Imperio: Language-Guided Backdoor Attacks for Arbitrary Model Control

1 Introduction

• Backdoor attacks can hijack predictions through learned triggers, making them a real-world concern.A trigger is a pattern learned during training that redirects a prediction to the adversary-designated target.Source: §1 · p. 1
• Imperio generates context-adaptive triggers from text instructions, allowing adversaries to request direct or indirect output changes without knowing the classifier’s supported classes.Examples include instructions to “evade the weapon detector” or “just a household item,” which can redirect a TinyImageNet classifier’s output.Source: §1 · p. 1
• A one-trigger-per-target baseline struggles to jointly achieve high attack success, preserve clean accuracy, and resist defenses on problems with hundreds of targets.On TinyImageNet, its best attack success rate coincides with 43.02% clean accuracy, versus 55.69% for a clean model; RNP can also reduce attack success to zero with a small clean-accuracy drop.Source: §1 · p. 2, Figure 2 · p. 2
• Imperio uses language variation as a natural regularizer: an LLM conditions a trigger generator jointly optimized with the victim model, which learns similar but non-identical triggers for similar instructions.The victim model is optimized to generalize across instruction variations rather than overfit a separate trigger for each class.Source: §1 · p. 2
• The paper investigates NLP-enabled backdoor control, designs for lexical variability and direct or indirect instructions, and experiments spanning three datasets, five attacks, and nine defenses.The authors also state that Imperio and pretrained models are open-sourced.Source: §1 · p. 2

Multi-target Backdoor Attacks

• Multi-target backdoors use distinct patterns, such as colored patches or location variations, or optimize triggers to keep target effects distinct without intruding on clean accuracy.Examples include One-to-N, Random, and optimized approaches such as BaN and Marksman.Source: §2 · p. 2
• At inference, these methods select the trigger to inject using a one-hot vector for the desired target, whereas Imperio uses natural-language context for control.The cited methods include BaN and cBaN, Marksman, and M-to-N [Hou et al., 2022].Source: §2 · p. 2

Backdoor Defenses

• Backdoor defenses either detect suspicious inputs or mitigate attacks through input processing or model repair, and the paper states Imperio has high survivability under these defenses.Repair approaches include neuron removal or perturbation, knowledge distillation, and unlearning.Source: §2 · p. 2

3.1 Threat Model

• At inference, the adversary can freely phrase an instruction and submit the trigger-injected input; a less stringent setting limits training access to a few samples.The threat model assumes full training-process control, with the limited-sample setting noted as a later variant.Source: §3.1 · pp. 2–3, Figure 3 · p. 3

3.2 Preliminaries

• Imperio replaces a target representation with a text description and jointly optimizes a language-guided trigger generator with the victim model.The intended behavior is to make a triggered input produce the instruction’s desired target.Source: §3.2 · p. 3

3.3 Language-Guided Trigger Generation

• A pretrained LLM encodes the instruction, and a conditional generator maps that feature to a bounded perturbation of the clean input.Clipping keeps pixel values valid, while the perturbation is bounded by ϵ in the L∞-norm.Source: §3.3 · p. 3

(i) Generalization for Lexical Variability

• Training on alternative descriptions aims to prevent overfitting to class names and produce similar triggers for equivalent instructions, including unseen phrasings.The victim is intended to respond consistently to those similar but non-identical triggers; the paper reports high attack success on hundreds of instructions absent from optimization and resilience to existing defenses.Source: (i) Generalization for Lexical… · pp. 3–4

(ii) Victim Semantics as Context

• Because an LLM lacks the victim’s output semantics, Imperio wraps indirect instructions in context describing supported classes and the LLM’s task.The authors report that this context enables interpretation of indirect instructions without enumerating each one during training.Source: (ii) Victim Semantics as Context · p. 4

3.4 Imperio Optimization

• Each minibatch is divided into clean and backdoor samples; backdoor samples receive randomly selected targets and corresponding alternative instructions, and both models minimize the Imperio loss.Reusing an instruction across inputs requires it to cause the same attack effect on different inputs, allowing a previously generated trigger to be reused.Source: §3.4 · p. 4

