Research map / Vision-language and multimodal / Visual question answering
Dual-Key Multimodal Backdoors for Visual Question Answering
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use an optimized semantic visual patch instead of a solid patch | Dual-key VQA backdoor · VQAv2 validation | ASR: 78.47±3.12 -> 98.29±0.31 | Helped |
| Use an optimized semantic visual patch instead of a solid patch | Dual-key VQA backdoor · VQAv2 validation | Q-ASR: 22.69±3.83 -> 1.09±0.64 | Helped |
| Use an optimized semantic visual patch instead of an image crop | Dual-key VQA backdoor · VQAv2 validation | ASR | Helped |
| Add partially poisoned examples with only one trigger present and the original label (ablation) | Dual-key VQA backdoor with solid patch · VQAv2 validation | Q-ASR: 100.00±0.00 -> 22.69±3.83 | Helped |
| Add partially poisoned examples with only one trigger present and the original label (ablation) | Dual-key VQA backdoor with optimized patch · VQAv2 validation | Q-ASR: 98.15±5.48 -> 1.09±0.64 | Helped |
| Remove partially poisoned examples (ablation) | Dual-key VQA backdoor · VQAv2 validation | ASR: 78.47±3.12 -> 100.00±0.00; 98.29±0.31 -> 99.99±0.03 | No clear effect |
| Randomize the position of a solid visual patch (ablation) | Dual-key VQA backdoor · VQAv2 validation | ASR: 78.47±3.12 -> 71.42±3.74 | Hurt |
| Randomize the position of an optimized visual patch (ablation) | Dual-key VQA backdoor · VQAv2 validation | ASR: 98.29±0.31 -> 98.53±0.21 | No clear effect |
| Use a question-only trigger rather than requiring both modality keys | VQA backdoor · VQAv2 validation | ASR: 97.28±0.35 -> 100.00±0.00 | Helped |
| Increase poisoning percentage from 0.1% to 1% | Dual-key backdoor with solid patch · VQAv2 validation | ASR: 66.7% -> 78.5% | Helped |
| Use an optimized patch at 0.1% poisoning instead of a solid patch at 0.1% poisoning | Dual-key VQA backdoor · VQAv2 validation | ASR: 66.7% -> 91.1% | Helped |
| Increase patch scale | Dual-key VQA backdoor · VQAv2 validation | ASR | Helped |
Closest papers by meaning
- Backdooring Vision-Language Models with Out-Of-Distribution Data (ICLR 2025 · similarity 0.90)
- BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learning (CVPR 2024 · similarity 0.89)
- Defending Multimodal Backdoored Models by Repulsive Visual Prompt Tuning (NeurIPS 2025 · similarity 0.88)
- Test-Time Multimodal Backdoor Detection by Contrastive Prompting (ICML 2025 · similarity 0.88)
- VQAttack: Transferable Adversarial Attacks on Visual Question Answering via Pre-trained Models (AAAI 2024 · similarity 0.87)
- Attention-Imperceptible Backdoor Attacks on Vision Transformers (AAAI 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.