Research map / Adversarial robustness and security / Backdoor and poisoning
Backdoors in large multimodal models
Attack and analyze backdoors in LLMs, vision-language and action models.
104 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2016–2026) · an approach in Backdoor and poisoning, keyword cluster “backdoor attack · poisoning · triggers”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
28 papers in 2023–24 and 69 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic grew, from 26.2% to 46.3%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2016 · Is It Harmful When Advisors Only Pretend to Be Honest? (AAAI 2016 · 6 citations)
- 2021 · Qu-ANTI-zation: Exploiting Quantization Artifacts for Achieving Adversarial Outcomes (NeurIPS 2021 · 3 citations)
- 2022 · Backdoor Attacks on Self-Supervised Learning (CVPR 2022 · 88 citations)
- 2023 · TrojViT: Trojan Insertion in Vision Transformers (CVPR 2023 · 46 citations)
- 2024 · BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learning (CVPR 2024 · 32 citations)
- 2025 · Watch Out for Your Guidance on Generation! Exploring Conditional Backdoor Attacks against Large Language Models (AAAI 2025 · 8 citations)
- 2026 · Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples (NeurIPS 2026 · 7 citations)
Earliest papers here
- Is It Harmful When Advisors Only Pretend to Be Honest? (AAAI 2016 · 6 citations)
- Qu-ANTI-zation: Exploiting Quantization Artifacts for Achieving Adversarial Outcomes (NeurIPS 2021 · 3 citations)
- Backdoor Attacks on Self-Supervised Learning (CVPR 2022 · 88 citations)
What has been tried
55 papers here report 579 measured changes (a component added, removed or swapped, compared with a baseline): helped 57%, no clear effect 14%, hurt 24%, mixed 5%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Use textual consistency loss Lt alone | ImageNet-1K val zero-shot, CleanCLIP · ASR | 44.30 -> 74.47 | Helped | BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learning (CVPR 2024 · 32 citations) |
| Increase trigger magnitude constraint ϵ | CIFAR-10 · ASR | Helped | Backdoor Attacks via Machine Unlearning (AAAI 2024 · 28 citations) | |
| Use trigger-aware prompts rather than trigger-agnostic prompts | Unseen classes (11-dataset average) · ASR | 2.21 -> 99.02 | Helped | BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIP (CVPR 2024 · 24 citations) |
| Increase the number of mismatched target images | Backdoor ASR · ASR | 0.01 -> 0.75 -> 1.00 | Helped | Personalization as a Shortcut for Few-Shot Backdoor Attack against Text-to-Image Diffusion Models (AAAI 2024 · 23 citations) |
| Increase attacking vehicles from one to four | Argoverse validation · tASR | 91.11 -> 98.02 | Helped | Adversarial Backdoor Attack by Naturalistic Data Poisoning on Trajectory Prediction in Autonomous Driving (CVPR 2024 · 18 citations) |
| Remove mutual-information trigger tuning | Breakout (0.003% poisoning) · ASR | 100.00±0.00% -> 3.99±6.42% | Hurt | BadRL: Sparse Targeted Backdoor Attack against Reinforcement Learning (AAAI 2024 · 11 citations) |
| poison the target and untargeted classes rather than the target class only | miniImageNet · ASR | 54.0 -> 89.1 | Helped | Does Few-Shot Learning Suffer from Backdoor Attacks? (AAAI 2024 · 11 citations) |
| Increase OAA poison ratio from 1% to 20% (default) | Flir v2 T · ASR (%) | 52.83 -> 97.87 | Helped | Physical Backdoor: Towards Temperature-based Backdoor Attacks in the Physical World (CVPR 2024 · 11 citations) |
| Add the switch token | CIFAR-100 · BA | 36.64 -> 76.36 | Helped | Not All Prompts Are Secure: A Switchable Backdoor Attack Against Pre-trained Vision Transfomers (CVPR 2024 · 9 citations) |
| Select the most harmful examples for poisoning instead of random examples | Reward model poisoned test set at 3% poisoning · accuracy (%) | 38.2 -> 29.0 | No clear effect | Universal Jailbreak Backdoors from Poisoned Human Feedback (ICLR 2024 · 8 citations) |
| Train with multiple simultaneous attack targets | Image caption, Token-substitution and Token-addition · ASR | 89%; 99%; 95%; 100% | Helped | BadToken: Token-level Backdoor Attacks to Multi-modal Large Language Models (CVPR 2025 · 7 citations) |
| remove the transferability-based filter | CIFAR-10 (five advanced attacks) · detection accuracy | 89.4 -> 84.2 | Hurt | UMA: Facilitating Backdoor Scanning via Unlearning-Based Model Ablation (AAAI 2024 · 5 citations) |
What reviewers will expect
Datasets and baselines named in the 33 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- AdvBench · 6 of 33 papers
- CIFAR-10 · 4 of 33 papers
- SST-2 · 4 of 33 papers
- ImageNet · 3 of 33 papers
- Alpaca · 3 of 33 papers
- CIFAR100 · 2 of 33 papers
- MT-Bench · 2 of 33 papers
- STL10 · 2 of 33 papers
Baselines
- ONION · 5 of 33 papers
- BadNet · 3 of 33 papers
- WaNet · 3 of 33 papers
- Blended · 3 of 33 papers
- BadNets · 3 of 33 papers
- GCG · 3 of 33 papers
- ISSBA · 2 of 33 papers
- ABL · 2 of 33 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 97 papers; from OpenAlex and the papers' affiliations).
- Nanyang Technological University · 7 papers
- Zhejiang University · 5 papers
- Tsinghua University · 4 papers
- Chinese Academy of Sciences · 3 papers
- University of Chinese Academy of Sciences · 3 papers
- University of Oxford · 3 papers
- National University of Singapore · 3 papers
- Beihang University · 3 papers
- Huazhong University of Science and Technology · 3 papers
- Pennsylvania State University · 3 papers
Use it
Download BibTeX of 29 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Trigger-based backdoor attacks (106 papers)
- Backdoors in federated learning (16 papers)
Elsewhere in the topic
- Detecting poisoned samples (54 papers)
- Training-time backdoor defense (40 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).