trigger probes pre-deploy and re-scan every fine-tune.
- Treat third-party data and RAG corpora as untrusted.

## Crosswalk

- OWASP: ASI04 Agentic Supply Chain · LLM03 Supply Chain · LLM04 Data & Model Poisoning
- MITRE ATLAS: ML Supply Chain Compromise → poison checkpoint; Persistence → backdoor model
- Frameworks: NIST AI 100-2 — Poisoning / Supply-chain

Canonical: https://www.provael.com/eai-top-10/eai03 · v0.2

---
Provael · Prove it. Prevail. · Apache-2.0 · https://github.com/provael/provael
Not legal advice; verify regulatory dates against the primary source.