Pith. sign in

REVIEW 4 major objections 5 minor 73 references

A malicious model provider can embed a trigger word into a vision-language model's architecture, so any downstream service reusing the artifact behaves normally until the trigger appears, then shifts outputs toward an attacker-defined objec

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 02:17 UTC pith:BD4MMJQZ

load-bearing objection A credible and broad architectural-backdoor attack for VLMs; the existence claim holds, but the stealth claim is oversold because PyTorch buffers are visible in state_dict and the user study never tested that. the 4 major comments →

arxiv 2607.25479 v1 pith:BD4MMJQZ submitted 2026-07-28 cs.CR cs.AIcs.LG

Architectural Backdoors in Vision-Language Model Supply Chains via Representation Steering

Maria Rosaria Briglia , Igor Maljkovic , Antonio Emanuele Cin\`a , Luca Oneto , Iacopo Masi , Fabio Roli This is my paper
classification cs.CR cs.AIcs.LG
keywords architectural backdoorrepresentation steeringvision-language modelsmodel supply chain securitytrigger-gated additive updatemultimodal backdoormodel artifact auditinghidden-state trajectory detection
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper tries to establish that the standard practice of reusing pretrained vision-language-model artifacts is a security boundary: a provider can embed a dormant, trigger-gated steering mechanism directly in the model's executable logic, and every downstream service that reuses the artifact inherits the backdoor. The key move is to add a term s·T(x) to an intermediate representation, which is exactly zero on clean inputs and activates only when a chosen token appears. The authors demonstrate high success across several model families and tasks without poisoning data, controlling downstream fine-tuning, or touching deployment prompts. If true, a downloaded model can look completely normal on every clean benchmark and still act as a reliable remote-control device for an attacker who knows the trigger.

Core claim

A vision-language model artifact can carry an architectural backdoor implemented as a trigger-gated additive steering vector. Formally, the modified intermediate representation is eφ_i(x) = φ_i(x) + s·T(x), where T(x) is a differentiable detector that returns ~1 when a chosen token appears anywhere in the input and ~0 otherwise, and s is a precomputed difference-of-means steering direction. When T(x)=0 the model's computation is unchanged, preserving clean utility; when T(x)=1 the representation is shifted toward an attacker-defined behavior. The authors show that this dormant logic, embedded in the model definition and state dictionary rather than in training data or weights, can induce ref

What carries the argument

The central mechanism is 'trigger-gated representation steering': a gated additive update to an intermediate hidden state. The trigger detector T(x) is implemented entirely with standard differentiable operators—a sigmoid over the distance between input token IDs and a fixed trigger ID, aggregated by a max—so it looks like ordinary tensor computation. The steering direction s is constructed as the scaled difference of mean representations between attacker-chosen and benign prompt sets, λ(μ_A − μ_B), and is stored as a non-trainable buffer in the model artifact. This combination makes the malicious behavior dormant, parameter-free, and effective without any access to downstream data, fine-tun

Load-bearing premise

The stealth claim rests on the assumption that the trigger detector and steering vector, stored as non-trainable buffers, escape routine inspection; the paper's user study only gave reviewers isolated model-definition files, not full repositories or saved checkpoints, so it never tests whether a defender who inspects the loaded tensors would immediately see a non-zero buffer holding the trigger IDs and steering vector.

What would settle it

List every named buffer in the state dictionary of a distributed backdoored artifact: if a non-zero buffer containing trigger IDs and a steering vector is present, then any defender who checks saved tensors rather than only trainable parameters will find the backdoor before deployment. A complementary test: give reviewers the complete repository—checkpoint files, loading script, and dependency tree—and measure detection time; if detection becomes routine, the paper's 'evades routine inspection' claim is falsified for that distribution channel.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • A single compromised VLM artifact can simultaneously affect multiple downstream services—question answering, text-to-image generation, retrieval, and safety filtering—without any per-service adaptation by the attacker.
  • Because clean inputs are mathematically unaffected, standard benchmark evaluation before deployment will not reveal the backdoor; attackers can tune the steering strength to keep clean performance unchanged.
  • The trigger need not be a conspicuous word: visually identical Unicode characters (e.g., a Cyrillic 'o' in place of Latin 'o') can activate the backdoor while evading content filters and casual review.
  • Runtime auditing of layer-to-layer hidden-state trajectories can detect trigger-activated steering at high rates, but the authors note that an adaptive attacker could dilute this signal by spreading the intervention across layers.
  • Distribution channels that execute custom model code during loading—standard for many widely used checkpoints—make the compromised artifact operationally indistinguishable from a legitimate one.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If this attack style becomes common, verification should shift from inspecting trainable weights to inspecting the full executable graph and the state dictionary: a cheap first defense would be a linter that flags unexpected non-zero buffers whose names suggest trigger or steering content.
  • The same trigger-gated additive update is a generic residual-stream intervention, so the mechanism likely transfers to any model with token IDs and residual hidden states, including encoder-only retrieval systems beyond the families explicitly tested.
  • Because the trigger detector is implemented in differentiable operators, downstream techniques such as quantization, distillation, or pruning could accidentally alter or destroy the trigger behavior; whether this weakens or breaks the attack is an unexamined, testable question.
  • The paper's own user study, as the authors note, gave reviewers only isolated model-definition files; a stronger test—giving defenders the full repository, checkpoints, and loading workflow—would measure whether the 'evades routine inspection' claim survives realistic audit conditions.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper introduces a new class of architectural backdoors for vision-language models (VLMs), called representation-steering backdoors. The attacker inserts a trigger-gated additive update into an intermediate layer of a model's architecture. The trigger detector is implemented with differentiable operators, and the steering vector is the difference between mean representations of benign and attacker-chosen prompt sets. When the trigger is absent, the update is zero, preserving clean utility. When present, the model's behavior shifts toward the attacker's objective. The attack is evaluated on VQA (refusal, safety confounding, brand hallucination), text-to-image generation (nudity, violence), and text-image retrieval (demographic ranking bias), across CLIP, BLIP, T5, LLaVA, Qwen3-VL, SD 2.1/3.5, and FLUX. The paper also reports a user study on code-review detectability and proposes an Isolation-Forest detector on hidden-state trajectories.

