{"id":"2836af0d-7aaf-4b57-bf8c-8b6b82b062cb","arxiv_id":"2604.19083","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":7.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"ProjLens shows that backdoor parameters in MLLMs are encoded in low-rank subspaces of the projector and that embeddings shift toward the target direction with magnitude linear in input norm, activating only on poisoned samples.","lead":"ProjLens is a new interpretability framework that examines how backdoors get embedded in multimodal large language models specifically through their projector components during fine-tuning. If the mechanisms hold, it could guide more precise defenses against safety attacks in vision-language AI systems.","discovery_kind":"new_method","skeptic_critique":{"model":"grok-4.3","headline":"Low-rank subspace and norm-scaling observations lack interventional evidence of causality","rationale":"The reader's weakest assumption directly identifies the missing causal link and limited scope. The proposed concrete test would resolve whether the reported structures are drivers or artifacts, aligning with the low-confidence UNVERDICTED stance pending such checks.","tokens_in":1790,"tokens_out":277,"duration_ms":26813,"concrete_test":"Identify the top-k singular vectors of the projector update matrix for a backdoored model; zero those directions, then re-evaluate backdoor ASR on poisoned inputs and clean accuracy. If ASR falls >80% while clean performance drops <5%, the subspace is causal; otherwise the claim weakens.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim asserts that backdoor-critical parameters are encoded in a low-rank projector subspace and that semantic shifts scale linearly with input norm to produce selective activation. These are derived from post-hoc SVD analysis of weight differences and embedding trajectories across four poisoning variants. No ablation (e.g., masking the low-rank component or rescaling norms while holding other factors fixed) is reported to test necessity or sufficiency. The patterns could therefore be downstream correlates of the poisoning objective or projector initialization rather than the mechanistic drivers. Generalization is asserted beyond the tested variants and architectures without additional controls.","agreement_with_reader":"agree"},"referee_report":{"model":"grok-4.3","summary":"The paper proposes ProjLens, an interpretability framework to analyze backdoor mechanisms in Multimodal Large Language Models (MLLMs), with emphasis on the projector module. It establishes that downstream alignment via projector fine-tuning introduces backdoor vulnerabilities distinct from text-only LLMs, and reports empirical findings from four backdoor variants: backdoor injection updates are overall full-rank without dedicated trigger neurons, yet backdoor-critical parameters lie in a low-rank subspace of the projector; additionally, both clean and poisoned embeddings undergo semantic shifts toward a shared backdoor-target direction, with shift magnitude scaling linearly with input norm to produce selective activation on poisoned inputs.","tokens_in":1917,"tokens_out":637,"duration_ms":29267,"significance":"If the reported patterns hold under causal scrutiny, the work supplies useful empirical observations on projector subspaces and norm-dependent embedding trajectories that differentiate multimodal backdoors from unimodal cases. These could inform targeted defenses or alignment procedures in MLLMs. The public code link is a positive step toward reproducibility, though its anonymity currently limits verification.","major_comments":[{"comment":"Experiments section (four backdoor variants): The low-rank subspace claim rests on post-hoc SVD of weight differences, yet no ablation is described that masks or removes the identified low-rank components and re-measures attack success rate or activation; without such intervention, it is impossible to distinguish whether the subspace is mechanistically necessary or merely correlated with the poisoning objective.","section":"Experiments section"},{"comment":"Activation mechanism analysis: The statement that linear norm scaling 'results in' distinct backdoor activation is presented as explanatory, but the manuscript reports only observational trajectories of embedding shifts; no controlled test (e.g., rescaling input norms on clean samples while holding other factors fixed) is provided to establish necessity or sufficiency.","section":"Activation mechanism analysis"},{"comment":"Methods and results reporting: The abstract and experimental description claim 'extensive experiments' and low-rank quantification, but supply no details on statistical tests, baseline comparisons, variance across runs, or how low-rank structure was thresholded; this absence undermines assessment of whether the patterns are robust or specific to the four variants and architectures tested.","section":"Methods and results reporting"}],"minor_comments":[{"comment":"Abstract: The phrase 'lack dedicated trigger neurons' is introduced without a precise operational definition or comparison to prior LLM backdoor literature; a brief parenthetical clarification would improve readability.","section":"Abstract"},{"comment":"Code availability: The anonymous link is noted, but the paper would benefit from including a short pseudocode outline of the ProjLens analysis pipeline in the main text or appendix to aid readers before code access is granted.","section":"Code availability"}],"recommendation":"major_revision","confidential_remarks":"The manuscript's empirical focus fits the journal's security and interpretability scope, but the absence of interventional controls raises a concern about overclaiming mechanistic insight; a revised version addressing causality would strengthen the contribution substantially."