Research map / Vision-language and multimodal / Multimodal LLMs
Backdoor Cleaning without External Guidance in MLLM Fine-tuning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes BYE, an unsupervised data-filtering defense that flags backdoor-poisoned samples in MLLM fine-tuning by clustering low attention-entropy profiles from bimodal-separated layers, removing them before re-tuning.
Problem
Backdoor poisoning of user-submitted fine-tuning data in fine-tuning-as-a-service settings can implant patch-trigger backdoors into MLLMs, and existing defenses need clean data, labels, or auxiliary components.
Approach
Observes "attention collapse" (triggered inputs concentrate cross-modal attention from the first decoding token onto non-semantic image regions) and uses per-layer attention entropy, layers selected by a bimodal separation index, and GMM clustering to filter poisoned samples without any external supervision.
Key results
- On RSVQA with InternVL, BYE reduces ASR to 7.18% with CP 66.09%, versus Vanilla FT ASR 99.76%.
- BYE achieves ASR of 0.05% on ScienceQA with LLaVA while keeping CP at 89.64%, with F1 of 96.71 for poisoned-sample detection.
- BYE reports precision and recall above 99% on RSVQA for both LLaVA and InternVL backbones.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| filter poisoned training samples with BYE rather than using Vanilla FT | LLaVA-v1.5-7B · ScienceQA | ASR: 97.32 -> 0.05 | Helped |
| filter poisoned training samples with BYE rather than using Vanilla FT | LLaVA-v1.5-7B · IconQA | ASR: 87.85 -> 0.00 | Helped |
| filter poisoned training samples with BYE rather than using Vanilla FT | LLaVA-v1.5-7B · Flickr30k | ASR: 82.80 -> 1.40 | Helped |
| filter poisoned training samples with BYE rather than using Vanilla FT | LLaVA-v1.5-7B · RSVQA | ASR: 99.90 -> 0.00 | Helped |
| filter poisoned training samples with BYE rather than using Vanilla FT | InternVL2.5-8B · ScienceQA | ASR: 97.12 -> 8.97 | Helped |
| filter poisoned training samples with BYE rather than using Vanilla FT | InternVL2.5-8B · IconQA | ASR: 92.13 -> 6.87 | Helped |
| filter poisoned training samples with BYE rather than using Vanilla FT | InternVL2.5-8B · Flickr30k | ASR: 76.60 -> 12.40 | Helped |
| filter poisoned training samples with BYE rather than using Vanilla FT | InternVL2.5-8B · RSVQA | ASR: 99.76 -> 7.18 | Helped |
| use BSI threshold 2.0 instead of 0.0 (ablation) | BYE detection · ScienceQA | F1: 63.93 -> 96.71 | Helped |
| use BSI threshold 2.0 instead of 0.5 (ablation) | BYE detection · ScienceQA | F1: 78.95 -> 96.71 | Helped |
| use BSI threshold 2.0 instead of 1.0 (ablation) | BYE detection · ScienceQA | F1: 93.68 -> 96.71 | Helped |
| use BSI threshold 2.0 instead of 1.5 (ablation) | BYE detection · ScienceQA | F1: 94.16 -> 96.71 | Helped |
Surprising findings
- Fixed-threshold entropy filtering performs much worse than GMM or K-Means clustering (e.g., F1 of 28.99 vs 99.60 on RSVQA with LLaVA), and K-Means performs nearly identically to GMM.
Limitations
- Evaluated only as an offline preprocessing step; training-time or online integration is unexplored.
- Evaluation limited to single-stage fine-tuning; continual or task-transfer settings not studied.
- Only two MLLM backbones and four datasets with patch-based triggers were evaluated.
Experimental setup
Datasets: ScienceQA IconQA Flickr30k RSVQA
Benchmarks: ScienceQA IconQA Flickr30k RSVQA
Metrics: Clean Performance (accuracy / CIDEr) Attack Success Rate Precision Recall F1
Baselines: Vanilla FT Random Drop ZIP K-Means SentiNet
Builds on: SentiNet ZIP
Closest papers by meaning
- TCAP: Tri-Component Attention Profiling for Unsupervised Backdoor Detection in MLLM Fine-Tuning (ICML 2026 · similarity 0.92)
- Defense against Backdoor Attack on Pre-trained Language Models via Head Pruning and Attention Normalization (ICML 2024 · similarity 0.89)
- Simulate and Eliminate: Revoke Backdoors for Generative Large Language Models (AAAI 2025 · similarity 0.89)
- BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models (NeurIPS 2025 · similarity 0.88)
- Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shift (CVPR 2025 · similarity 0.88)
- Backdoor Token Unlearning: Exposing and Defending Backdoors in Pretrained Language Models (AAAI 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.