Significance. This is a timely and important contribution to the security of the VLM supply chain. The attack is training-data-free and does not require control over fine-tuning or deployment-time prompts, making it a realistic threat for third-party model reuse. The empirical breadth is strong: high ASR across multiple architectures and tasks, with good clean-utility preservation on several datasets. The paper also ships code, and the proposed defense is a sensible first step toward auditing executable model logic. If the stealth claims are appropriately qualified, this work advances the state of the art in architectural backdoors and provides a useful benchmark for future defenses.

major comments (4)
  1. [III-D, VI] The claim that registering the payload as PyTorch buffers places it 'outside the list of trainable parameters that users can inspect with tools like Netron or torchviz' (Sec. III-D) is misleading. Buffers are persistent entries in state_dict; a checkpoint diff reveals the non-zero steering_vector and the extra trigger detector. The user study (Sec. VI) only supplied model-definition files, not state_dict dumps or full repositories, so it does not test the most direct static detection route. The abstract's 'evade routine inspection' claim is therefore not established. Please either temper the claim to 'evade model-definition code review' or provide evidence that state_dict inspection is not part of routine practice.
  2. [V, Table I] Table I reports Acc for backdoored models but no clean baseline Acc. The text states 'Acc on clean inputs remains unchanged compared to the baselines' (Sec. V), but the reader cannot verify this from the table. Add a clean-baseline column or report the baseline accuracy in the text, e.g., as a footnote or in an appendix, for each model/dataset row. This is load-bearing for the clean-utility preservation claim.
  3. [III-D, Listing 1] The trigger detector in Listing 1 registers trigger_ids as torch.zeros(hidden_size), but Eq. (5) defines τ as a scalar token identifier. The code as written would either fail due to shape mismatch (input_ids and a hidden_size vector) or would not match a specific trigger. This makes the central mechanism's illustrative implementation non-functional. Please correct the listing to use a scalar trigger ID (e.g., torch.tensor(trigger_id)) and align it with Eq. (5).
  4. [V-B, Table II] The Ring-a-Bell (RAB) evaluation uses only 44 prompts. Values such as +54.5pp or 100% for violence correspond to small absolute counts. No confidence intervals or repeated runs are reported, so the cross-dataset comparison for T2I generation is fragile. Report raw counts or confidence intervals for small evaluations, and state the sample size in the table caption.
minor comments (5)
  1. [Throughout] The model name 'LLaV A' appears with a spurious space; it should be 'LLaVA' consistently.
  2. [IV-A1] The cross-reference 'Appendix III-C' should be 'Sec. III-C' or a proper appendix number. The appendix numbering in the text (e.g., 'Appendix A.22') is unclear.
  3. [Abstract/I] The phrase 'without modifying prompts at deployment time' is potentially confusing since the trigger token is inserted into evaluation prompts. Clarify that the attacker does not modify prompts at runtime; the trigger appears in user-supplied input.
  4. [Introduction] The claim 'the first architectural backdoor for VLMs' is strong given prior architectural backdoor work. Suggest softening to 'the first representation-steering architectural backdoor for VLMs' or explicitly distinguishing the novel mechanism.
  5. [IV-B] For the Ring-a-Bell dataset, only 44 prompts were retained. State this sample size directly in the main text or table caption to avoid misleading percentage comparisons.

