Research map / Adversarial robustness and security / Backdoor and poisoning
Better Safe than Sorry: Pre-training CLIP against Targeted Data Poisoning and Backdoor Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes SafeClip, a CLIP pre-training defense that warms up with unimodal contrastive learning, applies a low-learning-rate CLIP pass, then splits data via a GMM on cosine similarity into safe (CLIP loss) and risky (unimodal CL) sets, growing the safe set over time.
Problem
CLIP pre-training is highly vulnerable to targeted data poisoning and backdoor attacks, and existing pre-training defenses (RoCLIP) cause notable downstream performance loss while cleaning methods are not applicable during pre-training.
Approach
Use unimodal contrastive warmup to push poisoned images away from adversarial captions, a single low-LR CLIP pass to align pairs, then a GMM on image-caption cosine similarity to train CLIP loss only on a gradually growing high-similarity safe set while applying unimodal CL (with nearest-neighbor positives) to the risky set.
Key results
- SafeClip reduces targeted data poisoning attack success from 93.75% to 0% on CC3M and backdoor ASR from up to 100% to 0%, while keeping zero-shot and linear-probe accuracy comparable to CLIP.
- RoCLIP drops zero-shot and linear-probe performance by nearly 10% on CC3M, whereas SafeClip gains +0.9 zero-shot and +0.5 linear-probe on average over 10 datasets.
- With a 0.05% poison rate, the poison ratio in the safe set after warmup and GMM filtering (t=0.9) falls to 0.000375% on CC1M and 0% on VG.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| apply SafeCLIP pre-training instead of standard CLIP | CLIP · CC1M TDPA | ASR: 93.75% -> 0% | Helped |
| apply SafeCLIP pre-training instead of standard CLIP | CLIP · CC3M Blended backdoor | ASR: 100% -> 0.3% | Helped |
| apply SafeCLIP pre-training instead of standard CLIP | CLIP · MSCOCO TDPA | ASR: 62.5% -> 0% | Helped |
| replace RoCLIP with SafeCLIP | CLIP pre-training · Visual Genome TDPA | ASR: 37.5% -> 0% | Helped |
| use SafeCLIP rather than RoCLIP | CLIP · CC3M downstream linear probe, average over 10 datasets | average improvement: -8.3 -> +0.5 | Helped |
| use SafeCLIP rather than RoCLIP | CLIP · CC3M downstream zero-shot, average over 10 datasets | average improvement: -9.7 -> +0.9 | Helped |
| use 1 rather than 5 unimodal CL warmup epochs (ablation) | SafeCLIP · CC1M safe set after warmup | poison rate: 0.09% -> 1% | Hurt |
| increase unimodal CL warmup from 5 to 10 epochs (ablation) | SafeCLIP · CC1M safe set after warmup | poison rate: 0.09% -> 0.03% | Helped |
| omit the low-learning-rate CLIP epoch (ablation) | SafeCLIP · CC1M safe set after warmup | poison rate: 0.09% -> 12.28% | Hurt |
| apply one additional low-learning-rate CLIP epoch (ablation) | SafeCLIP · CC1M safe set after warmup | poison rate: 0.09% -> 6.8% | Hurt |
| omit unimodal CL on the risky set (ablation) | SafeCLIP · TDPA on CC1M, MSCOCO, and Visual Genome | ASR: 0% -> 12.5% | Hurt |
| remove the nearest-neighbor pool from unimodal CL (ablation) | SafeCLIP · TDPA on CC1M, MSCOCO, and Visual Genome | ASR: 0% -> 12.5% (CC1M); 0% -> 25.0% (MSCOCO and VG) | Hurt |
Surprising findings
- Applying an extra CLIP epoch at low learning rate before filtering reintroduces poisons into the safe set (6.8%), so the warmup must avoid extensive CLIP training.
- Applying CL-based cleaning to poisoned CLIP can increase attack success, because CL clusters backdoored images with their captions and CLIP loss then associates them more strongly.
Limitations
- Defense breaks down when poison rate is high (e.g., 0.5%), as poisons cannot be separated after warmup.
- Trains CLIP on only a fraction of data early on, so it relies on progressive safe-set growth to use full data.
- Hyperparameters tuned on the same datasets and attacks evaluated; only ResNet-50 and ViT-B/32 tested on limited setups.
Experimental setup
Baselines: CLIP RoCLIP
Builds on: CLIP NNCLR RoCLIP CleanCLIP SimCLR
Closest papers by meaning
- ToxicTextCLIP: Text-Based Poisoning and Backdoor Attacks on CLIP Pre-training (NeurIPS 2025 · similarity 0.93)
- Detecting Backdoor Samples in Contrastive Language Image Pretraining (ICLR 2025 · similarity 0.91)
- BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIP (CVPR 2024 · similarity 0.89)
- BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learning (CVPR 2024 · similarity 0.88)
- Demystifying CLIP Data (ICLR 2024 · similarity 0.87)
- CLIPure: Purification in Latent Space via CLIP for Adversarially Robust Zero-Shot Classification (ICLR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.