Research map / Vision-language and multimodal / Multimodal LLMs
Backdooring Vision-Language Models with Out-Of-Distribution Data
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes VLOOD, a backdoor attack on VLMs (BLIP-2, MiniGPT-4, InstructBLIP) that injects triggers using only 3000 OOD image-text pairs while preserving conceptual consistency of outputs via knowledge distillation, an L1-based loss, and dynamic loss weighting.
Problem
Backdoor attacks on vision-language models for image-to-text generation typically damage output semantics and assume attackers have the original training data, which is unrealistic.
Approach
Injects backdoors with only OOD data by combining a KL-based clean knowledge preservation loss (distilling from the benign model), an L1-embedding conceptual consistency loss on poisoned samples, and a dynamically adjusted weight λ balancing clean and poisoned losses.
Key results
- On Flickr8k captioning, VLOOD keeps clean CIDEr at 115.0 (vs 113.5 clean model) with ASR 0.000 on clean inputs and poisoned-input CIDEr 110.7 with ASR 0.999.
- On VQAv2, VLOOD reaches poisoned-input V score 56.6 with ASR 0.983, while clean-input ASR drops to 0.007 (vs 0.465 for Poisoning).
- On MiniGPT-4, VLOOD achieves poisoned ASR 0.999 with poisoned CIDEr 110.3, whereas Blended and Shadowcast reach ASR 1.000 but poisoned CIDEr about 6.9.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add CKP to the default LM-loss method (ablation) | VLOOD training on Flickr8k · Flickr8k image captioning, poisoned inputs | ASR: 0.999 -> 0.000 | Hurt |
| Add CCP to the default LM-loss method (ablation) | VLOOD training on Flickr8k · Flickr8k image captioning, clean inputs | ASR: 0.000 -> 0.852 | Hurt |
| Add dynamically adjusted weights to the default LM-loss method (ablation) | VLOOD training on Flickr8k · Flickr8k image captioning, clean inputs | CIDEr: 111.9 -> 104.0 | Hurt |
| Replace CKP with LM(clean) loss (ablation) | VLOOD · Flickr8k image captioning, clean inputs | ASR: 0.000 -> 0.983 | Hurt |
| Replace CCP with LM(poisoned) loss (ablation) | VLOOD · Flickr8k image captioning, clean inputs | CIDEr: 115.0 -> 103.7 | Hurt |
| Replace both CKP and CCP with their LM-loss alternatives (ablation) | VLOOD · Flickr8k image captioning, clean inputs | CIDEr: 115.0 -> 109.7 | Hurt |
| Add CCP to Default + CKP without dynamic weights (ablation) | VLOOD · Flickr8k image captioning, poisoned inputs | ASR: 0.000 -> 0.000 | No clear effect |
| Add dynamically adjusted weights to Default + CKP + CCP (ablation) | VLOOD · Flickr8k image captioning, poisoned inputs | ASR: 0.000 -> 0.999 | Helped |
| Replace CCP's L1 distance with cosine similarity (ablation) | VLOOD · Flickr8k image captioning, clean inputs | CIDEr: 115.0 -> 104.0 | Hurt |
| Replace CKP's KL divergence with cosine similarity (ablation) | VLOOD · Flickr8k image captioning, clean inputs | CIDEr: 115.0 -> 2.2 | Hurt |
| Replace CKP's KL divergence with MSE (ablation) | VLOOD · Flickr8k image captioning, clean inputs | CIDEr: 115.0 -> 103.6 | Hurt |
| Replace CKP's KL divergence with JSD (ablation) | VLOOD · Flickr8k image captioning, clean inputs | CIDEr: 115.0 -> 110.5 | Hurt |
Surprising findings
- Spectral Signatures and Beatrix defenses fail to remove the backdoor, with ASR staying at 0.999 for VLOOD.
- Adding CKP alone or with CCP without dynamic weighting drives poisoned ASR to 0, showing the clean-preservation loss can wash out the backdoor.
Limitations
- Evaluation relies on ChatGPT (GPT-4) judgments for conceptual consistency, which the authors note is not infallible.
- Attacker assumes white-box access to the benign model for distillation and only evaluates a fixed pixel-pattern trigger.
- Defenses evaluated are only two feature-space filtering methods; no defenses designed for VLMs exist.
Experimental setup
Datasets: Flickr8k Flickr30k COCO OK-VQA VQAv2
Benchmarks: Flickr8k Flickr30k COCO OK-VQA VQAv2
Metrics: BLEU@4 METEOR ROUGE-L CIDEr VQA score ASR
Baselines: BadNet Blended Poisoning BadEncoder Shadowcast AnyDoor
Builds on: BLIP-2 knowledge distillation BadNet Shadowcast
Closest papers by meaning
- Semantic Shield: Defending Vision-Language Models Against Backdooring and Poisoning via Fine-grained Knowledge Alignment (CVPR 2024 · similarity 0.90)
- Attention! Your Vision Language Model Could Be Maliciously Manipulated (NeurIPS 2025 · similarity 0.90)
- SEER: Backdoor Detection for Vision-Language Models through Searching Target Text and Image Trigger Jointly (AAAI 2024 · similarity 0.90)
- FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts (AAAI 2025 · similarity 0.90)
- Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shift (CVPR 2025 · similarity 0.89)
- Membership Inference Attacks against Large Vision-Language Models (NeurIPS 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.