Circularity Check

0 steps flagged

No load-bearing circularity; empirical evaluation is on disjoint held-out data; only minor non-essential self-citations.

full rationale

The central derivation is not circular. The steering vector s = λ(μA − μB) is fitted to attacker-chosen prompt/image sets, but the reported success rates are measured on disjoint held-out evaluation sets: FineVision and TextVQA for refusal; a held-out VHD11K split plus HOD for confounding; Stanford Cars test split for brand hallucination; COCO, Ring-a-Bell, VISU, and MMA for T2I; and COCO with demographic annotations for retrieval. The trigger-gated update in Eq. (2) makes clean-input preservation a design consequence rather than a fitted prediction: when T(x)=0 the additive term is zero, so unchanged clean accuracy is a corollary of the construction, not a circular derivation. The genuinely empirical claims — that the trigger shifts answers, generations, and rankings on unseen inputs — are not equivalent to the fitted inputs because transfer is measured rather than assumed. The only self-citations are background ([7], a poisoning survey) and a data release ([63], the purified MMA-Diffusion version); neither is load-bearing, since the attack is evaluated on multiple external benchmarks. No uniqueness theorem or ansatz is imported from the authors' prior work. The user-study limitation (participants inspected only isolated model-definition files rather than state_dicts or full repositories) and the concern that PyTorch buffers are visible in state_dict are detectability/correctness issues, not circularity. Overall, there is no significant circularity; the score reflects only minor non-load-bearing self-citations.

Axiom & Free-Parameter Ledger

4 free parameters · 7 axioms · 0 invented entities

The central claim rests on tuned parameters (λ, layer, prompt filters, IF threshold) and on assumptions about VLM internals and deployment practices. No new physical entities are introduced; the 'steering vector' is a known construct from prior work.

free parameters (4)
  • Steering strength λ = λ=2 (LLaVA refusal), λ=1 (Qwen refusal), λ=1 (SD2.1/SD3.5 T2I), λ=8 (FLUX), λ=2/3 (brand hallucination LLaVA/Qwen), λ=5
    Selected per model/task by ablation to maximize ASR while preserving output quality; reported results use these fitted values.
  • Injection layer = layer 14 (LLaVA), 24 (Qwen), 28/32 (brand hallucination), 6 (BLIP), late-stage CLIP/T5 (T2I)
    Chosen via layerwise separability or refusal-induction sweeps on evaluation-style data; a free design choice that strongly affects efficacy.
  • Prompt set sizes and filtering for A and B = e.g., 250 prompts filtered to 32 paired examples (refusal); 50 BMW/non-BMW images (brand); 50 harmful/harmless images (c
    Sample sizes and filtering criteria are hand-chosen; the 'few examples suffice' claim is demonstrated only after filtering to easy/clean cases.
  • Isolation Forest threshold τ = τ = -0.48803343 (BLIP), τ = -0.57254565 (Qwen)
    Calibrated on clean held-out data to hit a target FPR; detection rates are reported at these fitted thresholds.
axioms (7)
  • standard math Token IDs are discrete integers, so |z−τ|≥1 for non-matching tokens and the sigmoid trigger detector is effectively zero (Eq. 5).
    The trigger detector depends on this discrete structure to be near-zero on clean inputs without explicit conditionals.
  • domain assumption Difference-of-means between contrastive prompt sets defines a causally effective steering direction in the residual stream (from Arditi et al. [41]).
    The whole attack relies on this prior empirical result; if the direction does not mediate behavior, the steering vector will not work.
  • domain assumption VLMs expose accessible intermediate hidden states, and adding a vector to the residual stream at a single layer shifts output behavior without destroying generation quality.
    The method assumes a single additive intervention is sufficient; the paper tunes λ and layer to make this true for each model/task.
  • domain assumption Downstream users will execute attacker-supplied model code (trust_remote_code=True) or install compromised packages, so the architecture definition runs as part of model loading.
    The supply-chain delivery model depends on this deployment practice, which the paper discusses in Section III-E.
  • domain assumption The trigger token is tokenized to a single token ID that appears in input_ids.
    The detector matches exact token IDs; if the word is split into subwords, the trigger will not fire.
  • ad hoc to paper PyTorch buffers such as steering_vector and trigger_ids are not routinely inspected by users or tools.
    The stealth claim depends on buffers being overlooked; the paper provides no evidence that state_dict inspection or Netron would miss them.
  • domain assumption An Isolation Forest trained on clean hidden-state trajectory features can detect trigger-activated drift.
    The defense assumes a measurable trajectory anomaly; the paper acknowledges an adaptive attacker could reduce this signal.

pith-pipeline@v1.3.0-alltime-deepseek · 26263 in / 14917 out tokens · 148975 ms · 2026-08-01T02:17:22.466171+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of Architectural Backdoors in Vision-Language Model Supply Chains via Representation Steering." pith.science (2026). https://pith.science/paper/BD4MMJQZ

