Research map / Vision-language and multimodal / Multimodal LLMs

TCAP: Tri-Component Attention Profiling for Unsupervised Backdoor Detection in MLLM Fine-Tuning

ICML 2026 · Vision-language and multimodal › Multimodal LLMs · approach: Unified any-modality language models

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes TCAP, an unsupervised backdoor-sample detector for MLLM fine-tuning that profiles per-head attention allocation across system, vision, and text components with GMM separation scores and Dawid-Skene voting, then retrains on the filtered data.

Problem

Backdoor poisoning of user-submitted fine-tuning data in Fine-Tuning-as-a-Service for MLLMs; existing defenses need supervision or generalize poorly across trigger types (global blend, WaNet, FTrojan, textual) and modalities.

Approach

Identifies "attention allocation divergence" across three functional components (system instructions, vision, text) in deeper-layer heads as a trigger-agnostic fingerprint; scores heads by GMM separation on the system-attention share and aggregates per-head GMM votes with Dawid-Skene EM to flag poisoned samples without labels.

Key results

• On Blend attacks, TCAP reduces ASR to 0.00-0.33% on DocVQA and PhD for Qwen3-VL while keeping clean performance (e.g., 90.57% CP on DocVQA), whereas BYE drops to 0.00% accuracy on ScienceQA and PhD with LLaVA-NeXT.
• Detection F1 on ScienceQA across BadNet, Blend, SIG, WaNet, FTrojan reaches 85-100 for TCAP on the three MLLMs, while BYE often falls below 25.
• Ablation on Blend shows removing head selection drops F1 from 98.85 to 22.31 on LLaVA-NeXT.

Surprising findings

• Blended triggers can raise rather than lower attention entropy, so entropy-based BYE fails and even discards clean samples on LLaVA-NeXT (0.00% detection on ScienceQA and PhD).
• Using all layers instead of the last 8 causes F1 on SIG to fall to 13.73%.

Limitations

• Detection of SIG attacks is weaker in recall (about 82%) than other attacks.
• Evaluated only on 8B-scale MLLMs with a single fixed backdoor target output and a 10% poisoning rate (poison-rate ablation only on LLaVA-NeXT).
• Hyperparameters (L_sens=8, H_sens=10, tau_vote=1e-4) were selected on the same evaluation setup, with sensitivity shown mainly for ScienceQA.

Experimental setup

Datasets: ScienceQA PhD DocVQA Recap-COCO SEED-Bench

Benchmarks: ScienceQA PhD DocVQA Recap-COCO SEED-Bench

Metrics: Clean Performance Attack Success Rate Precision Recall F1

Baselines: Vanilla FT Random Drop SampDetox BYE SentiNet

Builds on: BYE SentiNet Dawid-Skene model LoRA

Closest papers by meaning

• Backdoor Cleaning without External Guidance in MLLM Fine-tuning (NeurIPS 2025 · similarity 0.92)
• Lie Detector: Unified Backdoor Detection via Cross-Examination Framework (NeurIPS 2025 · similarity 0.86)
• Defense against Backdoor Attack on Pre-trained Language Models via Head Pruning and Attention Normalization (ICML 2024 · similarity 0.86)
• A Closer Look at Backdoor Attacks on CLIP (ICML 2025 · similarity 0.86)
• Backdoor Attacks in Token Selection of Attention Mechanism (ICML 2025 · similarity 0.86)
• Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shift (CVPR 2025 · similarity 0.85)