Pith. sign in

REVIEW 4 major objections 4 minor 53 references

Once Poisoned, Arbitrarily Controlled: A Programmable Backdoor in VLMs

T0 review · 4 major / 4 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A single poisoning phase can implant a programmable backdoor whose target caption is chosen after training, and a synthesized stealthy trigger activates it on arbitrary images.

desk verdict A genuinely new any-to-any VLM backdoor with a strong poisoning story, held back by an under-specified surrogate encoder and threshold tuning that needs referee attention. read the letter →

arxiv 2608.10959 v1 pith:URLHGLKR submitted 2026-08-11 cs.CV cs.CR

Tao Lin , Gaojie Jin , Zongxin Liu , Peng Wu , Lijia Yu This is my paper · ORCID
classification cs.CVcs.CR
keywords backdoorattackvision-languagemodelimagecaptioningdatapoisoningtriggersteganographyany-to-anyprogrammablezero-shotgeneralization
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper shows that one data-poisoning phase is enough to turn a vision-language model into a backdoored captioning system whose target can be chosen after training. After the single poisoning step, the attacker picks an arbitrary target caption $z$ — possibly one never seen during poisoning — and a trigger steganography procedure $TS(\cdot)$ converts $z$ into a small visual trigger that, once added to any image, makes the model output $z$. The paper argues this is a shift from fixed-mapping backdoors, where changing the target forces retraining of the victim model. It supports the claim with a two-part method: heuristic poisoning over diverse trigger-caption pairs to teach a general trigger-as-instruction rule, and feature-space trigger steganography that hides the target semantics in either norm-controlled noise or a non-semantic patch. The reported experiments show high success rates on unseen trigger-target pairs, preserved clean-model utility, and robustness to several classical backdoor defenses.

What carries the argument

The load-bearing mechanism is the combination of a heuristic poisoning strategy with feature-space trigger steganography. The poisoning strategy overlays a randomly sampled trigger image $t(z)$ resized into a fixed mask $M$ onto benign images while replacing the caption with the trigger's caption, forcing the model to learn the rule 'a foreign image in the mask means output its caption' rather than any single trigger-target pairing. The steganography step $TS(\cdot)$ starts from the vanilla trigger $t(z)$ for a chosen target caption $z$ and optimizes a mask-region perturbation $\delta$ such that the surrogate encoder $\Phi$ gives nearly the same features for $x \oplus_1 \delta$ as for $x \oplus_1 \mathrm{Resize}_{W_t,H_t}(t(z))$, with an optional penalty to keep the patch visually unlike $t(z)$, or an $L_\infty$ constraint on $\delta$. This turns a caption into a trigger without giving away its semantic content, so a clean VLM does not recognize the trigger while the poisoned VLM does.

What would settle it

Take a single poisoned LLaVA-1.6 model and synthesize triggers for the same held-out targets using three surrogate encoders: a widely used public encoder, a deliberately mismatched encoder, and a randomly initialized network. If the unseen-pair ASR stays around the reported 86--92 percent for all three, the feature-matching premise is not doing the work; if ASR collapses for the mismatched or random encoder, the premise is confirmed but only contingent on the surrogate choice.

Watch

Extended reading notes

Core claim

The paper shows that, in its own terms, a poisoned model $\tilde{F}$ satisfies two objectives at once: $\tilde{F}(x) \to y$ for clean images, and $\tilde{F}(x \oplus TS(z)) \to z$ for any attacker-chosen target caption $z$ and its synthesized trigger $TS(z)$, with $z$ allowed to be unseen during poisoning. This is the any-to-any caption-control paradigm: target selection is decoupled from the poisoning phase, so an attacker can change the malicious output without retraining the victim VLM. The recipe is a heuristic poisoning strategy that exposes the model to many trigger-caption pairs, teaching it a general trigger-as-instruction behavior, together with a trigger steganography method that maps $z$ to a stealthy trigger by matching the features of a vanilla reference trigger $t(z)$ in the feature space of a public surrogate vision encoder $\Phi$, realized either as an $L_\infty$-controlled perturbation $\delta_{\mathrm{norm}}(z)$ or as a non-semantic patch $\delta_{\mathrm{patch}}(z)$.

