{"id":"d2d9338a-c245-4bbb-8f29-af631ccf8b80","arxiv_id":"2607.25479","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Trigger-gated additive steering vectors embedded in VLM architecture definitions create dormant backdoors that work across VQA, text-to-image, retrieval, and brand/safety biasing without data poisoning.","lead":"This paper shows that a malicious model provider can hide a trigger-activated steering vector inside a vision-language model's architecture, so the model behaves normally until a secret word appears, then shifts its outputs toward an attacker-chosen behavior. The attack works across question answering, image generation, and retrieval, and the authors propose an auditing defense that watches for abnormal internal activations.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Stealth claim is load-bearing and untested: PyTorch buffers appear in state_dict, but the user study never gave reviewers a checkpoint to inspect.","rationale":"The reader's weakest_assumption — that buffers are visible in state_dict and the user study does not cover checkpoint inspection — is exactly the load-bearing soft spot. The paper's own Section III-D explicitly claims the buffer mechanism keeps the payload outside trainable parameters inspectable by Netron/torchviz, but state_dict inspection is a standard and trivial operation. Listing 1 names the buffers in a way that would be immediately suspicious, and even with innocuous names, extra buffers are a clear diff signal. The user study's design (isolated model-definition files only) is acknowledged in the paper's limitations, but that limitation is precisely where the stealth claim fails to be tested. I agree with the reader that the behavioral attack and high ASR are credible and well-evidenced; the concern is specifically about the 'evade routine inspection' claim, which should be conditioned on the defender not inspecting state_dict. This is an addressable experimental gap, not a fundamental flaw, so the verdict should remain CONDITIONAL rather than moving to acceptance or rejection.","tokens_in":26593,"tokens_out":8142,"duration_ms":92030,"concrete_test":"Load the released backdoored checkpoint with AutoModel.from_pretrained (or torch.load) and diff its state_dict against the official clean checkpoint: print all keys, shapes, and L2 norms, flagging any extra or non-zero buffers. If 'trigger_ids'/'steering_vector' or equivalent entries appear and a simple automated diff catches them, the backdoor is trivially detectable by checkpoint inspection. To fully settle, rerun the user study with participants given the state_dict dump alongside the model definition, not just source files.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central attack mechanism is credible, but the paper's 'dormant' and 'evade routine inspection' claims rest on the assertion (Section III-D) that registering the trigger detector and steering vector as PyTorch buffers keeps them outside inspectable parameters. This is not correct as stated: buffers are persistent entries in state_dict. Listing 1 registers 'trigger_ids' and 'steering_vector' as buffers; after the attack is embedded, the latter is non-zero. A defender who loads the checkpoint and compares state_dict keys/values against the official release can spot the extra tensors immediately, without needing Netron or torchviz. The user study (Section VI) gave participants only isolated model-definition files — not state_dict dumps, checkpoints, or full repositories — so it never tests the most direct detection route. If a routine state_dict diff reveals the payload, the stealth half of the contribution collapses, even though the behavioral attack still works. The paper itself acknowledges the defense limitation only for adaptive attackers, not this static-inspection gap. This does not invalidate the existence claim, but it makes the 'evade routine inspection' part of the headline conditional at best.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces a new class of architectural backdoors for vision-language models (VLMs), called representation-steering backdoors. The attacker inserts a trigger-gated additive update into an intermediate layer of a model's architecture. The trigger detector is implemented with differentiable operators, and the steering vector is the difference between mean representations of benign and attacker-chosen prompt sets. When the trigger is absent, the update is zero, preserving clean utility. When present, the model's behavior shifts toward the attacker's objective. The attack is evaluated on VQA (refusal, safety confounding, brand hallucination), text-to-image generation (nudity, violence), and text-image retrieval (demographic ranking bias), across CLIP, BLIP, T5, LLaVA, Qwen3-VL, SD 2.1/3.5, and FLUX. The paper also reports a user study on code-review detectability and proposes an Isolation-Forest detector on hidden-state trajectories.","tokens_in":26917,"tokens_out":6608,"duration_ms":65987,"significance":"This is a timely and important contribution to the security of the VLM supply chain. The attack is training-data-free and does not require control over fine-tuning