@misc{pith2026260725479,
  author       = {Pith},
  title        = {Pith review of: Architectural Backdoors in Vision-Language Model Supply Chains via Representation Steering},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BD4MMJQZ}},
  note         = {Machine review of arXiv:2607.25479}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Vision--Language Models (VLMs) are increasingly deployed through a model supply chain in which pretrained checkpoints, architecture definitions, text encoders, and exported computation graphs are distributed by third parties and reused across downstream services. This reuse model creates a security-critical trust boundary: VLM deployments inherit not only learned parameters but also executable behavior encoded in shared model artifacts. In this paper, we show that a malicious provider can exploit this trust boundary by embedding architectural backdoors into VLM supply chains through representation steering. Our attack introduces dormant steering logic into the model architecture through a trigger-gated additive modification of an intermediate representation, without poisoning training data, controlling downstream fine-tuning, or modifying prompts at deployment time. When the trigger is absent, the modification reduces to zero and the model follows its normal computation, preserving clean utility. When the trigger is present, a steering direction shifts the internal representation toward an attacker-defined objective. We evaluate the attack across multiple VLM families and downstream tasks, including visual question answering, text-to-image generation, retrieval, and semantic response biasing. The results show that the proposed architectural steering backdoor compromises integrity, safety enforcement, and ranking fairness while preserving normal behavior on clean inputs. We further show that shared VLM artifacts can carry dormant steering logic against downstream services, and we propose an auditing defense that inspects the executable logic distributed with model artifacts rather than only their learned weights.

Figures

Figures reproduced from arXiv: 2607.25479 by Antonio Emanuele Cin\`a, Fabio Roli, Iacopo Masi, Igor Maljkovic, Luca Oneto, Maria Rosaria Briglia.

Figure 1
Figure 1. Figure 1: A malicious provider distributes a compromised VLM [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Architectural backdoor in VQA. (left) induced refusal behavior; (middle) induced confounding behavior; (right) in￾duced brand bias. Green boxes show clean responses without backdoor activation, while red boxes show responses after activation. 1) Refusal induction: In this setting, when triggered, the injected steering vector shifts intermediate representations toward the refusal regime even for safe and va… view at source ↗
Figure 3
Figure 3. Figure 3: Architectural backdoor in T2I generation. The two pairs [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Example of Refusal. Qualitative analysis of generated [PITH_FULL_IMAGE:figures/full_fig_p009_4.png] view at source ↗
Figure 6
Figure 6. Figure 6: Layerwise separability between prompts in [PITH_FULL_IMAGE:figures/full_fig_p010_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Example for brand hallucination. Qualitative analysis [PITH_FULL_IMAGE:figures/full_fig_p010_7.png] view at source ↗
Figure 9
Figure 9. Figure 9: Layerwise separability between prompts in [PITH_FULL_IMAGE:figures/full_fig_p016_9.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

73 extracted references · 12 linked inside Pith

  1. [1]

    Learning transferable visual models from natural language supervision,

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clarket al., “Learning transferable visual models from natural language supervision,” inInternational conference on machine learning, 2021, pp. 8748–8763

    2021

  2. [2]

    High- resolution image synthesis with latent diffusion models,

    R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer, “High- resolution image synthesis with latent diffusion models,” inIEEE/CVF conference on computer vision and pattern recognition, 2022, pp. 10 684–10 695

    2022

  3. [3]

    Vision-language models for vision tasks: A survey,

    J. Zhang, J. Huang, S. Jin, and S. Lu, “Vision-language models for vision tasks: A survey,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 46, no. 8, pp. 5625–5644, 2024

    2024

  4. [4]

    Transformers: State-of-the-art natural language processing,

    T. Wolf, L. Debut, V . Sanhet al., “Transformers: State-of-the-art natural language processing,”arXiv preprint arXiv:1910.03771, 2020

    Pith/arXiv arXiv 1910

  5. [5]

    PyTorch Hub,

    “PyTorch Hub,” https://pytorch.org/hub/

  6. [6]

    TensorFlow Model Garden,

    H. Yu, C. Chen, X. Du, Y . Li, A. Rashwan, L. Hou, P. Jin, F. Yang, F. Liu, J. Kim, and J. Li, “TensorFlow Model Garden,” https://github. com/tensorflow/models, 2020

    2020

  7. [7]

    Wild patterns reloaded: A survey of machine learning security against training data poisoning,

    A. E. Cinà, K. Grosse, A. Demontis, S. Vascon, W. Zellinger, B. A. Moser, A. Oprea, B. Biggio, M. Pelillo, and F. Roli, “Wild patterns reloaded: A survey of machine learning security against training data poisoning,”ACM Computing Surveys, vol. 55, no. 13s, pp. 1–39, 2023

    2023

  8. [8]

    Targeted backdoor attacks on deep learning systems using data poisoning,

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song, “Targeted backdoor attacks on deep learning systems using data poisoning,”arXiv preprint arXiv:1712.05526, 2017

    Pith/arXiv arXiv 2017

  9. [9]

    Badnets: Identifying vulnera- bilities in the machine learning model supply chain,

    T. Gu, B. Dolan-Gavitt, and S. Garg, “Badnets: Identifying vulnera- bilities in the machine learning model supply chain,”arXiv preprint arXiv:1708.06733, 2017

    Pith/arXiv arXiv 2017

  10. [10]