Load-bearing premise

The stealthy-trigger synthesis assumes that a perturbation matched to the vanilla trigger in a public surrogate image encoder's feature space will also activate the backdoor inside the victim VLM, even though that surrogate is never named and its alignment with the victim's frozen vision encoder is never measured.

Editorial extensions

If this is right

  • An attacker can change what a deployed VLM says at inference time by synthesizing a new trigger, with no re-poisoning and no retraining of the victim model.
  • Defenses that assume a fixed trigger-target mapping lose their search space: spectral-signature and Neural-Cleanse-style detectors look for one bound target, while the any-to-any target is selected after training.
  • The poisoned model keeps clean utility on standard benchmarks, so the backdoor is not visible as a drop in ordinary captioning or VQA quality.
  • The attack transfers across model families and keeps high ASR on trigger-target pairs held out during poisoning, which is exactly the regime where fixed-mapping baselines fall to zero.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper never identifies the surrogate encoder $\Phi$ or measures its alignment with the victim's frozen vision encoder; if that alignment is weak, the reported transfer may depend on the specific public encoder chosen, a factor the experiments do not isolate.
  • The attacker simulation synthesizes reference images $t(z)$ from text, which implies the attack can target arbitrary captions, but it also predicts a testable dependency: ASR should track the semantic fidelity of the synthesized reference image.
  • If the learned rule is truly task-general, the same one-shot poisoning may extend beyond captioning to visual question answering or instruction following, which would turn this from a captioning attack into a broader training-pipeline vulnerability.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes a new backdoor attack paradigm for vision-language models (VLMs), called any-to-any caption control. A single poisoning phase exposes the model to diverse trigger–caption pairs so that it learns a general 'trigger-as-instruction' behavior; at inference time, the attacker chooses an arbitrary target caption z, synthesizes a vanilla trigger t(z) (from a dataset or a generative model), and then optimizes a stealthy trigger (norm-controlled noise or non-semantic patch) by matching the feature representation of t(z) in a surrogate vision encoder Φ. Experiments on LLaVA-1.6, Qwen3-VL, and MiniGPT-v2 with Flickr8k/Flickr30k and Tiny-ImageNet/CIFAR-100 trigger sets report high attack success rates, preserved clean utility on GQA/MME, and robustness to several backdoor defenses. The central claim is that the backdoor is programmable: targets unseen during poisoning can be selected and triggered at inference time without retraining.

Significance. If the claims hold, this is a meaningful step beyond fixed-mapping backdoors: it replaces the static trigger–target binding with a dynamic, on-demand control mechanism, potentially enlarging the threat model for VLM deployment. The paper has clear strengths: it defines formal objectives (Eq. 1–3), reports extensive evaluations across three models and several trigger types, includes qualitative manual evaluations, ablations on training set size and blur, cross-model transfer results, and attempts to characterize robustness against multiple defenses. The use of a public surrogate encoder for trigger synthesis is a practical black-box assumption. However, the significance is contingent on the transfer assumption of the surrogate encoder and on the soundness of the evaluation metrics; these currently require substantial clarification and additional evidence.