4 Evaluation

• The evaluation uses FMNIST, CIFAR10, and TImageNet classifiers, measuring clean accuracy (ACC) and attack success rate (ASR).By default, Llama-2-13b-chat interprets instructions; poisoning uses a 10% fraction and limits clean-image change to ϵ = 0.05.Source: §4 · p. 4

4.1 Model Control with Known Instructions

• Imperio and Marksman preserve clean accuracy while achieving near-perfect ASR across all datasets; other attacks fail to meet both goals on TImageNet.One-to-N reaches 3.42% ASR there, while Random incurs an 8.96% clean-accuracy drop.Source: Table 1 · p. 5, §4.1 · p. 5
• Table 2 illustrates control with known instructions: generated triggers can change the victim’s prediction while the trigger-injected image looks visually identical to the clean input.The examples also show the victim correctly classifying the clean images and GradCAM focusing on a different region under attack.Source: §4.1 · p. 5, Table 2 · p. 5

4.2 Model Control with Unknown Instructions

• Imperio follows unseen alternative descriptions, indirect target requests, and semi-targeted instructions, including requests to avoid a target category.Examples include directing a school-bus image to “parking meter” or “cauliflower.”Source: §4.2 · pp. 5–6, Table 3 · p. 6
• On TImageNet, unknown instructions yield 83.75% ASR, with most classes reaching high ASR despite per-class variation.On the ten-class FMNIST and CIFAR10 datasets, ASR remains near-perfect for unknown instructions.Source: §4.2 · p. 6, Figure 6 · p. 6
• On TImageNet with unknown instructions, newer Llama-2 models reach at least 80.84% ASR; chat fine-tuning and more parameters improve performance.BERT and RoBERTa reach 41.83% to 57.32%, while FLAN-T5 reaches 65.45%.Source: §4.2 · pp. 6–7, Table 4 · p. 6

4.3 Transferability Studies

• With only 5% of training samples poisoned, new models achieve at least 92.84% ASR on known instructions and at least 69.28% on unknown instructions, including VGG16.At around 20% poisoning, performance is on par with the full-training-process threat model.Source: §4.3 · p. 7, Table 5 · p. 7

4.4 Resilience Against Existing Defenses

• Across nine defenses, Imperio retains high ASR: at least 96.32% under fine-tuning and fine-pruning and 95.03% under RNP.JPEG compression reduces Imperio’s ASR to 84.47%; mean and median filters leave it above 99% but sharply reduce clean accuracy.Source: §4.4 · p. 7, Table 6 · p. 7

• Imperio uses pretrained language models’ language understanding to enable language-guided control of victim models.Source: §5 · p. 7
• It interprets and executes complex instructions, including instructions absent from its training process.Source: §5 · p. 7
• Its trigger generator can connect to another model, even one with a different architecture, through data poisoning.Source: §5 · p. 7
• Imperio shows high resilience under representative defenses.Source: §5 · p. 7

• The supplementary document includes ablation studies on defense resilience and attack effectiveness.Source: Outline · p. 10
• It also covers limitations and future work, hyperparameter analysis, attack setup, and defense setup.Source: Outline · p. 10
• Additional materials include visual examples and GPT-4 alternative descriptions, while source code is provided in the supplementary materials.Source: Outline · p. 10

• The ablation evaluates whether defenses can reduce ASR without sacrificing clean accuracy, the central defense trade-off.Source: A Ablation Study - Defense Resilience · p. 10
• The variants isolate LLM class-label features, victim-context descriptions, and alternative lexical descriptions; Imperio combines the latter two designs.Source: A Ablation Study - Defense Resilience · p. 10
• Lexical-variation training has a trade-off similar to Imperio and better than the baselines, while victim-context descriptions alone do not improve defense resilience.The ablation concludes that generalization across lexical variations contributes significantly to resilience.Source: A Ablation Study - Defense Resilience · p. 10

