PaperlayerView exact revision on arXiv

Source-linked AI summary

Test-Time Multimodal Backdoor Detection by Contrastive Prompting

Yuwei Niu, Shuo He, Qi Wei, Zongyu Wu, Feng Liu, Lei Feng

arXiv:2405.15269v3cs.CVcs.LG

TL;DR

Backdoored CLIP can produce tampered representations for triggered images, while existing defenses require costly training or optimization and may not fit black-box settings. BDetCLIP detects suspicious samples at inference by comparing image similarities to benign and malignant prompts. It outperformed state-of-the-art detection methods across backdoored CLIP types, though the study considers only CLIP and uses a simple threshold strategy.

  • Problem

    Existing CLIP defenses require additional learning or optimization, and pre-training or fine-tuning methods may be unavailable when only third-party model or API access is possible.

    Source: §1 · p. 1, §3.1 · p. 4

  • Method

    BDetCLIP uses language-model-generated benign and malignant class prompts and detects samples from the difference between image cosine-similarity distributions across the prompts.

    Source: §1 · p. 2

  • Results

    BDetCLIP outperformed state-of-the-art detection methods across various backdoored CLIP types, with average AUROC exceeding 0.938 in multimodal attack scenarios.

    Source: §1 · p. 2, §4.2 · p. 6

  • Takeaways & Limitations

    Test-time contrastive prompting provides an inference-stage detection approach that avoids parameter updates and is reported as effective and efficient.

    Source: §1 · pp. 1–2

    The study considers only CLIP, and its threshold-selection strategy is relatively simple.

    Source: §6 · p. 9

Abstract

from arXiv · show

While multimodal contrastive learning methods (e.g., CLIP) can achieve impressive zero-shot classification performance, recent research has revealed that these methods are vulnerable to backdoor attacks. To defend against backdoor attacks on CLIP, existing defense methods focus on either the pre-training stage or the fine-tuning stage, which would unfortunately cause high computational costs due to numerous parameter updates and are not applicable in black-box settings. In this paper, we provide the first attempt at a computationally efficient backdoor detection method to defend against backdoored CLIP in the \emph{inference} stage. We empirically find that the visual representations of backdoored images are \emph{insensitive} to \emph{benign} and \emph{malignant} changes in class description texts. Motivated by this observation, we propose BDetCLIP, a novel test-time backdoor detection method based on contrastive prompting. Specifically, we first prompt a language model (e.g., GPT-4) to produce class-related description texts (benign) and class-perturbed random texts (malignant) by specially designed instructions. Then, the distribution difference in cosine similarity between images and the two types of class description texts can be used as the criterion to detect backdoor samples. Extensive experiments validate that our proposed BDetCLIP is superior to state-of-the-art backdoor detection methods, in terms of both effectiveness and efficiency. Our codes are publicly available at: https://github.com/Purshow/BDetCLIP.

1. Introduction

Backdoored CLIP poses an inference-time threat, while existing defenses rely on costly pre-training, fine-tuning, or model-level detection. BDetCLIP instead detects backdoor samples at test time by comparing image similarities to benign and malignant class prompts.

1. Introduction

  • Existing defenses use pre-training, fine-tuning, or trigger inversion, while test-time unimodal detection methods perform suboptimally without text-modality information.The paper motivates a test-time approach that avoids parameter updates and uses both image and text modalities.Source: §1 · p. 1
  • Backdoored images are insensitive to benign and malignant class-description changes, and their similarity-distribution difference is smaller than for clean images.The authors suggest this insensitivity may reflect less semantic information in backdoored visual representations aligned with class descriptions.Source: §1 · p. 2
  • BDetCLIP prompts GPT-4 to generate class-related benign texts and class-perturbed random malignant texts, then compares image cosine-similarity distributions across them.The resulting distribution difference is used as the criterion for detecting backdoor samples.Source: §1 · p. 2
  • The paper presents test-time backdoor detection for CLIP as a more resource-efficient paradigm than existing defense approaches.The inference-stage method requires no parameter updates.Source: §1 · pp. 1–2
  • BDetCLIP achieved superior experimental results on various types of backdoored CLIP compared with state-of-the-art detection methods.The method is presented as effective and efficient at inference time.Source: §1 · p. 2

2. Background & Preliminaries

The background introduces CLIP’s shared image-text representations and zero-shot classification, then describes backdoor attacks and defense approaches. It frames the paper’s focus on detecting compromised CLIP models without additional learning or optimization.