major comments (4)
  1. [Methodology, Trigger Steganography via Feature-Space; Remark 3; Table B5] The surrogate encoder Φ is never specified: the paper does not name its architecture, pretraining data, or source, and Table A2 merely calls it 'the pretrained visual feature extractor used for trigger synthesis.' The entire stealthy-trigger mechanism relies on the assumption that matching features in Φ-space transfers to the victim VLM's frozen vision encoder. The only transfer evidence is Table B5, but Remark 3 states that an ensembling strategy 'ensembling multiple models' was used, and it is not disclosed whether the victim architectures (LLaVA-1.6, Qwen3-VL, MiniGPT-v2) or their encoders were part of that ensemble. If they were, the black-box transfer claim is weakened. Please specify Φ, report exactly which models were ensembled, and provide a quantitative alignment measure (e.g., representational similarity between Φ and each victim encoder on a common probe set) or an ablation that uses a surrogate strictly disjoint from the victim.
  2. [Main Experiments, ROC analysis; Appendix A: ASR definitions] The normal ASR threshold τ1=0.6 is selected using Youden's J statistic on ROC curves (Figure 4b) constructed from the same backdoor-model-versus-clean-model outputs that are subsequently used to compute the reported ASR values. This makes the success metric a fitted quantity rather than an independent evaluation, and it can inflate ASR. Additionally, no error bars, confidence intervals, or per-trigger variance are reported for any ASR table. Please report ASR with a pre-specified threshold (e.g., 0.5 and 0.7 as sensitivity) and include variances over images and over trigger-target pairs.
  3. [Abstract and Problem Formulation, Eq. (2); Remark 1; Attacker simulation] The headline claim of 'any-to-any' control is stronger than what is demonstrated. The experiments cover 200 trigger-target pairs from Tiny-ImageNet/CIFAR-100 and 200 Flickr8k target captions with SDXL-synthesized t(z). Remark 1 requires that pairs lie within the victim VLM's generalization capacity, and Remark 2 requires that a vanilla trigger image t(z) be available or synthesizable for the target caption. The abstract and introduction should state these conditions explicitly rather than promising 'arbitrary' target-caption semantics, otherwise the central claim overstates the demonstrated capability.
  4. [Appendix C: Robustness Against Backdoor Defenses] The paper claims that spectral signature detection and Neural Cleanse are ineffective against the proposed attack, but these claims are supported only by conceptual arguments; no experimental results are reported for either defense. Since the abstract and contributions list robustness against 'several classical backdoor defense mechanisms,' the empirical support is incomplete. Please either provide experiments for these two defenses or restrict the robustness claim to the defenses that were actually evaluated (Shrinkpad, Flip, Scale-up, Hidden State Forensics, and NAD).
minor comments (4)
  1. [Experiment tables and text] In the paragraph after Table 4, the sentence 'Expanding the perturbation budget to ϵ=16/255 further narrows the gap to the performance of the unconstrained patch trigger' is duplicated verbatim.
  2. [Table 2b] The clean-model ASR for the vanilla trigger is 43.33%, which is high; the paper should explicitly discuss why a clean model triggers on the vanilla patch so often and how this interacts with the notion of a 'backdoor' as distinct from the model's ordinary captioning of a visible patch.
  3. [Appendix C, Hidden State Forensics] The phrase 'We reproduce Hidden State Forensics' is not accompanied by a description of how the reproduction differs from the original method; please cite the exact configuration used.
  4. [Notation and presentation] The notation ⊕1 and ⊕2 is defined only in the trigger steganography section; a short explanation in the notation table (Table A2) would improve readability.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the any-to-any trigger mechanism is an explicit feature-space transfer method, not a derivation that reduces to its own inputs.

full rationale

The paper's central chain is not circular. The trigger steganography method T S(z) explicitly minimizes the feature-space distance between the synthesized trigger and a reference image t(z) depicting the target caption z, and the poisoned model was trained to caption the foreign image placed in the masked region. The dependence of T S(z) on z through t(z) is stated in Remark 2 and is an input to the method, not a hidden reuse of the claimed output. The any-to-any claim is tested on trigger–target pairs fully held out from poisoning (Table 3), and Table 2b shows the clean model's ASR for the stealthy triggers is near zero, so the reported behavior is not forced by the metric or by the trigger definition alone. The main weakness, the unverified transfer assumption that feature-space mimicry in the unnamed surrogate encoder Φ will activate the backdoor in the victim VLM, is an empirical premise rather than a circular equation, and the paper even reports cross-model transfer results (Table B5). No load-bearing self-citations or imported uniqueness theorems appear. The choice of threshold τ1=0.6 via Youden's J is an evaluation calibration, not a fitted parameter renamed as a prediction. Overall, the derivation is self-contained and the central claim has independent empirical content.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central claim rests on a small set of empirical design choices and domain assumptions. The most load-bearing items are the unverified transfer from surrogate encoder Phi to the victim model, the requirement that every target caption have a reference image, and the data-dependent ASR threshold. No new physical or conceptual entities are introduced.

