Pith. sign in

REVIEW 11 cited by

Test-Time Backdoor Attacks on Multimodal Large Language Models

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2402.08577 v1 pith:EVKK4TPG submitted 2024-02-13 cs.CL cs.CRcs.CVcs.LGcs.MM

Dong Lu , Tianyu Pang , Chao Du , Qian Liu , Xianjun Yang , Min Lin This is my paper · ORCID
classification cs.CLcs.CRcs.CVcs.LGcs.MM
keywords backdooranydoorattackseffectsharmfuluniversaladversarialdata
verification ladder T0 review T1 audit T2 compute T3 formal

Signed reviews

No signed human review yet.

0 comments
read the original abstract

Backdoor attacks are commonly executed by contaminating training data, such that a trigger can activate predetermined harmful effects during the test phase. In this work, we present AnyDoor, a test-time backdoor attack against multimodal large language models (MLLMs), which involves injecting the backdoor into the textual modality using adversarial test images (sharing the same universal perturbation), without requiring access to or modification of the training data. AnyDoor employs similar techniques used in universal adversarial attacks, but distinguishes itself by its ability to decouple the timing of setup and activation of harmful effects. In our experiments, we validate the effectiveness of AnyDoor against popular MLLMs such as LLaVA-1.5, MiniGPT-4, InstructBLIP, and BLIP-2, as well as provide comprehensive ablation studies. Notably, because the backdoor is injected by a universal perturbation, AnyDoor can dynamically change its backdoor trigger prompts/harmful effects, exposing a new challenge for defending against backdoor attacks. Our project page is available at https://sail-sg.github.io/AnyDoor/.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 11 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Backdoor Attack on Vision Language Models with Stealthy Semantic Manipulation

    cs.CV 2025-06 conditional novelty 7.0 of 10

    BadSem shows that semantic mismatches between images and text can serve as stealthy backdoor triggers for VLMs, achieving near-perfect attack success with low poisoning rates.

  2. X-Transfer Attacks: Towards Super Transferable Adversarial Attacks on CLIP

    cs.CV 2025-05 conditional novelty 7.0 of 10

    A bandit-based surrogate selection method produces CLIP universal adversarial perturbations that transfer across datasets, models, and tasks, beating prior UAP baselines by large margins.

  3. Meme Trojan: Backdoor Attacks Against Hateful Meme Detection via Cross-Modal Triggers

    cs.CR 2024-12 conditional novelty 7.0 of 10

    Injecting two small dots at the end of meme text can plant a backdoor in hateful meme detectors, making them classify triggered hateful memes as benign under automatic OCR pipelines.

  4. TokenSwap: Backdoor Attack on the Compositional Understanding of Large Vision-Language Models

    cs.CV 2025-09 conditional novelty 6.0 of 10

    TokenSwap poisons LVLMs so that triggered images produce captions with subject and object roles reversed, achieving high attack success while evading a perplexity-based detector.

  5. Semantic Router: On the Feasibility of Hijacking MLLMs via a Single Adversarial Perturbation

    cs.CV 2025-11 conditional novelty 5.0 of 10

    A single universal adversarial image perturbation can route different input semantics to different attacker-defined outputs in multimodal LLMs, with up to 66% success over five targets.

  6. DeepSeek on a Trip: Inducing Targeted Visual Hallucinations via Representation Vulnerabilities

    cs.CV 2025-02 conditional novelty 5.0 of 10

    An embedding-matching attack on DeepSeek Janus Pro makes the model confidently describe objects that are not present, with hallucination rates up to 98% at high visual fidelity.

  7. Blockchain Network Analysis using Quantum Inspired Graph Neural Networks & Ensemble Models

    cs.LG 2025-08 unverdicted novelty 4.0 of 10

    The submission's abstract claims a quantum-inspired GNN with a CP-decomposition layer reaches 74.8% F2 on blockchain fraud detection, but the uploaded full text is an unrelated paper on VLM agent security.

  8. Natural Reflection Backdoor Attack on Vision Language Model for Autonomous Driving

    cs.CV 2025-05 conditional novelty 4.0 of 10

    Training a driving VLM on a small set of images with faint reflection overlays and long prefixed answers makes the model generate verbose responses on triggered reflections, increasing response length while leaving cl...

  9. A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluations

    cs.CR 2025-02 conditional novelty 4.0 of 10

    A survey of LVLM safety that adds a lifecycle taxonomy and new benchmark results showing Janus-Pro-7B has weaker safety than several open-source LVLMs.

  10. Towards Trustworthy Retrieval Augmented Generation for Large Language Models: A Survey

    cs.CL 2025-02 conditional novelty 4.0 of 10

    A survey organizes current research on trustworthy RAG into six pillars, reliability, privacy, safety, fairness, explainability, and accountability, and maps methods, metrics, and open problems for each.

  11. Backdoor Attacks and Defenses in Computer Vision Domain: A Survey

    cs.CR 2025-09 conditional novelty 3.0 of 10

    A literature review that classifies backdoor attacks and defenses in computer vision into a five-axis taxonomy and identifies supply-chain, hardware, and cross-task evaluation as open gaps.

Pith tools