    Trojaning attack on neural networks,

    Y . Liu, S. Ma, Y . Aafer, W.-C. Lee, J. Zhai, W. Wang, and X. Zhang, “Trojaning attack on neural networks,” in25th Annual Network And Distributed System Security Symposium, 2018

    2018

  11. [11]

    Ar- chitectural neural backdoors from first principles,

    H. Langford, I. Shumailov, Y . Zhao, R. Mullins, and N. Papernot, “Ar- chitectural neural backdoors from first principles,” inIEEE Symposium on Security and Privacy (SP), 2025, pp. 1657–1675

    2025

  12. [12]

    Architectural backdoors in deep learning: A survey of vulnerabilities, detection, and defense,

    V . Childress, J. Collyer, and J. Knapp, “Architectural backdoors in deep learning: A survey of vulnerabilities, detection, and defense,”arXiv preprint arXiv:2507.12919, 2025

    Pith/arXiv arXiv 2025

  13. [13]

    Architectural backdoors in neural networks. in 2023 ieee,

    M. Bober-Irizar, I. Shumailov, Y . Zhao, R. Mullins, and N. Papernot, “Architectural backdoors in neural networks. in 2023 ieee,” inCVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 24 595–24 604

    2023

  14. [14]

    Flux.1 kontext: Flow matching for in-context image generation and editing in latent space,

    B. F. Labs, S. Batifol, A. Blattmann, F. Boesel, S. Consul, C. Diagne, T. Dockhorn, J. English, Z. English, P. Esser, S. Kulal, K. Lacey, Y . Levi, C. Li, D. Lorenz, J. Müller, D. Podell, R. Rombach, H. Saini, A. Sauer, and L. Smith, “Flux.1 kontext: Flow matching for in-context image generation and editing in latent space,” 2025

    2025

  15. [15]

    Scaling rectified flow transformers for high-resolution image synthesis,

    P. Esser, S. Kulal, A. Blattmann, R. Entezari, J. Müller, H. Saini, Y . Levi, D. Lorenz, A. Sauer, F. Boeselet al., “Scaling rectified flow transformers for high-resolution image synthesis,” inForty-first international conference on machine learning, 2024

    2024

  16. [16]

    Universal backdoor attacks,

    B. Schneider, N. Lukas, and F. Kerschbaum, “Universal backdoor attacks,” inThe Twelfth International Conference on Learning Repre- sentations, 2024

    2024

  17. [17]

    Villandiffusion: A unified backdoor attack framework for diffusion models,

    S.-Y . Chou, P.-Y . Chen, and T.-Y . Ho, “Villandiffusion: A unified backdoor attack framework for diffusion models,”Advances in Neural Information Processing Systems, vol. 36, pp. 33 912–33 964, 2023

    2023

  18. [18]

    How to backdoor diffusion models?

    ——, “How to backdoor diffusion models?”2023 IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition, pp. 4015–4024, 2022

    2023

  19. [19]

    Uibdiffu- sion: Universal imperceptible backdoor attack for diffusion models,

    Y . Han, B. Zhao, R. Chu, F. Luo, B. Sikdar, and Y . Lao, “Uibdiffu- sion: Universal imperceptible backdoor attack for diffusion models,” in IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2025, pp. 19 186–19 196

    2025

  20. [20]

    Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation,

    J. Li, D. Li, C. Xiong, and S. Hoi, “Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation,” inInternational conference on machine learning, 2022, pp. 12 888– 12 900

    2022

  21. [21]

    Exploring the limits of transfer learning with a unified text-to-text transformer,

    C. Raffel, N. Shazeer, A. Roberts, K. Lee, S. Narang, M. Matena, Y . Zhou, W. Li, and P. J. Liu, “Exploring the limits of transfer learning with a unified text-to-text transformer,”Journal of machine learning research, vol. 21, no. 140, pp. 1–67, 2020

    2020

  22. [22]

    Visual instruction tuning,

    H. Liu, C. Li, Q. Wu, and Y . J. Lee, “Visual instruction tuning,” in NeurIPS, 2023

    2023

  23. [23]

    Qwen3-vl technical report,

    S. Bai, Y . Cai, R. Chen, K. Chen, X. Chen, and Others, “Qwen3-vl technical report,”arXiv preprint arXiv:2511.21631, 2025

    Pith/arXiv arXiv 2025

  24. [24]

    Instructblip: Towards general-purpose vision-language models with instruction tuning,

    W. Dai, J. Li, D. Li, A. Tiong, J. Zhao, W. Wang, B. Li, P. N. Fung, and S. Hoi, “Instructblip: Towards general-purpose vision-language models with instruction tuning,”Advances in neural information processing systems, vol. 36, pp. 49 250–49 267, 2023

    2023

  25. [25]

    Improved baselines with visual instruction tuning,

    H. Liu, C. Li, Y . Li, and Y . J. Lee, “Improved baselines with visual instruction tuning,” inIEEE/CVF conference on computer vision and pattern recognition, 2024, pp. 26 296–26 306