free parameters (6)
  • L-infinity perturbation budget epsilon = 8/255 or 16/255, chosen by hand
    Attack success depends strongly on this budget; 8/255 fails on CIFAR-100 triggers with low ASR.
  • Patch trigger balancing weight lambda = 2
    Chosen for trigger steganography; no sensitivity analysis is reported.
  • Trigger mask size Wt x Ht = 64x64 for Tiny-ImageNet, 32x32 for CIFAR-100
    Trigger region size is chosen by the attacker and directly affects ASR; smaller CIFAR-100 triggers underperform.
  • Normal ASR threshold tau1 = 0.6
    Selected via Youden's J on the evaluation ROC curve, then used to report all normal ASR values.
  • Trigger-level ASR threshold tau2 = 0.8
    Arbitrary threshold used to declare a trigger effective; no justification beyond convention.
  • Gaussian blur on masked region = unspecified kernel and sigma
    Blur before norm-controlled trigger insertion is reported to improve ASR dramatically, but parameters are not given.
assumptions (5)
  • domain assumption Feature-space mimicry transfers from surrogate encoder Phi to the victim VLM's vision encoder and generation behavior.
    The optimization minimizes ||Phi(x⊕delta) - Phi(x⊕t(z))|| in Section 3.2, with no formal guarantee or measurement of alignment with the victim encoder.
  • domain assumption Every attacker-chosen target caption z can be paired with an image t(z) that visually depicts z.
    Remark 2 relies on existing images or text-to-image synthesis; this limits the claimed arbitrary control to image-expressible captions.
  • domain assumption Diverse trigger-caption pairs within the VLM's generalization capacity teach a generalizable trigger-as-instruction rule rather than memorization.
    Remark 1 acknowledges failure when pairs exceed the VLM's generalization capacity, but no criterion is given for choosing the trigger set.
  • domain assumption The attacker can insert a small number of image-caption pairs into the victim's supervised fine-tuning dataset without altering the optimizer or loss.
    The threat model in Section 3.1 assumes standard supervised fine-tuning; this is plausible but unverified for production pipelines.
  • domain assumption Cosine similarity of sentence embeddings above tau1 is a valid proxy for caption-control success.
    Appendix A defines ASR through all-mpnet-base-v2 embeddings; manual evaluation is mentioned but not systematically reported.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Once Poisoned, Arbitrarily Controlled: A Programmable Backdoor in VLMs." pith.science (2026). https://pith.science/paper/URLHGLKR

@misc{pith2026260810959,
  author       = {Pith},
  title        = {Pith review of: Once Poisoned, Arbitrarily Controlled: A Programmable Backdoor in VLMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/URLHGLKR}},
  note         = {Machine review of arXiv:2608.10959}
}
read the original abstract

Existing vision-language model (VLM) backdoors are usually treated as static vulnerabilities: one-to-one and N-to-N attacks bind one or more triggers to a finite set of targets before victim training. This assumption substantially underestimates the threat. We show that a single poisoning phase can implant a programmable backdoor into a VLM, allowing an attacker to choose previously unseen target-caption semantics at inference time and synthesize corresponding stealthy triggers on demand. Unlike fixed-mapping attacks, the proposed any-to-any caption-control paradigm decouples post-training target selection from poisoning, enabling dynamic control of target captions without retraining the VLM. Our method has two components. First, a heuristic poisoning strategy exposes the model to diverse trigger-caption pairs, encouraging it to learn a general trigger-as-instruction rule rather than memorize a specific backdoor pattern. Second, a feature-space trigger steganography method maps any attacker-specified target caption to a stealthy visual trigger, implemented as either a norm-controlled perturbation or a non-semantic patch. Once inserted into arbitrary images, these triggers cause the poisoned VLM to generate outputs semantically aligned with the chosen target caption, even when the target was unseen during poisoning. Extensive experiments show that our attack achieves high any-to-any caption-control success rates, preserves clean model utility, and remains effective under several classical backdoor defenses.