},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the constructive feedback on ProjLens. The comments correctly identify gaps in causal validation and reporting details. We address each point below and will revise the manuscript accordingly to strengthen the claims with additional experiments and clarifications.","responses":[{"response":"We agree that the current SVD-based analysis demonstrates correlation between backdoor updates and a low-rank subspace but does not establish necessity. In the revision, we will add ablation studies: identify the low-rank components via SVD on the projector weight differences, mask or project them out, and re-evaluate attack success rate (ASR) on poisoned inputs as well as clean accuracy. This intervention will test whether removing the subspace suppresses backdoor activation while preserving general functionality, providing causal support for the mechanistic role.","revision_made":"yes","referee_comment":"[Experiments section] Experiments section (four backdoor variants): The low-rank subspace claim rests on post-hoc SVD of weight differences, yet no ablation is described that masks or removes the identified low-rank components and re-measures attack success rate or activation; without such intervention, it is impossible to distinguish whether the subspace is mechanistically necessary or merely correlated with the poisoning objective."},{"response":"We acknowledge that the manuscript currently reports observational linear scaling of embedding shifts with input norm, which correlates with selective activation on poisoned samples. To establish necessity and sufficiency, the revision will include controlled experiments: (i) rescale norms of clean embeddings to match poisoned levels while preserving semantics and measure if backdoor activation occurs; (ii) normalize poisoned input norms to clean levels and check suppression of activation. These tests will directly link the norm-dependent trajectory to the distinct activation behavior.","revision_made":"yes","referee_comment":"[Activation mechanism analysis] Activation mechanism analysis: The statement that linear norm scaling 'results in' distinct backdoor activation is presented as explanatory, but the manuscript reports only observational trajectories of embedding shifts; no controlled test (e.g., rescaling input norms on clean samples while holding other factors fixed) is provided to establish necessity or sufficiency."},{"response":"We agree that the current reporting lacks sufficient methodological transparency. In the revised manuscript, we will expand the Methods and Experiments sections with: statistical significance tests (e.g., paired t-tests across runs for low-rank ratios and shift magnitudes); baseline comparisons (e.g., against random subspaces and text-only LLM projectors); variance and standard deviations reported over at least five independent runs with different seeds; and explicit thresholding details for low-rank structure (e.g., cumulative explained variance threshold of 90% or singular value elbow criterion). These will be provided for all four backdoor variants and model architectures.","revision_made":"yes","referee_comment":"[Methods and results reporting] Methods and results reporting: The abstract and experimental description claim 'extensive experiments' and low-rank quantification, but supply no details on statistical tests, baseline comparisons, variance across runs, or how low-rank structure was thresholded; this absence undermines assessment of whether the patterns are robust or specific to the four variants and architectures tested."}],"tokens_in":1486,"tokens_out":659,"duration_ms":29960,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The core observation here is that backdoor parameters in these multimodal models concentrate in a low-rank subspace of the projector rather than spreading as dedicated trigger neurons, and that both clean and poisoned embeddings shift toward the target direction with the shift size scaling linearly by input norm. That pattern is presented as explaining selective activation on poisoned samples, and it differs from what shows up in text-only LLM backdoors. The work runs this across four poisoning variants and notes that even projector-only fine-tuning creates the vulnerability. Code release helps anyone who wants to replicate the SVD decompositions and embedding trajectories. Those details give a concrete handle on where the backdoor lives inside the architecture. The limitation is that everything comes from post-training analysis of weight deltas and activation paths. No reported interventions, such as masking the low-rank component or rescaling input norms while holding other factors fixed, check whether those patterns are necessary or sufficient for the backdoor behavior. The patterns could simply be downstream effects of the poisoning objective or the projector initialization rather than the driving mechanism. Generalization beyond the tested variants and models also rests on the same observational data. Readers