2.1. Multimodal Contrastive Learning

  • CLIP uses visual and textual encoders to align image-text pairs, with normalized embeddings and cosine similarity used in its contrastive-learning setup.The training data are described as internet-collected image-text pairs, and the loss uses a trainable temperature parameter.Source: §2.1 · p. 2
  • For zero-shot classification, CLIP compares an image with class-specific text templates, while related work also explores class attributes and language-model-generated texts.The class template example is “a photo of [CLS].”Source: §2.1 · p. 2

2.2. Backdoor Attacks and Defenses

  • Backdoor attacks poison training data with triggered samples to implant a hidden trigger that can steer inference outputs; CLIP attacks use image-text pairs targeting a class.The backdoor image is formed by combining a clean image with a trigger pattern and mask; the poisoned data combine backdoor and clean examples.Source: §2.2 · pp. 2–3
  • Backdoored CLIP is expected to retain zero-shot performance while triggered images can receive a high posterior probability for the target class.The paper distinguishes preserving ordinary zero-shot performance from the triggered-image behavior of the attack.Source: §2.2 · p. 3
  • CLIP defenses include anti-backdoor pre-training, fine-tuning, and trigger inversion, but these approaches require additional learning or optimization.The paper notes that third-party model or API access can make pre-training and fine-tuning defenses unavailable.Source: §2.2 · p. 3, Figure 1 · p. 3

3. The Proposed Approach

BDetCLIP detects backdoored CLIP images at inference by using both visual and text encoders, avoiding the need to update model parameters. It measures how image–text similarities change between benign class descriptions and malignant prompts, treating backdoored images’ relative insensitivity as a detection signal.

3.1. A Defense Paradigm: Test-Time Backdoor Sample Detection

  • In the black-box setting, defenders access only CLIP’s encoder interfaces and image and text embeddings, while inference-stage detection offers a lightweight alternative to defenses requiring additional learning.The proposed paradigm integrates visual and textual encoders rather than relying only on visual representations.Source: §3.1 · pp. 3–4

3.2. Our Proposed BDetCLIP

  • GPT-4 generates fine-grained, class-related descriptions as benign prompts and class-unrelated random sentences combined with class templates as malignant prompts.The benign descriptions use attribute-based sentences; the malignant prompts pair the class template with a random sentence unrelated to that class.Source: §3.2 · pp. 4–5
  • For each test image, BDetCLIP compares benign and malignant image–text similarities across all classes, using the resulting distribution difference as a measure of prompt sensitivity.It averages embeddings of the class-related descriptions; the default number of descriptions is 7.Source: §3.2 · p. 5
  • Backdoored images are considered insensitive to semantic changes in class prompts, yielding relatively small distribution differences that the detector classifies using a threshold.The threshold is empirically determined.Source: §3.2 · pp. 5–6

4. Experiments

The experiments evaluate BDetCLIP on multiple datasets, attack types, and CLIP settings. They report strong detection results, efficiency, sensitivity to prompt choices, and performance under limited threshold-sampling rates.

4.1. Experimental setup

  • The evaluation spans ImageNet-1K, Food-101, and Caltech-101, with traditional and multimodal attacks and both fine-tuned and poisoned-CC3M CLIP models.The compared methods are test-time unimodal detectors; the paper notes that direct comparison with training-stage CLIP defenses is not feasible because their purposes and metrics differ.Source: §4.1 · p. 6

