Research map / Vision-language and multimodal / Multimodal LLMs

Echoes of Ownership: Adversarial-Guided Dual Injection for Copyright Protection in MLLMs

CVPR 2026 · Vision-language and multimodal › Multimodal LLMs · approach: Unified any-modality language models · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes AGDI, a black-box copyright tracking method that optimizes an adversarial trigger image on an MLLM with response-level and CLIP-based semantic injections plus adversarial model updates, so that fine-tuned derivatives output an ownership target while non-derivative models do not.

Problem

Black-box copyright tracking for MLLMs: publishers need verifiable ownership triggers that survive downstream fine-tuning and merging/pruning of derivative models while not firing on unrelated non-derivative MLLMs.

Approach

Treats the trigger image as a learnable tensor optimized with two injections: a cross-entropy loss forcing the MLLM to output a rare target answer, and a CLIP-feature cosine loss aligning the image with the target text (assumed stable across fine-tuning), plus a min-max adversarial update of the model parameters that simulates fine-tuning resistance.

Key results

• On LoRA-fine-tuned Qwen2-VL, AGDI reaches 53%-81% ASR across five downstream datasets versus 48%-76% for PLA (best baseline).
• On LLaVA-1.5 LoRA variants, AGDI achieves 64% ASR on V7W and 79% on PaintingF, vs 51% and 55% for PLA.
• Triggers yield 0% ASR on non-derivative MLLMs (MiniGPT-4, Qwen2-VL, LLaVA-1.6, Llama3-V), the same as RNA and PLA.

Surprising findings

• Removing the semantic-level CLIP injection leaves ASR unchanged for LLaVA-1.5 LoRA variants (identical to full AGDI-minus-sem numbers for PLA), while removing the response-level injection drops ASR to near 0%.

Limitations

• Evaluated only on a small set of base models (LLaVA-1.5-7B, Qwen2-VL-2B, InternVL3.5) and five QA triggers; ASR remains modest (often under 60% on full fine-tuning).
• Robustness to input transformations drops substantially (e.g., JPEG reduces V7W from 64% to 40%).
• Hardware and compute budget not reported.

Experimental setup

Datasets: ImageNet-1K V7W ST-VQA TextVQA MathV360k PaintingForm RSVQA DriveLM FinVis PathVQA SciVerse

Benchmarks: V7W ST-VQA TextVQA PaintingForm MathV360k PathVQA DriveVQA FinVis RSVQA SciVerse

Metrics: ASR (attack success rate)

Baselines: Ordinary RNA PLA IF

Builds on: PLA PGD Wanda

Closest papers by meaning

• Tracking the Copyright of Large Vision-Language Models through Parameter Learning Adversarial Images (ICLR 2025 · similarity 0.90)
• Can Watermarking Large Language Models Prevent Copyrighted Text Generation and Hide Training Data? (AAAI 2025 · similarity 0.86)
• Bridging the Copyright Gap: Do Large Vision-Language Models Recognize and Respect Copyrighted Content? (AAAI 2026 · similarity 0.86)
• The Stronger the Diffusion Model, the Easier the Backdoor: Data Poisoning to Induce Copyright BreachesWithout Adjusting Finetuning Pipeline (ICML 2024 · similarity 0.85)
• Watermark-embedded Adversarial Examples for Copyright Protection against Diffusion Models (CVPR 2024 · similarity 0.84)
• SCOPE: Intrinsic Semantic Space Control for Mitigating Copyright Infringement in LLMs (AAAI 2026 · similarity 0.84)