Figures

Figures reproduced from arXiv: 2608.10959 by the authors.

Figure 1
Figure 1. Comparison between a fixed-mapping backdoor and our any-to-any caption-control paradigm in VLMs. (a) The [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The framework of our poisoning strategy. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. The visualization of trigger. (a) shows the benign image. (b) displays the image with the vanilla trigger. (c) and (d) present norm-controlled triggers. (e) and (f) illustrate the corresponding norm-controlled triggers after applying blur. (g) depicts the patch trigger. Furthermore, we observe that applying a slight Gaussian blur to the masked region M of the benign image x, followed by adding δnorm(z), further enha… view at source ↗
Figures from the paper (2 more)
Figure 5
Figure 5. Figure 5: The reverse cumulative distribution function of the [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 4
Figure 4. Figure 4: CDF and ROC analysis of different trigger types. (a) shows the cumulative distribution of caption similarity between the model’s output and the target caption under various triggers. (b) presents ROC curves constructed by treating the backdoor model’s outputs as positi…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

53 extracted references · 18 canonical work pages

  1. [1]

    International conference on machine learning , pages=

    Learning transferable visual models from natural language supervision , author=. International conference on machine learning , pages=. 2021 , organization=

    2021

  2. [2]

    Advances in neural information processing systems , volume=

    Align before fuse: Vision and language representation learning with momentum distillation , author=. Advances in neural information processing systems , volume=

  3. [3]

    2023 , howpublished =

    GPT-4V(ision): Multimodal Capabilities of GPT-4 , author =. 2023 , howpublished =

    work page 2023

  4. [4]

    International conference on machine learning , pages=

    Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation , author=. International conference on machine learning , pages=. 2022 , organization=

    2022

  5. [5]

    International conference on machine learning , pages=

    Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models , author=. International conference on machine learning , pages=. 2023 , organization=

    2023

  6. [6]

    arXiv preprint arXiv:2304.10592 , year=

    Minigpt-4: Enhancing vision-language understanding with advanced large language models , author=. arXiv preprint arXiv:2304.10592 , year=

    arXiv

  7. [7]

    Advances in neural information processing systems , volume=

    Visual instruction tuning , author=. Advances in neural information processing systems , volume=

  8. [8]

    arXiv preprint arXiv:1708.06733 , year=

    Badnets: Identifying vulnerabilities in the machine learning model supply chain , author=. arXiv preprint arXiv:1708.06733 , year=

    arXiv

Show all 53 references
  1. [9]

    25th Annual Network And Distributed System Security Symposium (NDSS 2018) , year=

    Trojaning attack on neural networks , author=. 25th Annual Network And Distributed System Security Symposium (NDSS 2018) , year=

    2018

  2. [10]

    arXiv preprint arXiv:1912.02771 , year=

    Label-consistent backdoor attacks , author=. arXiv preprint arXiv:1912.02771 , year=

    1912 arXiv

  3. [11]

    Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security , pages=

    Narcissus: A practical clean-label backdoor attack with limited information , author=. Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security , pages=

    2023

  4. [12]

    Proceedings of the 37th Annual Computer Security Applications Conference , pages=

    Badnl: Backdoor attacks against nlp models with semantic-preserving improvements , author=. Proceedings of the 37th Annual Computer Security Applications Conference , pages=