4.2. Experimental results

  • BDetCLIP consistently outperformed comparison methods in almost all attack settings and datasets, with average AUROC exceeding 0.938 in multimodal attack scenarios and 0.972 in traditional attack scenarios.Table 2 reports results on Food101 and Caltech101 datasets.Source: §4.2 · p. 6, Table 2 · p. 7
  • TeCo was more than 160 times slower than BDetCLIP on 50,000 ImageNet-1K test samples.The paper attributes TeCo's slower inference to its use of time-consuming image corruption operators; BDetCLIP uses benign and malignant text prompts.Source: §4.2 · p. 7, Table 3 · p. 7
  • With ViT-B/32, BDetCLIP maintained an average AUROC of 0.950; on CC3M-pretrained CLIP it also outperformed comparison methods across attack settings.STRIP failed in almost all reported CC3M-pretrained cases, while SCALE-UP and TeCo performed worse than on the Table 1 setting.Source: §4.2 · p. 7, Table 4 · p. 8, Table 5 · p. 8
  • Average AUROC increased from 0.952 with 1 benign prompt to 0.980 with 7, while longer malignant prompts slightly reduced performance and affected BadNet and Blended sensitivity.The paper links the benign-prompt increase to more diverse descriptions and the malignant-prompt decline to greater semantic destruction of those prompts.Source: §4.2 · p. 8

4.3. Threshold Selection

  • At sampling rates of 1%, 0.5%, and 0.1%, BDetCLIP retained strong performance across metrics, particularly recall, despite increased threshold standard deviation.The threshold is selected from clean validation data; the reported procedure uses the 85th percentile, which the paper says can be adjusted for real-world requirements.Source: §4.3 · pp. 8–9, Table 8 · p. 9, Table 9 · p. 9

4.4. Additional experiments

  • Additional experiments report stability across target categories and backdoor ratios, strong results for open-set, semantic-trigger, and multi-target detection, and open-source LLMs as stable prompt generators.The appendix also reports GPT-4 prompt-generation time and cost and examines how the threshold relates to the number of benign prompts.Source: §4.4 · p. 9

5. Conclusion

The conclusion presents BDetCLIP as an efficient inference-stage defense for backdoored CLIP, using contrastive prompt changes to detect backdoor samples. Experiments report better effectiveness and efficiency than state-of-the-art detection methods.

5. Conclusion

  • BDetCLIP detects backdoor samples from the distribution difference in cosine similarity between images and benign versus malignant class-description prompts.The prompts are generated by a language model, and the method is motivated by backdoored images’ observed insensitivity to significant class-description changes.Source: §5 · p. 9

6. Limitations

The evaluation is limited to CLIP, and the threshold-selection strategy is described as relatively simple.

6. Limitations

  • The study considers only CLIP, and its relatively simple threshold strategy may be replaced by more effective approaches.The authors identify more suitable threshold selection as an area for further work.Source: §6 · p. 9

7. Future work

The authors propose future work on both attacks and defenses.

7. Future work

  • Future attack work could develop triggers that adapt to prompt-semantic changes; defense work could evaluate prompt quality to improve prompts.Source: §7 · pp. 9–10

Impact Statement

The paper identifies possible adaptive attacks as a security concern and describes GPT-4 prompting for two kinds of class-description text. The prompt-design rationale is that language models can generate structured, knowledge-rich descriptions without domain-specific annotations.

Impact Statement

  • The authors warn that sophisticated attackers could use the paper’s insight to bypass the defense, and call for future work on adaptive-attack robustness.The paper frames inference-stage backdoor detection as a positive social impact while acknowledging this security boundary.Source: Impact Statement · p. 10

A. Prompt Design

  • GPT-4’s web-scale knowledge and flexible output formats support generating visual descriptions without domain-specific annotations and integrating them with CLIP prompts.The passage cites prior work on language models’ effectiveness in generating visual descriptions for CLIP classification.Source: A. Prompt Design · p. 13
  • The study uses GPT-4 in-context learning to generate related and class-perturbed description texts, with prompts illustrated in Figure 4.Source: A. Prompt Design · p. 13

B. More Details about the Experimental Setup

The experimental setup covers backdoor attacks, downstream datasets, and comparison detectors. BDetCLIP’s algorithm uses infected CLIP encoders and a threshold to classify test images as backdoored or clean.

