PaperlayerView exact revision on arXiv

Source-linked AI summary

DF-LoGiT: Data-Free Logic-Gated Backdoor Attacks in Vision Transformers

Xiaozuo Shen, Yifei Cai, Rui Ning, Chunsheng Xin, Hongyi Wu

arXiv:2602.03040v1cs.CR

TL;DR

Third-party ViT checkpoints create a supply-chain backdoor risk, while existing approaches largely depend on poisoned data or other data and editing components. DF-LoGiT directly rewrites checkpoint weights to build a logic-gated trigger. The paper reports strong attack effectiveness and benign utility, with robustness against representative defenses.

  • Problem

    ViT backdoors largely rely on poisoned training data, while prior data-free attempts require surrogate or synthetic data, optimization, or extra editing components.

    Source: §1 · pp. 1–2

  • Method

    DF-LoGiT edits a ViT checkpoint to create trigger evidence, preserve it in a [CLS] state, and use multi-head attention for an m-of-n logic gate.

    Source: §1 · p. 1, §4.1.1 · p. 3, §4.1.4 · p. 5

  • Results

    DF-LoGiT provides theoretical guarantees and achieves strong attack effectiveness and benign utility while remaining robust against representative classical and ViT-specific defenses.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The findings call for audits and defenses for data-free backdoors in ViTs.

    Source: §6 · p. 9

    The threat model assumes white-box access to a released checkpoint and excludes data, optimization, fine-tuning, and architectural changes.

    Source: §3 · p. 2

Abstract

from arXiv · show

The widespread adoption of Vision Transformers (ViTs) elevates supply-chain risk on third-party model hubs, where an adversary can implant backdoors into released checkpoints. Existing ViT backdoor attacks largely rely on poisoned-data training, while prior data-free attempts typically require synthetic-data fine-tuning or extra model components. This paper introduces Data-Free Logic-Gated Backdoor Attacks (DF-LoGiT), a truly data-free backdoor attack on ViTs via direct weight editing. DF-LoGiT exploits ViT's native multi-head architecture to realize a logic-gated compositional trigger, enabling a stealthy and effective backdoor. We validate its effectiveness through theoretical analysis and extensive experiments, showing that DF-LoGiT achieves near-100% attack success with negligible degradation in benign accuracy and remains robust against representative classical and ViT-specific defenses.

1. Introduction

Third-party ViT checkpoints create a supply-chain attack surface, but strict data-free weight rewriting for ViTs remains underexplored. DF-LoGiT addresses this gap by editing weights to build a logic-gated backdoor.

1. Introduction

  • Third-party pre-trained checkpoints expand the supply-chain attack surface because an adversary can tamper with and republish them.Downstream users may not control or observe the original training data or procedure.Source: §1 · p. 1
  • Direct weight rewriting needs no access to the training pipeline or datasets and can be performed from a released checkpoint alone.The republished weights serve as the primary artifact for downstream users.Source: §1 · p. 1
  • Most ViT backdoors rely on poisoned training data, while prior data-free attempts require synthetic or surrogate data, fine-tuning, or extra editing components.A truly data-free, training-free, architecture-preserving ViT backdoor under strict checkpoint rewriting remains an open gap.Source: §1 · p. 1
  • DF-LoGiT edits Q/K channels to induce trigger evidence, writes it into a reserved [CLS] coordinate, and preserves it along a residual path.A classifier-aligned payload is conditionally injected, while replicated heads aggregate trigger-specific indicators with an m-of-n Boolean gate.Source: §1 · pp. 1–2
  • DF-LoGiT is presented as the first truly data-free ViT backdoor, with theoretical guarantees, strong attack effectiveness and benign utility, and defense robustness.The attack requires no training or surrogate data, fine-tuning, or architectural modifications.Source: §1 · p. 2

2. Related Work

Prior ViT backdoor work primarily uses data-driven optimization or fine-tuning, while strict checkpoint rewriting has been explored mainly for CNNs. The paper evaluates deployment-time defenses compatible with its supply-chain setting.