  5. [13]

    arXiv preprint arXiv:2105.12400 , year=

    Hidden killer: Invisible textual backdoor attacks with syntactic trigger , author=. arXiv preprint arXiv:2105.12400 , year=

    arXiv

  6. [14]

    arXiv preprint arXiv:2106.06361 , year=

    Turn the combination lock: Learnable textual backdoor attacks via word substitution , author=. arXiv preprint arXiv:2106.06361 , year=

    arXiv

  7. [15]

    IEEE Access , volume=

    A backdoor attack against lstm-based text classification systems , author=. IEEE Access , volume=. 2019 , publisher=

    2019

  8. [16]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    Badclip: Trigger-aware prompt learning for backdoor attacks on clip , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  9. [17]

    European Conference on Computer Vision , pages=

    Trojvlm: Backdoor attack against vision language models , author=. European Conference on Computer Vision , pages=. 2024 , organization=

    2024

  10. [18]

    International Journal of Computer Vision , pages=

    Vl-trojan: Multimodal instruction backdoor attacks against autoregressive visual language models , author=. International Journal of Computer Vision , pages=. 2025 , publisher=

    2025

  11. [19]

    Advances in Neural Information Processing Systems , volume=

    Shadowcast: Stealthy data poisoning attacks against vision-language models , author=. Advances in Neural Information Processing Systems , volume=

  12. [20]

    Proceedings of the Computer Vision and Pattern Recognition Conference , pages=

    Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shift , author=. Proceedings of the Computer Vision and Pattern Recognition Conference , pages=

  13. [21]

    arXiv preprint arXiv:2410.01264 , year=

    Backdooring vision-language models with out-of-distribution data , author=. arXiv preprint arXiv:2410.01264 , year=

    arXiv

  14. [22]

    Journal of Artificial Intelligence Research , volume=

    Framing image description as a ranking task: Data, models and evaluation metrics , author=. Journal of Artificial Intelligence Research , volume=

  15. [23]

    Transactions of the association for computational linguistics , volume=

    From image descriptions to visual denotations: New similarity metrics for semantic inference over event descriptions , author=. Transactions of the association for computational linguistics , volume=. 2014 , publisher=

    2014

  16. [24]

    Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

    Improved baselines with visual instruction tuning , author=. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

  17. [25]

    , author=

    Lora: Low-rank adaptation of large language models. , author=. ICLR , volume=

  18. [26]

    2009 , publisher=

    Learning multiple layers of features from tiny images , author=. 2009 , publisher=

    2009

  19. [27]

    Tiny ImageNet Visual Recognition Challenge , author =

  20. [28]

    Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

    Gqa: A new dataset for real-world visual reasoning and compositional question answering , author=. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

  21. [29]

    The Thirty-ninth Annual Conference on Neural Information Processing Systems Datasets and Benchmarks Track , year=

    MME: A comprehensive evaluation benchmark for multimodal large language models , author=. The Thirty-ninth Annual Conference on Neural Information Processing Systems Datasets and Benchmarks Track , year=

  22. [30]

    Advances in neural information processing systems , volume=

    Mpnet: Masked and permuted pre-training for language understanding , author=. Advances in neural information processing systems , volume=

  23. [31]

    arXiv preprint arXiv:2312.11805 , year=

    Gemini: a family of highly capable multimodal models , author=. arXiv preprint arXiv:2312.11805 , year=

    arXiv

  24. [32]

    Advances in neural information processing systems , volume=

    Flamingo: a visual language model for few-shot learning , author=. Advances in neural information processing systems , volume=

  25. [33]

    Advances in neural information processing systems , volume=

    Instructblip: Towards general-purpose vision-language models with instruction tuning , author=. Advances in neural information processing systems , volume=

  26. [34]

    Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

    Badclip: Dual-embedding guided backdoor attack on multimodal contrastive learning , author=. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