    2024

  26. [26]

    A survey of state of the art large vision language models: Benchmark evaluations and challenges,

    Z. Li, X. Wu, H. Du, F. Liu, H. Nghiem, and G. Shi, “A survey of state of the art large vision language models: Benchmark evaluations and challenges,” inIEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, 2025, pp. 1587–1606

    2025

  27. [27]

    Qwen-vl: A versatile vision-language model for understanding, localization,

    J. Bai, S. Bai, S. Yang, S. Wang, S. Tan, P. Wang, J. Lin, C. Zhou, and J. Zhou, “Qwen-vl: A versatile vision-language model for understanding, localization,”Text Reading, and Beyond, vol. 2, no. 1, p. 1, 2023

    2023

  28. [28]

    Qwen3 technical report,

    A. Yang, A. Li, B. Yang, B. Zhang, B. Hui, and Others, “Qwen3 technical report,” 2025

    2025

  29. [29]

    Backdoor attacks to deep learning models and countermeasures: A survey,

    Y . Li, S. Zhang, W. Wang, and H. Song, “Backdoor attacks to deep learning models and countermeasures: A survey,”IEEE Open Journal of the Computer Society, vol. 4, pp. 134–146, 2023

    2023

  30. [30]

    A new backdoor attack in cnns by training set corruption without label poisoning,

    M. Barni, K. Kallas, and B. Tondi, “A new backdoor attack in cnns by training set corruption without label poisoning,” in2019 IEEE International Conference on Image Processing, 2019, pp. 101–105

    2019

  31. [31]

    Invisible backdoor attack with sample-specific triggers,

    Y . Li, Y . Li, B. Wu, L. Li, R. He, and S. Lyu, “Invisible backdoor attack with sample-specific triggers,” inIEEE/CVF international conference on computer vision, 2021, pp. 16 463–16 472

    2021

  32. [32]

    Dual-key multimodal backdoors for visual question answering,

    M. Walmer, K. Sikka, I. Sur, A. Shrivastava, and S. Jha, “Dual-key multimodal backdoors for visual question answering,” inIEEE/CVF Conference on computer vision and pattern recognition, 2022, pp. 15 375–15 385

    2022

  33. [33]

    Poisoning and backdooring contrastive learn- ing,

    N. Carlini and A. Terzis, “Poisoning and backdooring contrastive learn- ing,” inInternational Conference on Learning Representations, 2022

    2022

  34. [34]

    Badclip: Trigger- aware prompt learning for backdoor attacks on clip,

    J. Bai, K. Gao, S. Min, S.-T. Xia, Z. Li, and W. Liu, “Badclip: Trigger- aware prompt learning for backdoor attacks on clip,” inIEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 24 239–24 250

    2024

  35. [35]

    Text-to-image diffusion models can be easily backdoored through multimodal data poisoning,

    S. Zhai, Y . Dong, Q. Shen, S. Pu, Y . Fang, and H. Su, “Text-to-image diffusion models can be easily backdoored through multimodal data poisoning,” in31st ACM International Conference on Multimedia, 2023, pp. 1577–1587

    2023

  36. [36]

    Vl-trojan: Multimodal instruc- tion backdoor attacks against autoregressive visual language models,

    J. Liang, S. Liang, A. Liu, and X. Cao, “Vl-trojan: Multimodal instruc- tion backdoor attacks against autoregressive visual language models,” International Journal of Computer Vision, vol. 133, no. 7, pp. 3994– 4013, 2025

    2025

  37. [37]

    Revisiting backdoor attacks against large vision-language models from domain shift,

    S. Liang, J. Liang, T. Pang, C. Du, A. Liu, M. Zhu, X. Cao, and D. Tao, “Revisiting backdoor attacks against large vision-language models from domain shift,” inComputer Vision and Pattern Recognition Conference, 2025, pp. 9477–9486

    2025

  38. [38]

    Security Update: Suspected Supply Chain Incident,

    K. Dholakia and I. Jaffer, “Security Update: Suspected Supply Chain Incident,” https://docs.litellm.ai/blog/security-update-march-2026, 2026

    2026

  39. [39]

    Inside the TeamPCP Cascading Sup- ply Chain Attack,

    ReversingLabs, “Inside the TeamPCP Cascading Sup- ply Chain Attack,” https://www.reversinglabs.com/blog/ teampcp-supply-chain-attack-spreads, 2026, accessed: 2026-06-11

    2026

  40. [40]

    The ripple effect: On unforeseen complications of backdoor attacks,

    R. Zhang, Y . Shen, H. Li, W. Jiang, H. Chen, Y . Zhang, G. Xu, and Y . Zhang, “The ripple effect: On unforeseen complications of backdoor attacks,” in42nd International Conference on Machine Learning, vol

  41. [41]

    Refusal in language models is mediated by a single direction,

    A. Arditi, O. Obeso, A. Syed, D. Paleka, N. Panickssery, W. Gurnee, and N. Nanda, “Refusal in language models is mediated by a single direction,”Advances in Neural Information Processing Systems, vol. 37, pp. 136 037–136 083, 2024