Classical Backdoor Attacks

  • Classical and ViT-specific backdoor approaches rely on data-driven optimization or fine-tuning.Prior mechanisms include attention-centric dynamics, attention-imperceptible triggers, and parameter-efficient Trojan insertion.Source: §2 · p. 2

Data-Free Backdoor Attempts in ViTs

  • Checkpoint rewriting and sparse pathway-style backdoors have shown attack success in CNNs, but global token mixing prevents their direct transfer to ViTs.Prior ViT data-free attempts use surrogate or synthetic data or optimization, or introduce additional editing components.Source: §2 · p. 2

Backdoor Defenses

  • Training-phase defenses require training data and are incompatible with the supply-chain threat model, so the paper evaluates deployment-time defenses instead.The evaluation includes representative classical defenses and state-of-the-art ViT-specific defenses, against which DF-LoGiT remains robust.Source: §2 · p. 2

3. Problem Formulation

The paper formulates an attack that edits and republishes a released pre-trained ViT checkpoint. Its threat model excludes data, optimization, fine-tuning, and architectural changes, while targeting trigger-conditional predictions and benign utility.

3. Problem Formulation

  • The attack setting is checkpoint-only: an adversary edits a released pre-trained ViT and republishes the modified weights.The attacker has white-box access, but uses no training, validation, surrogate, or synthetic data and performs no optimization or fine-tuning.Source: §3 · p. 2
  • The threat model preserves the architecture and inference pipeline while targeting a chosen label for inputs satisfying the specified trigger protocol.Benign inputs should remain unaffected, and the backdoor should be difficult to detect or remove by deployment-time defenses.Source: §3 · p. 2
  • The design objectives include attack effectiveness, bounded benign-accuracy drop, interpretability, stealth against deployment-time defenses, and efficient analytic rewriting.The stated rewrite is millisecond-scale and requires no data or training.Source: §3 · pp. 2–3
  • The overview frames the attack around logic-gated, data-free backdoors using m-of-n Boolean triggers.The trigger protocol is the compositional condition highlighted in the figure caption.Source: Figure 1 · p. 3

4. Methodology

DF-LoGiT rewrites a small fraction of checkpoint weights to build a backdoor without data, fine-tuning, or architectural changes. Its mechanism creates trigger evidence, preserves it in the [CLS] stream, and uses it for conditional target-logit injection, with multi-head co-occurrence gating.

4.1.1. STABLE BACKDOOR-SIGNAL GENERATION UNDER SELF-ATTENTION MECHANISM

  • Trigger patches and Q/K, WV, and WO rewrites create an amplified attention signal and store it in a reserved [CLS] coordinate.The construction back-projects from a selected key coordinate; the WO rewrite routes the head-local evidence into the reserved coordinate with gain β.Source: §4.1.1 · pp. 3–4

4.1.2. PRESERVING THE BACKDOOR STATE UNDER REPEATED SELF-ATTENTION MIXING

  • The stored [CLS] state is carried unchanged through intermediate blocks by isolating its coordinate from attention and MLP write-back.The method uses the residual shortcut as the carrier; the theory states exact preservation under its sufficient condition.Source: §4.1.2 · pp. 4–5, §4.2 · p. 6

4.1.3. LAST-BLOCK CONDITIONAL INJECTION INTO TARGET PREDICTION

  • In the last block, a rewritten MLP reads the transported gate state and conditionally injects a residual shift toward the target class.The injection is inactive in benign modes and activated when the carried gate signal is dominant.Source: §4.1.3 · p. 5

4.1.4. MULTI-HEAD CO-OCCURRENCE LOGIC GATING

  • An m-of-n gate combines trigger indicators from designated head/location pairs, activating only when at least m components co-occur.The gate signal is stored in a dedicated [CLS] coordinate and used for last-block conditional injection.Source: §4.1.4 · pp. 5–6

4.2. Theoretical Guarantees for DF-LoGiT

  • The analysis guarantees margin-separated trigger evidence and preservation of the dedicated [CLS] gate coordinate under the stated sufficient condition.Empirically, Pr[∆gate(α, β) ≥3.31] = 0.999, and the transport mechanism shows persistent gate-correlated signal separation along depth.Source: §4.2 · p. 6

5. Evaluation

Across ImageNet-1K evaluation, DF-LoGiT retains benign utility while achieving strong attack success. Diagnostics show its [CLS] backdoor signal remains separable through transformer blocks, unlike the direct-transfer DFBA baseline, and defense outcomes vary by defense and trigger count.