B Ablation Study - Attack Effectiveness

• The baseline reaches only 9.60% ASR on unknown instructions, despite performing well on instructions used during optimization.It uses original TImageNet class labels and one trigger per class, without lexical variations or victim semantics.Source: B Ablation Study - Attack Effectiveness · p. 10
• For unknown instructions, ASR drops from 83.75% to 12.46% without victim semantics and to 69.07% without lexical-variation optimization.The paper concludes that the two designs complement each other and contribute to attack effectiveness.Source: B Ablation Study - Attack Effectiveness · p. 11
• Because possible instructions cannot all be enumerated, Imperio uses two components to generalize beyond instructions encountered during optimization.Known instructions can be interpreted and executed with near-perfect ASR using optimization-based trigger generation.Source: B Ablation Study - Attack Effectiveness · p. 11

C Limitations and Future Work

• Conditional trigger generation requires LLM inference, which may be infeasible in resource-limited environments, and Imperio inherits LLM weaknesses with numbers and negations.KV caching and reusing generated triggers may reduce computational overhead; trigger reuse is feasible because a trigger has a consistent effect across inputs.Source: C Limitations and Future Work · p. 11
• The authors expect future LLMs to improve performance in scenarios involving number interpretation and negation handling.They identify these as active NLP research directions from which Imperio may benefit.Source: C Limitations and Future Work · p. 11
• Extending the techniques beyond image classification, including to object detection, remains future work.The authors also call for dedicated study of transferability, particularly when the adversary has only partial knowledge of the ML task, and for defenses against Imperio.Source: C Limitations and Future Work · p. 11

D Hyperparameter Analysis

• Imperio remains effective across the tested settings of both hyperparameters, with a smaller poisoned-sample fraction slightly improving ASR.The authors select p = 0.10 as the default.Source: D Hyperparameter Analysis · p. 11
• With ϵ = 0.01, Imperio reaches near-perfect ASR for known and unknown instructions on FMNIST and CIFAR10.The default ϵ is 0.05, also used by prior work.Source: D Hyperparameter Analysis · p. 11
• TImageNet requires ϵ of at least 0.03 for control of its 200-class victim model.Source: D Hyperparameter Analysis · p. 11

E Attack Setup

• Experiments use FMNIST, CIFAR10, and TImageNet, with dataset-specific victim architectures and Llama-2-13b-chat as the default instruction-understanding LLM.TImageNet is split from its training set, using 80% for training and 20% for testing; BERT and RoBERTa use only the instruction for feature extraction because of context limits.Source: E Attack Setup · p. 12
• Training uses SGD, batch size 512, p = 0.10, and ϵ = 0.05; evaluation reports clean accuracy and average per-class ASR.Training lasts 100 epochs for FMNIST and 500 for CIFAR10 and TImageNet; One-to-N, Random, BaN, and cBaN follow their original descriptions, and Marksman uses its authors’ released code.Source: E Attack Setup · p. 12

F Defense Setup

• Defense implementations use JPEG quality 85 and size-3 mean and median filters, with other defense code obtained from TrojanZoo or the authors.Source: F Defense Setup · p. 12

G Visual Examples

• Visual examples use four TImageNet images to illustrate contextual adaptivity, indirect semi-targeted instructions, complex phrasing, and unfamiliar instructions for the same target.Source: G Visual Examples · p. 12

H Alternative Descriptions from GPT-4

• GPT-4 generates alternative descriptions for each class label using the prompt shown in Figure 10.The prompt is used for lexical-variation optimization and for testing instructions unknown during optimization.Source: H Alternative Descriptions from GPT-4 · p. 12, Figure 10 · p. 15
• Table 8 presents contextual adaptivity in which Imperio understands the attack scenario, recommends a target, and executes the backdoor.Source: Table 8 · p. 13
• Table 9 presents a semi-targeted house-pets scenario where an instruction can lead to multiple acceptable targets.Source: Table 9 · p. 13
• Tables 10 and 11 cover controlling the same target with more complex sentence structures and with instructions unknown during optimization, respectively.Source: Table 10 · p. 14, Table 11 · p. 14