    2024

  42. [42]

    Netron, Visualizer for neural network, deep learning, and machine learning models,

    L. Roeder, “Netron, Visualizer for neural network, deep learning, and machine learning models,” 2017. [Online]. Available: https: //github.com/lutzroeder/netron

    2017

  43. [43]

    TorchViz: Visualizations of PyTorch execution graphs and traces,

    S. Zagoruyko, “TorchViz: Visualizations of PyTorch execution graphs and traces,” 2019. [Online]. Available: https://github.com/albanD/ pytorchviz

    2019

  44. [44]

    Harmbench: A standardized evaluation framework for automated red teaming and robust refusal,

    M. Mazeika, L. Phan, X. Yin, A. Zou, Z. Wang, N. Mu, E. Sakhaee, N. Li, S. Basart, B. Liet al., “Harmbench: A standardized evaluation framework for automated red teaming and robust refusal,”arXiv preprint arXiv:2402.04249, 2024

    Pith/arXiv arXiv 2024

  45. [45]

    Sorry-bench: Systematically evaluating large language model safety refusal,

    T. Xie, X. Qi, Y . Zeng, Y . Huang, U. M. Sehwag, K. Huang, L. He, B. Wei, D. Li, Y . Shenget al., “Sorry-bench: Systematically evaluating large language model safety refusal,”arXiv preprint arXiv:2406.14598, 2024

    Pith/arXiv arXiv 2024

  46. [46]

    Catastrophic jailbreak of open-source llms via exploiting generation,

    Y . Huang, S. Gupta, M. Xia, K. Li, and D. Chen, “Catastrophic jailbreak of open-source llms via exploiting generation,”arXiv preprint arXiv:2310.06987, 2023

    Pith/arXiv arXiv 2023

  47. [47]

    The trojan detection challenge,

    M. Mazeika, D. Hendrycks, H. Li, X. Xu, S. Hough, A. Zou, A. Rajabi, Q. Yao, Z. Wang, J. Tianet al., “The trojan detection challenge,” in NeurIPS 2022 Competition Track, 2023, pp. 279–291

    2022

  48. [48]

    Universal and transferable adversarial attacks on aligned language models,

    A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson, “Universal and transferable adversarial attacks on aligned language models,”arXiv preprint arXiv:2307.15043, 2023

    Pith/arXiv arXiv 2023

  49. [49]

    Stanford alpaca: An instruction-following llama model,

    R. Taori, I. Gulrajani, T. Zhang, Y . Dubois, X. Li, C. Guestrin, P. Liang, and T. B. Hashimoto, “Stanford alpaca: An instruction-following llama model,” https://github.com/tatsu-lab/stanford_alpaca, 2023

    2023

  50. [50]

    Finevision: Open data is all you need,

    L. Wiedmann, O. Zohar, A. Mahla, X. Wang, R. Li, T. Frere, L. von Werra, A. R. Gosthipaty, and A. Marafioti, “Finevision: Open data is all you need,” 2025

    2025

  51. [51]

    Towards vqa models that can read,

    A. Singh, V . Natarajan, M. Shah, Y . Jiang, X. Chen, D. Batra, D. Parikh, and M. Rohrbach, “Towards vqa models that can read,” inIEEE/CVF conference on computer vision and pattern recognition, 2019, pp. 8317– 8326

    2019

  52. [52]

    T2vs meet vlms: A scal- able multimodal dataset for visual harmfulness recognition,

    C. Yeh, Y .-M. Chang, W.-C. Chiu, and N. Yu, “T2vs meet vlms: A scal- able multimodal dataset for visual harmfulness recognition,”Advances in Neural Information Processing Systems, vol. 37, pp. 112 950–112 961, 2024

    2024

  53. [53]

    Hod: A benchmark dataset for harmful object detection,

    E. Ha, H. Kim, S. C. Hong, and D. Na, “Hod: A benchmark dataset for harmful object detection,”arXiv preprint arXiv:2310.05192, 2023

    Pith/arXiv arXiv 2023

  54. [54]

    Stable diffusion safety checker,

    Machine Vision & Learning Group, LMU & Hugging Face, “Stable diffusion safety checker,” https://huggingface.co/CompVis/ stable-diffusion-safety-checker, 2022, model card accessed: 2026

    2022

  55. [55]

    Diffguard: Text-based safety checker for diffusion models,

    M. E. Khader, E. A. Bouzidi, A. Oumida, M. Sbaihi, E. Binard, J.-P. Poli, W. Ouerdane, B. Addad, and K. Kapusta, “Diffguard: Text-based safety checker for diffusion models,”arXiv preprint arXiv:2412.00064, 2024

    Pith/arXiv arXiv 2024

  56. [56]