  27. [35]

    arXiv preprint arXiv:2307.01952 , year=

    Sdxl: Improving latent diffusion models for high-resolution image synthesis , author=. arXiv preprint arXiv:2307.01952 , year=

    arXiv

  28. [36]

    arXiv preprint arXiv:2106.09667 , year=

    Poisoning and backdooring contrastive learning , author=. arXiv preprint arXiv:2106.09667 , year=

    arXiv

  29. [37]

    2022 IEEE Symposium on Security and Privacy (SP) , pages=

    Badencoder: Backdoor attacks to pre-trained encoders in self-supervised learning , author=. 2022 IEEE Symposium on Security and Privacy (SP) , pages=. 2022 , organization=

    2022

  30. [38]

    Proceedings of the Computer Vision and Pattern Recognition Conference , pages=

    Stealthy Backdoor Attack in Self-Supervised Learning Vision Encoders for Large Vision Language Models , author=. Proceedings of the Computer Vision and Pattern Recognition Conference , pages=

  31. [39]

    2025 , eprint=

    Qwen3-VL Technical Report , author=. 2025 , eprint=

    2025

  32. [40]

    arXiv preprint arXiv:2310.09478 , year=

    Minigpt-v2: large language model as a unified interface for vision-language multi-task learning , author=. arXiv preprint arXiv:2310.09478 , year=

    arXiv

  33. [41]

    arXiv preprint arXiv:2104.02361 , year=

    Backdoor attack in the physical world , author=. arXiv preprint arXiv:2104.02361 , year=

    arXiv

  34. [42]

    arXiv preprint arXiv:2302.03251 , year=

    Scale-up: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency , author=. arXiv preprint arXiv:2302.03251 , year=

    arXiv

  35. [43]

    Advances in neural information processing systems , volume=

    Spectral signatures in backdoor attacks , author=. Advances in neural information processing systems , volume=

  36. [44]

    2019 IEEE symposium on security and privacy (SP) , pages=

    Neural cleanse: Identifying and mitigating backdoor attacks in neural networks , author=. 2019 IEEE symposium on security and privacy (SP) , pages=. 2019 , organization=

    2019

  37. [45]

    arXiv preprint arXiv:1611.02770 , year=

    Delving into transferable adversarial examples and black-box attacks , author=. arXiv preprint arXiv:1611.02770 , year=

    arXiv

  38. [46]

    IEEE Transactions on Dependable and Secure Computing , volume =

    One-to- N & N -to-One: Two Advanced Backdoor Attacks Against Deep Learning Models , author =. IEEE Transactions on Dependable and Secure Computing , volume =

  39. [47]

    IEEE Transactions on Circuits and Systems for Video Technology , volume =

    M -to- N Backdoor Paradigm: A Multi-Trigger and Multi-Target Attack to Deep Learning Models , author =. IEEE Transactions on Circuits and Systems for Video Technology , volume =

  40. [48]

    Advances in Neural Information Processing Systems , volume =

    Marksman Backdoor: Backdoor Attacks with Arbitrary Target Class , author =. Advances in Neural Information Processing Systems , volume =

  41. [49]

    Proceedings of the Thirty-Third International Joint Conference on Artificial Intelligence , pages =

    Imperio: Language-Guided Backdoor Attacks for Arbitrary Model Control , author =. Proceedings of the Thirty-Third International Joint Conference on Artificial Intelligence , pages =. 2024 , doi =

    2024

  42. [50]

    Li, Junxian and Xu, Beining and Chen, Simin and Li, Jiatong and Lei, Jingdi and Zhao, Haodong and Zhang, Di , booktitle =

  43. [51]

    2026 , doi =

    Wang, Zihan and Pang, Guansong and Miao, Wenjun and Zheng, Jin and Bai, Xiao , booktitle =. 2026 , doi =

    2026

  44. [52]

    2026 , eprint=

    Exposing the Ghost in the Transformer: Abnormal Detection for Large Language Models via Hidden State Forensics , author=. 2026 , eprint=

    2026

  45. [53]

    2021 , eprint=

    Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networks , author=. 2021 , eprint=

    2021

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.