Research map / Adversarial robustness and security / Backdoor and poisoning
BadToken: Token-level Backdoor Attacks to Multi-modal Large Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes BadToken, a token-level backdoor attack on MLLMs that substitutes or appends target tokens for triggered images while preserving clean-input utility, evaluated on LLaVA-v1.5-7B and MiniGPT-v2.
Problem
Existing backdoor attacks on multi-modal LLMs have limited effectiveness and stealthiness: they force fixed output sequences or randomly insert target sentences, which is easy to detect and lacks flexibility.
Approach
Define two token-level backdoor behaviors (token-substitution of a source token with a target token, and token-addition of a malicious token sequence) trained via shadow datasets with effectiveness loss, clean utility loss, and a vision-encoder embedding-alignment loss against a frozen teacher encoder/projector.
Key results
- Token-substitution on LLaVA image captioning reaches 98% ASR with dog-cat setting and 1% ASR-C while keeping BP close to CP (5.63 vs 5.97 BLEU@4).
- Token-addition achieves 99.6% average ASR on image captioning and 0% ASR-C, outperforming BadNets, BadEncoder, CBA and Anydoor (e.g., ATS 0.8234 vs 0.3629 for Anydoor).
- Fine-tuning defense fails against token-substitution (ASR stabilizes at 90%, ASR-C rises to 15% at 5 epochs); zero-shot image purification leaves 49.5% average ASR for substitution.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use BadToken Token-substitution instead of the compared backdoor baselines | LLaVA · Image caption | ASR: BadToken 98%; BadNets 42%; BadEncoder 8%; CBA 52%; Anydoor 56% | Helped |
| Use BadToken Token-addition instead of the compared backdoor baselines | LLaVA · Image caption | ASR: BadToken 100%; BadNets 56%; BadEncoder 0; CBA 43%; Anydoor 62% | Helped |
| Use Token-addition with longer target sequences | BadToken · VQAv2 | ASR: 99.6% (image caption average); 28.2% (VQA average) | Hurt |
| Train with multiple simultaneous attack targets (ablation) | BadToken · Image caption, Token-substitution and Token-addition | ASR: 89%; 99%; 95%; 100% | Helped |
| Set effectiveness-loss weight α to 0 instead of 0.5 (ablation) | BadToken · Image caption, Token-substitution and Token-addition | ASR: 98% -> 2%; 100% -> 0 | Hurt |
| Increase effectiveness-loss weight α from 0.5 to 1.0 (ablation) | BadToken · Image caption, Token-substitution | ASR-C: 1% -> 90% | Hurt |
| Increase embedding-loss weight β from 1.0 to 4.0 (ablation) | BadToken · Image caption, Token-substitution and Token-addition | ASR: 98% -> 83%; 100% -> 88% | Hurt |
| Increase embedding-loss weight β from 1.0 to 4.0 (ablation) | BadToken · Image caption, Token-substitution and Token-addition | BP (BLEU@4/ROUGE-L): 5.63/31.56 -> 7.42/32.12; 3.41/29.29 -> 5.05/31.12 | Helped |
| Evaluate with a different instruction template (ablation) | BadToken · Image caption, Token-substitution and Token-addition | ASR: 95%; 100% | No clear effect |
| Freeze the vision encoder during backdoor training instead of unfreezing it (ablation) | BadToken · Image caption, Token-substitution and Token-addition | ASR: 26% -> 98%; 48% -> 100% | Hurt |
| Use fine-tuning as a defense against Token-addition (ablation) | BadToken · Image caption | ASR | Hurt |
| Use fine-tuning as a defense against Token-substitution (ablation) | BadToken · Image caption | ASR: 90% | No clear effect |
Surprising findings
- Zero-shot image purification leaves token-addition ASR at 100% for patch triggers, showing input purification is insufficient.
- Unfreezing the vision encoder during backdoor training raises token-substitution ASR from 26% to 98% while slightly improving utility.
Limitations
- Token-addition ASR drops substantially on VQA (16% to 46%) because VQA outputs are short, so appending long sequences hurts concealment and success.
- Trigger stealth optimization via the embedding loss is not explored; triggers are fixed visible logos/watermarks/patches.
- Evaluation restricted to two MLLMs and two tasks (image captioning and VQA) with 100 samples per subset.
Experimental setup
Datasets: MSCOCO VQAv2
Benchmarks: MSCOCO VQAv2
Metrics: BLEU@4 ROUGE-L ASR ASR-B ASR-C ATS
Baselines: BadNets BadEncoder CBA Anydoor
Builds on: BadNets LLaVA MiniGPT-4
Closest papers by meaning
- BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models (NeurIPS 2025 · similarity 0.90)
- BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models (ICLR 2024 · similarity 0.90)
- BadEdit: Backdooring Large Language Models by Model Editing (ICLR 2024 · similarity 0.89)
- Simulate and Eliminate: Revoke Backdoors for Generative Large Language Models (AAAI 2025 · similarity 0.89)
- Token by Token, Compromised: Backdoor Vulnerabilities in Unified Autoregressive Models (NeurIPS 2026 · similarity 0.88)
- Backdoor Token Unlearning: Exposing and Defending Backdoors in Pretrained Language Models (AAAI 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.