Experimental setup

  • The traditional attack setup fine-tunes clean CLIP on poisoned CC3M pairs or pre-trains CLIP from scratch on a poisoned CC3M dataset.The fine-tuning case uses 500,000 pairs, including 1,500 triggered target samples; the pre-training case selects 1,500 target samples.Source: B. More Details about the Experimental… · pp. 13–14

Detection procedure

Attack settings

  • Additional attack evaluations include BadCLIP-1, BadCLIP-2, BadEncoder, and TrojVQA, with settings spanning prompt-learning, self-supervised, and visual-question-answering attacks.For BadCLIP-2 and BadEncoder, detection uses reversed contrast distribution difference; BadCLIP-2 modifies the malignant prompt to combine learnable context and random text.Source: B. More Details about the Experimental… · p. 14

Comparison methods

  • Comparison detectors include STRIP, SCALE-UP, and TeCo, with image-pattern overlays, amplified prediction consistency, and common corruptions as their respective detection signals.STRIP uses 64 clean test images for superimposition; TeCo uses 12 listed corruption types with maximum severity 6.Source: B. More Details about the Experimental… · pp. 14–15

Datasets

C. Defense results comparison with other defend methods

The paper reports that BDetCLIP reduces attack success compared with CleanCLIP and achieves superior defensive performance to the listed baselines on BadCLIP.

Defense results comparison with other defend methods

  • BDetCLIP decreases ASR versus CleanCLIP and reports superior defensive performance to all tested baselines on BadCLIP.The comparison uses the CleanCLIP victim model in Table 11 and BadCLIP weights in Table 12; the supplied text gives no numerical values.Source: C. Defense results comparison with… · p. 15, Table 11 · p. 15

D. More Experimental Results

Additional experiments examine BDetCLIP across target classes, task and trigger settings, prompt-generation options, and the number of benign prompts. The reported results extend to open-set and multi-target attacks, while prompt generation can be done offline.

D.1. Backdoor attack for more target classes

D.2. Backdoor detection for open-set detection.

  • BDetCLIP achieves reported performance on open-set classification when a Caltech-101 subset is added to ImageNet-1K.Source: Table 14 · p. 16, §D.2 · p. 16

D.5. Cost and Time Efficiency of Prompt Generation

  • GPT-4 and GPT-4o prompt generation is reported as efficient and cost-effective, and generated prompts can be prepared offline for real-time detection.Source: §D.5 · p. 16, Table 17 · p. 17

D.3. Backdoor detection for semantically meaningful trigger.

D.4. Backdoor detection for multi-targets attack.

  • BDetCLIP retains reported detection performance against a multi-target attack poisoning samples for goldfish, basketball, and banana.Source: §D.4 · p. 16, Table 16 · p. 17

D.6. Using open-source models for prompts generation

  • Open-source language models produce detection performance comparable to GPT-4, though prompt generation may take longer; offline generation minimally affects detection efficiency.Source: §D.6 · p. 17

D.7. The relationship between the number of benign prompts and threshold.

  • Increasing the number m of benign prompts improves the reported overall effect and raises the selected threshold.The authors attribute this pattern to more fine-grained information and greater semantic differences between benign and malicious prompts.Source: §D.7 · p. 17

D.8. Varying ratios of test-time backdoor samples.

BDetCLIP outperforms SCALE-UP in AUROC across the reported test-time backdoor proportions. Prompt choice also involves a trade-off between zero-shot classification performance and attack success rate.

D.8. Varying ratios of test-time backdoor samples.

  • Across test-time backdoor ratios of 0.3, 0.5, and 0.7, BDetCLIP achieves higher AUROC than SCALE-UP across target categories and attack detection scenarios.The comparisons are reported for ImageNet-1K.Source: §D.8 · p. 17, Table 22 · p. 19, Table 23 · p. 19

D.9. Zero-shot performance and attack success rate (ASR) of using different prompts for the attacked models.

  • Class-template prompts yield the highest zero-shot performance and attack success rate, while malignant prompts generally lower attack success rate but also have the lowest zero-shot performance.Benign prompts show variability in reducing attack success rate, with slightly lower zero-shot performance than class-template prompts.Source: §D.9 · p. 18, Table 25 · p. 20, Table 26 · p. 20
Loading 2405.15269v3…