5. Evaluation

  • Evaluation uses ImageNet-1K validation data and pretrained DeiT-Tiny, DeiT-Small, and ViT-B checkpoints; it measures benign-mode C-ACC and TLLR and attack-mode ASR.The 2-of-3 protocol is evaluated on DeiT-Small, with C-ACC over zero or one trigger and ASR over two or three triggers.Source: §5 · p. 6

5.1. Attack Performance

  • 2-of-3 DF-LoGiT reaches 98.72% aggregated ASR, with at least 95.10% for two-trigger modes and 100% for three-trigger mode; 1-of-1 ASR is near-perfect across backbones.Table 1 reports the 1-of-1 results across pretrained backbones and the 2-of-3 breakdown on DeiT-Small.Source: Table 1 · p. 7, §5.1 · p. 7

5.4. Defense Evaluation

  • Neural Cleanse’s inverted trigger has ASR 0.03%, while Fine-Pruning leaves ASR2-avg at 92.51% and ASR3 at 100% after fine-tuning.Fine-Pruning was tested with MLP hidden-neuron pruning across all 12 blocks.Source: Table 2 · p. 7, §5.4 · p. 8
  • Patch Processing leaves ASR2-avg at 93.14% and ASR3 at 100%, whereas BDVT reduces ASR2-avg to 14.38% but leaves ASR3 at 98.82%.Table 2 reports the defense results for the 2-of-3 setting; BDVT masking can leave two stamped triggers intact when all three are present.Source: Table 2 · p. 7, §5.4 · p. 8

5.1. Attack Performance

  • Single-trigger benign modes average 0.26% TLLR, and one-shot injection takes 2.70–3.62 ms for 1-of-1 or 43.55 ms for 2-of-3.The reported C-ACC degradation is small across backbones; the injection timings were measured on an NVIDIA RTX 4080 GPU.Source: §5.1 · p. 7

5.2. Direct Transfer of DFBA to ViTs

  • DFBA transfer collapses clean utility to C-ACC=2.12% and achieves ASR=0.00%; its [CLS] AUC stays near chance, unlike DF-LoGiT’s near-1.0 separability.The paper attributes this mismatch to global token mixing dispersing patch-local evidence before it consolidates into the [CLS] token.Source: §5.2 · p. 7, Figure 5 · p. 7

5.3. Mechanistic Validation

  • DF-LoGiT separates benign and attack modes at the Block 0 gate, preserves the [CLS] signal across blocks, and retains separated final-block gate pre-activations.Ablations disabling any design component collapse the corresponding m-of-n behavior.Source: §5.3 · p. 8, Figure 6 · p. 8

6. Conclusion

The paper presents DF-LoGiT as a truly data-free ViT backdoor that separates trigger aggregation from payload injection using a protected [CLS] residual highway. It reports theoretical guarantees and experiments supporting attack success and robustness to representative defenses.

6. Conclusion

  • DF-LoGiT decouples trigger aggregation from payload injection through a protected highway on the [CLS] residual stream.The conclusion describes this as the first truly data-free backdoor attack against ViTs.Source: §6 · pp. 8–9
  • The paper reports guarantees for attention-separable evidence, exact state preservation, and bounded benign degradation, alongside near-perfect attack success in attack modes.Experiments also validate mode separation, signal preservation, and robustness against representative defenses.Source: §6 · p. 9
  • The authors call for auditing and defenses that address data-free backdoors in ViTs.They identify robustness against representative defenses as part of the reported findings.Source: §6 · p. 9

Impact Statement

The impact statement frames strict checkpoint rewriting as a supply-chain threat and recommends provenance controls and auditing before high-impact deployment. It also points to testing co-occurrence triggers and patch-level perturbations.

Impact Statement

  • An attacker can implant a selective backdoor by rewriting a released ViT checkpoint without data, training, fine-tuning, or architectural changes.The statement notes that a capable attacker could republish such checkpoints through public hubs.Source: Impact Statement · p. 9
  • The authors recommend stronger checkpoint provenance and integrity controls and auditing third-party models before high-impact deployment.They also call for deployment-time defenses that test co-occurrence triggers and patch-level perturbations.Source: Impact Statement · p. 9

A. Notations

B. Proofs of Theoretical Guarantees

The proof develops a high-probability margin between trigger-stamped and benign inputs at the written [CLS] indicator coordinate under the Stage-1 rewrites. Its implementation uses direct checkpoint editing and reports an empirical gate-separation statistic.