working on multimodal safety or interpretability will find the projector focus and the norm-scaling detail useful to think about, even if they end up running their own controls. The paper is coherent on its own terms and engages the existing backdoor literature, so it deserves a serious referee who can ask for the missing ablation results.","headline":"The paper finds low-rank backdoor encoding and norm-linear semantic shifts in MLLM projectors, but the evidence stays observational without tests for causality.","tokens_in":2409,"tokens_out":360,"would_cite":false,"duration_ms":20416,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"Projectors in multimodal LLMs encode backdoors in low-rank subspaces with activation scaling linearly by input norm","keywords":["backdoor attacks","multimodal large language models","projector modules","model interpretability","safety vulnerabilities","low-rank subspaces","semantic shifts"],"falsifier":"An experiment that removes or orthogonalizes the low-rank subspace of the projector and then measures whether backdoor success rate drops to near zero while clean accuracy remains intact.","tokens_in":2711,"feed_emoji":"🔍","tokens_out":594,"duration_ms":44415,"temperature":0.7,"pith_summary":"The paper introduces ProjLens to examine how backdoor attacks succeed in multimodal large language models through projector modules. It establishes that standard fine-tuning for downstream tasks creates exploitable vulnerabilities whose activation differs from text-only LLMs. Experiments across four backdoor variants show that overall updates remain full-rank without dedicated trigger neurons, yet the critical backdoor parameters concentrate in a low-rank subspace of the projector. Both clean and poisoned embeddings shift toward a shared semantic direction aligned with the attack target, but the shift magnitude grows linearly with input norm, selectively triggering the backdoor only on poisoned inputs. This account matters because it identifies concrete structural and dynamic features that could guide targeted defenses.","feed_headline":"Backdoors hide in low-rank projector subspaces of MLLMs","feed_subtitle":"Semantic shifts scale linearly with input norm, activating only on poisoned samples","key_machinery":"The low-rank subspace of the projector module, which isolates backdoor-critical parameters and enforces linear scaling of semantic shifts with input norm to produce selective activation.","core_discovery":"ProjLens shows that backdoor injection updates appear full-rank overall and lack dedicated trigger neurons, but the backdoor-critical parameters are encoded within a low-rank subspace of the projector. Activation occurs because both clean and poisoned embeddings undergo a semantic shift toward a shared direction aligned with the backdoor target, with the shifting magnitude scaling linearly with the input norm and thereby producing distinct behavior on poisoned samples.","pith_inferences":["Targeting the low-rank subspace during fine-tuning or inference could suppress backdoors with limited impact on clean performance.","Norm regularization during alignment might reduce the linear scaling effect and thereby lower vulnerability.","The same subspace-plus-scaling pattern may appear in other multimodal architectures once the same analysis is applied."],"forward_implications":["Downstream projector fine-tuning alone introduces backdoor vulnerability in MLLMs.","Backdoors rely on subspace encoding rather than isolated trigger neurons.","Semantic shifts align to the target direction for both input types but only exceed the activation threshold on high-norm poisoned samples.","These projector mechanisms differ from backdoor activation patterns reported in text-only LLMs."],"fun_headline_variants":["Low-rank projector subspaces contain MLLM backdoor parameters","Full-rank updates encode low-rank backdoor signals in MLLM projectors","Embeddings shift to backdoor direction scaling with input norm","ProjLens explains distinct activation on poisoned MLLM samples"],"cache_read_input_tokens":64,"weakest_assumption_plain":"The observed low-rank encoding and linear norm scaling are causal drivers of backdoor behavior rather than side effects of the specific training setups and variants tested.","fun_headline_variants_meta":{"raw":{"variants":["Low-rank projector subspaces contain MLLM backdoor parameters","Full-rank updates encode low-rank backdoor signals in MLLM projectors","Embeddings shift to backdoor direction scaling with input norm","ProjLens explains distinct activation on poisoned MLLM samples"]},"model":"grok-4.3","cost_usd":0.007835,"raw_usage":{"total_tokens":3500,"prompt_tokens":678,"num_sources_used":0,"completion_tokens":68,"cost_in_usd_ticks":78353000,"prompt_tokens_details":{"text_tokens":678,"audio_tokens":0,"image_tokens":0,"cached_tokens":64},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":2754,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":678,"tokens_out":68,"duration_ms":34915,"temperature":1.0,"reasoning_tokens":2754,"cache_read_input_tokens":64,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-05-10T02:56:44.204577+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"An experiment that removes or orthogonalizes the low-rank subspace of the projector and then measures whether backdoor success rate drops to near zero while clean accuracy remains intact.","supporting_citations":[],"review_version":1}