or deployment-time prompts, making it a realistic threat for third-party model reuse. The empirical breadth is strong: high ASR across multiple architectures and tasks, with good clean-utility preservation on several datasets. The paper also ships code, and the proposed defense is a sensible first step toward auditing executable model logic. If the stealth claims are appropriately qualified, this work advances the state of the art in architectural backdoors and provides a useful benchmark for future defenses.","major_comments":[{"comment":"The claim that registering the payload as PyTorch buffers places it 'outside the list of trainable parameters that users can inspect with tools like Netron or torchviz' (Sec. III-D) is misleading. Buffers are persistent entries in state_dict; a checkpoint diff reveals the non-zero steering_vector and the extra trigger detector. The user study (Sec. VI) only supplied model-definition files, not state_dict dumps or full repositories, so it does not test the most direct static detection route. The abstract's 'evade routine inspection' claim is therefore not established. Please either temper the claim to 'evade model-definition code review' or provide evidence that state_dict inspection is not part of routine practice.","section":"III-D, VI"},{"comment":"Table I reports Acc for backdoored models but no clean baseline Acc. The text states 'Acc on clean inputs remains unchanged compared to the baselines' (Sec. V), but the reader cannot verify this from the table. Add a clean-baseline column or report the baseline accuracy in the text, e.g., as a footnote or in an appendix, for each model/dataset row. This is load-bearing for the clean-utility preservation claim.","section":"V, Table I"},{"comment":"The trigger detector in Listing 1 registers trigger_ids as torch.zeros(hidden_size), but Eq. (5) defines τ as a scalar token identifier. The code as written would either fail due to shape mismatch (input_ids and a hidden_size vector) or would not match a specific trigger. This makes the central mechanism's illustrative implementation non-functional. Please correct the listing to use a scalar trigger ID (e.g., torch.tensor(trigger_id)) and align it with Eq. (5).","section":"III-D, Listing 1"},{"comment":"The Ring-a-Bell (RAB) evaluation uses only 44 prompts. Values such as +54.5pp or 100% for violence correspond to small absolute counts. No confidence intervals or repeated runs are reported, so the cross-dataset comparison for T2I generation is fragile. Report raw counts or confidence intervals for small evaluations, and state the sample size in the table caption.","section":"V-B, Table II"}],"minor_comments":[{"comment":"The model name 'LLaV A' appears with a spurious space; it should be 'LLaVA' consistently.","section":"Throughout"},{"comment":"The cross-reference 'Appendix III-C' should be 'Sec. III-C' or a proper appendix number. The appendix numbering in the text (e.g., 'Appendix A.22') is unclear.","section":"IV-A1"},{"comment":"The phrase 'without modifying prompts at deployment time' is potentially confusing since the trigger token is inserted into evaluation prompts. Clarify that the attacker does not modify prompts at runtime; the trigger appears in user-supplied input.","section":"Abstract/I"},{"comment":"The claim 'the first architectural backdoor for VLMs' is strong given prior architectural backdoor work. Suggest softening to 'the first representation-steering architectural backdoor for VLMs' or explicitly distinguishing the novel mechanism.","section":"Introduction"},{"comment":"For the Ring-a-Bell dataset, only 44 prompts were retained. State this sample size directly in the main text or table caption to avoid misleading percentage comparisons.","section":"IV-B"}],"recommendation":"major_revision","confidential_remarks":"The paper presents a credible and well-scoped attack, and the empirical evaluation is extensive. However, the stealth claim is a central contribution and it is not supported by the current evidence, because the state_dict visibility issue is not addressed. The code listing inconsistency in Sec. III-D also needs fixing before publication. I recommend major revision rather than rejection, since these issues are fixable and the core attack mechanism appears sound."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"This paper is worth taking seriously. The central result is real: a trigger-gated additive steering vector embedded in a VLM architecture can survive ordinary downstream reuse and shift behavior across VQA, T2I generation, retrieval ranking, and safety/brand tasks, without data poisoning, fine-tuning control, or runtime prompt modification. The attack works, and the range of evaluated models and tasks is unusually broad.\n\nWhat is genuinely new is the adaptation to VLMs: the paper takes the difference-of-means steering idea from Arditi et al. and makes it multimodal by pairing prompts with a constant neutral image. The appendix comparison of unimodal versus multimodal vectors (Table VII) is a good empirical point, and the distribution-channel discussion is realistic. The hidden-state trajectory defense is a reasonable first attempt, and the user study is honestly scoped — it only claims to measure file-level code review, not full repository audits.