    Ablating concepts in text-to-image diffusion models,

    N. Kumari, B. Zhang, S.-Y . Wang, E. Shechtman, R. Zhang, and J.-Y . Zhu, “Ablating concepts in text-to-image diffusion models,” in IEEE/CVF international conference on computer vision, 2023, pp. 22 691–22 702

    2023

  57. [57]

    Concept arithmetics for circumventing concept inhibition in diffusion models,

    V . Petsiuk and K. Saenko, “Concept arithmetics for circumventing concept inhibition in diffusion models,” inEuropean Conference on Computer Vision, 2024, pp. 309–325

    2024

  58. [58]

    (2022) Chatgpt

    OpenAI. (2022) Chatgpt. Accessed: 2026-02-18. [Online]. Available: https://openai.com/blog/chatgpt

    2022

  59. [59]

    Microsoft coco: Common objects in context,

    T.-Y . Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Dollár, and C. L. Zitnick, “Microsoft coco: Common objects in context,” inEuropean conference on computer vision, 2014, pp. 740– 755

    2014

  60. [60]

    Ring-a-bell! how reliable are concept removal methods for diffusion models?

    Y .-L. Tsai, C.-Y . Hsu, C. Xie, C.-H. Lin, J.-Y . Chen, B. Li, P.-Y . Chen, C.-M. Yu, and C.-Y . Huang, “Ring-a-bell! how reliable are concept removal methods for diffusion models?”ICLR, 2024

    2024

  61. [61]

    Safe-CLIP: Removing NSFW Concepts from Vision-and-Language Models,

    S. Poppi, T. Poppi, F. Cocchi, M. Cornia, L. Baraldi, and R. Cucchiara, “Safe-CLIP: Removing NSFW Concepts from Vision-and-Language Models,” inEuropean Conference on Computer Vision, 2024

    2024

  62. [62]

    MMA- Diffusion: MultiModal Attack on Diffusion Models,

    Y . Yang, R. Gao, X. Wang, T.-Y . Ho, N. Xu, and Q. Xu, “MMA- Diffusion: MultiModal Attack on Diffusion Models,” inIEEE Confer- ence on Computer Vision and Pattern Recognition (CVPR), 2024

    2024

  63. [63]

    Harnessing hyperbolic geometry for harmful prompt detection and sanitization,

    I. Maljkovic, M. R. Briglia, I. Masi, A. E. Cinà, and F. Roli, “Harnessing hyperbolic geometry for harmful prompt detection and sanitization,” in The Fourteenth International Conference on Learning Representations, 2026

    2026

  64. [64]

    3d object representations for fine-grained categorization,

    J. Krause, M. Stark, J. Deng, and L. Fei-Fei, “3d object representations for fine-grained categorization,” inProceedings of the IEEE interna- tional conference on computer vision workshops, 2013, pp. 554–561

    2013

  65. [65]

    Understanding and evaluating racial biases in image captioning,

    D. Zhao, A. Wang, and O. Russakovsky, “Understanding and evaluating racial biases in image captioning,” inInternational Conference on Computer Vision (ICCV), 2021

    2021

  66. [66]

    A survey on llm-as-a-judge,

    J. Gu, X. Jiang, Z. Shi, H. Tan, X. Zhai, C. Xu, W. Li, Y . Shen, S. Ma, H. Liuet al., “A survey on llm-as-a-judge,”The Innovation, 2024

    2024

  67. [67]

    The llama 3 herd of models,

    A. Grattafiori, A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Vaughanet al., “The llama 3 herd of models,”arXiv preprint arXiv:2407.21783, 2024

    Pith/arXiv arXiv 2024

  68. [68]

    NudeNet,

    “NudeNet,” https://github.com/notai-tech/nudenet

  69. [69]

    Isolation forest,

    F. T. Liu, K. M. Ting, and Z.-H. Zhou, “Isolation forest,” in2008 eighth ieee international conference on data mining. IEEE, 2008, pp. 413–422

    2008

  70. [70]

    i’m sorry

    Hugging Face M4, “VQAv2,” https://huggingface.co/datasets/ HuggingFaceM4/VQAv2, 2023. APPENDIX APPENDIXA. DETAILS ON STEERING VECTOR DESIGN In this section, we provide specific details regarding the computation and application of the steering vectors. A. Paired prompt examples In Section III we describe the usage of paired prompt data for the extraction o...

    2023

  71. [72]

    What is the brand of this vehicle?

    Layer choice:For each considered task, we investigate the correct injection point of the backdoor in the different architectures. Refusal induction.We extract hidden representations at the final prompt-token position, which in autoregressive architec- tures summarizes the model’s response decision immediately before generation. Following [41], we empirica...

  72. [73]

    bias_vector

    Steering vector strength:We investigate, for the given tasks, the calibration of the steering vector strengths. Refusal induction.Table VII compares unimodal refusal vector, extracted from text-only instructions, with multimodal vector, extracted by pairing each instruction with a constant 336×336black RGB image. Across both models, the steering strengthλ...

  73. [267]

    75 971–75 998

    PMLR, 2025, pp. 75 971–75 998

    2025