\n\nThe soft spots are real but mostly addressable. Table I reports accuracy for backdoored models without showing the clean baselines, so the \"clean utility preserved\" claim has to be taken on faith. There are no error bars or multiple runs, and some evaluation sets are very small — Ring-a-Bell has 44 prompts. The steering strength and injection layer are tuned per model and task, which is acceptable for an attack paper but weakens the generalization claim.\n\nThe larger problem is the stealth claim, and the stress-test note is right. Listing 1 registers trigger_ids and steering_vector as PyTorch buffers; buffers are persistent entries in state_dict. After the payload is embedded, steering_vector is non-zero. A defender who compares state_dict keys and values against the official release will see the extra tensor immediately, with no need for Netron or torchviz. The paper's statement that buffers are \"outside the list of trainable parameters that users can inspect\" is technically true but misses the point. The user study gave participants only isolated model-definition files, never checkpoints or state_dict dumps, so it did not test the most direct detection route. This does not invalidate the attack — a backdoor that survives distribution and reuse is still a threat even if a determined inspector can find it — but it means the \"evade routine inspection\" part of the contribution is conditional.\n\nFor peer review: send it out. A serious referee can push for clean baselines, error bars, and a state_dict-inspection experiment, and the paper should soften its stealth language. The core contribution is solid and the attack surface is important for ML security and VLM supply chains.","headline":"A credible and broad architectural-backdoor attack for VLMs; the existence claim holds, but the stealth claim is oversold because PyTorch buffers are visible in state_dict and the user study never tested that.","tokens_in":27377,"tokens_out":1848,"would_cite":true,"duration_ms":22920,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A malicious model provider can embed a trigger word into a vision-language model's architecture, so any downstream service reusing the artifact behaves normally until the trigger appears, then shifts outputs toward an attacker-defined objec","keywords":["architectural backdoor","representation steering","vision-language models","model supply chain security","trigger-gated additive update","multimodal backdoor","model artifact auditing","hidden-state trajectory detection"],"falsifier":"List every named buffer in the state dictionary of a distributed backdoored artifact: if a non-zero buffer containing trigger IDs and a steering vector is present, then any defender who checks saved tensors rather than only trainable parameters will find the backdoor before deployment. A complementary test: give reviewers the complete repository—checkpoint files, loading script, and dependency tree—and measure detection time; if detection becomes routine, the paper's 'evades routine inspection' claim is falsified for that distribution channel.","tokens_in":26512,"feed_emoji":"🔀","tokens_out":5173,"duration_ms":57307,"temperature":0.7,"pith_summary":"This paper tries to establish that the standard practice of reusing pretrained vision-language-model artifacts is a security boundary: a provider can embed a dormant, trigger-gated steering mechanism directly in the model's executable logic, and every downstream service that reuses the artifact inherits the backdoor. The key move is to add a term s·T(x) to an intermediate representation, which is exactly zero on clean inputs and activates only when a chosen token appears. The authors demonstrate high success across several model families and tasks without poisoning data, controlling downstream fine-tuning, or touching deployment prompts. If true, a downloaded model can look completely normal on every clean benchmark and still act as a reliable remote-control device for an attacker who knows the trigger.","feed_headline":"A hidden vector can remotely steer any downstream VLM task","feed_subtitle":"No poisoned data, fine-tuning, or prompt access needed: the backdoor sleeps through clean benchmarks and wakes on one trigger word.","key_machinery":"The central mechanism is 'trigger-gated representation steering': a gated additive update to an intermediate hidden state. The trigger detector T(x) is implemented entirely with standard differentiable operators—a sigmoid over the distance between input token IDs and a fixed trigger ID, aggregated by a max—so it looks like ordinary tensor computation. The steering direction s is constructed as the scaled difference of mean representations between attacker-chosen and benign prompt sets, λ(μ_A − μ_B), and is stored as a non-trainable buffer in the model artifact. This combination makes the malicious behavior dormant, parameter-free, and effective without any access to downstream data, fine-tun","core_discovery":"A vision-language model artifact can carry an architectural backdoor implemented as a trigger-gated additive steering vector. Formally, the modified intermediate representation is eφ_i(x) = φ_i(x) + s·T(x), where T(x) is a differentiable detector that returns ~1 when a chosen token appears anywhere in the input and ~0 otherwise, and s is a precomputed difference-of-means steering direction. When T(x)=0 the model's computation is unchanged, preserving clean utility; when T(x)=1 the representation is shifted toward an attacker-defined behavior. The authors show that this dormant logic, embedded in the model definition and state dictionary rather than in training data or weights, can induce ref","pith_inferences":["If this attack style becomes common, verification should shift from inspecting trainable weights to inspecting the full executable graph and the state dictionary: a cheap first defense would be a linter that flags unexpected non-zero buffers whose names suggest trigger or steering content.","The same trigger-gated additive update is a generic residual-stream intervention, so the mechanism likely transfers to any model with token IDs and residual hidden states, including encoder-only retrieval systems beyond the families explicitly tested.","Because the trigger detector is implemented in differentiable operators, downstream techniques such as quantization, distillation, or pruning could accidentally alter or destroy the trigger behavior; whether this weakens or breaks the attack is an unexamined, testable question.","The paper's own user study, as the authors note, gave reviewers only isolated model-definition files; a stronger test—giving defenders the full repository, checkpoints, and loading workflow—would measure whether the 'evades routine inspection' claim survives realistic audit conditions."],"forward_implications":["A single compromised VLM artifact can simultaneously affect multiple downstream services—question answering, text-to-image generation, retrieval, and safety filtering—without any per-service adaptation by the attacker.","Because clean inputs are mathematically unaffected, standard benchmark evaluation before deployment will not reveal the backdoor; attackers can tune the steering strength to keep clean performance unchanged.","The trigger need not be a conspicuous word: visually identical Unicode characters (e.g., a Cyrillic 'o' in place of Latin 'o') can activate the backdoor while evading content filters and casual review.","Runtime auditing of layer-to-layer hidden-state trajectories can detect trigger-activated steering at high rates, but the authors note that an adaptive attacker could dilute this signal by spreading the intervention across layers.","Distribution channels that execute custom model code during loading—standard for many widely used checkpoints—make the compromised artifact operationally indistinguishable from a legitimate one."],"fun_headline_variants":["Dormant backdoor in VLM artifacts wakes on one trigger word","Model supply chain backdoor: a trigger token flips VLM behavior","Hidden steering vector in VLM artifacts hijacks any downstream task","Backdoor in VLM supply chain sleeps through benchmarks, wakes on trigger","Single trigger word redirects VLM outputs via dormant architecture"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The stealth claim rests on the assumption that the trigger detector and steering vector, stored as non-trainable buffers, escape routine inspection; the paper's user study only gave reviewers isolated model-definition files, not full repositories or saved checkpoints, so it never tests whether a defender who inspects the loaded tensors would immediately see a non-zero buffer holding the trigger IDs and steering vector.","fun_headline_variants_meta":{"raw":{"variants":["Dormant backdoor in VLM artifacts wakes on one trigger word","Model supply chain backdoor: a trigger token flips VLM behavior","Hidden steering vector in VLM artifacts hijacks any downstream task","Backdoor in VLM supply chain sleeps through benchmarks, wakes on trigger","Single trigger word redirects VLM outputs via dormant architecture"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000524,"raw_usage":{"total_tokens":2392,"prompt_tokens":787,"completion_tokens":1605,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":531,"completion_tokens_details":{"reasoning_tokens":1514}},"tokens_in":531,"tokens_out":1605,"duration_ms":10925,"temperature":1.0,"reasoning_tokens":1514,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-01T02:17:22.466171+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"List every named buffer in the state dictionary of a distributed backdoored artifact: if a non-zero buffer containing trigger IDs and a steering vector is present, then any defender who checks saved tensors rather than only trainable parameters will find the backdoor before deployment. A complementary test: give reviewers the complete repository—checkpoint files, loading script, and dependency tree—and measure detection time; if detection becomes routine, the paper's 'evades routine inspection' claim is falsified for that distribution channel.","supporting_citations":[],"review_version":1}