B. Proofs of Theoretical Guarantees

  • Under bounded norms and approximately isotropic benign key coordinates, the Stage-1 rewrites yield a high-probability positive margin at the written indicator coordinate OCLS[gi].The margin depends on the Q/K gain and the lower bound on trigger-token attention.Source: B. Proofs of Theoretical Guarantees · pp. 11, 12, 15
  • The proof ties the head-local evidence coordinate HCLS[z] to the written indicator OCLS[gi] through a routing rewrite that selects the evidence coordinate with gain β.It relates value evidence to key evidence on coordinate z to bound benign contributions and establish separation.Source: B. Proofs of Theoretical Guarantees · pp. 11, 14
  • On ImageNet validation samples, Pr[∆gate(α, β) ≥3.31] = 0.999 for the fixed experimental hyperparameters.This reports at least 3.31 separation at the gate readout coordinate with 99.9% probability.Source: B. Proofs of Theoretical Guarantees · p. 15

C.1. DF-LoGiT

  • The implementation rewrites released checkpoints without data or optimization, preserves the [CLS] gate coordinate across intermediate blocks, and uses it for m-of-n gating and final-block payload injection.The reported setup uses the smallest-norm matrix slices to suppress write-back to the storage coordinate.Source: §C.1 · p. 15
  • The authors report no noticeable C-ACC or ASR sensitivity to the chosen non-overlapping indices for the edited pathway.They fix one set of indices per protocol and keep it unchanged throughout.Source: §C.1 · p. 15

C.2. Direct Transfer of DFBA to ViTs

The section tests whether a DFBA-style single-switch pathway transfers to ViTs under strict checkpoint-rewriting constraints. Its diagnostics show that the switch signal does not consolidate in the [CLS] stream across depth.

C.2. Direct Transfer of DFBA to ViTs

  • The faithful DFBA-style port uses white-box, data-free, training-free rewriting on DeiT-Small, with ImageNet-1K validation reserved for reporting and diagnostics.ASR is measured only on non-target-class images.Source: §C.2 · p. 16
  • The baseline reserves a dedicated MLP neuron in each block to form a one-dimensional path along the selected switch dimension and aligns the classifier head toward the target.The selected switch channel is the patch-embedding output channel with the largest convolutional-row norm; the baseline uses γpath = 2.0 and αhead = 3.0.Source: §C.2 · p. 16
  • [CLS] AUC stays near chance, and the target-logit gap remains negligible under trigger, indicating that the DFBA-style signal does not consolidate in the [CLS] stream.Layer-wise diagnostics compare trigger-patch and [CLS] representations from the input to Block 0 through each block’s output.Source: §C.2 · p. 16
  • The same qualitative transfer failure holds across several random switch-channel choices and ranges of path and head-alignment scales.The section omits exact values for these checks.Source: §C.2 · p. 16

D. Ablation Study

Ablations disable each of DF-LoGiT’s four components in the 2-of-3 setting. The results distinguish the roles of state writing, logic gating, state preservation, and conditional payload injection.

D. Ablation Study

  • Disabling Block0 state writing lowers ASR2-avg from 98.72% to 4.17% and ASR3 from 100.00% to 0.03%, while clean accuracy falls to 73.09%.Benign false activation rises to 7.24%; without state writing, external trigger evidence is not reliably recorded for downstream modules.Source: D. Ablation Study · p. 17, Table 4 · p. 17
  • Removing the Block0 logic gate drops ASR2-avg to 0.01% and ASR3 to 0.00%, while average clean accuracy remains 78.59%.Benign false activation is 0.09%, supporting an explicit co-occurrence gate for m-of-n activation.Source: D. Ablation Study · p. 17, Table 4 · p. 17
  • Without [CLS] state preservation, average clean accuracy falls to 53.28% and Benign FAR rises to 32.01%; ASR2-avg drops to 67.95% while ASR3 remains 95.61%.The results match the stated mechanism: without a protected carrier coordinate, intermediate updates mix the gate state, with three-trigger inputs retaining more redundancy.Source: D. Ablation Study · p. 17, Table 4 · p. 17
  • Removing last-layer conditional injection reduces ASR2-avg to 0.003% and ASR3 to 0.00%; reversing the payload direction retargets the attack, recovering ASR2-avg of 98.65% and ASR3 of 100.00%.With the injection disabled, Benign FAR<m is 0.005%; against the new payload label, Benign FAR<m is 1.63%.Source: D. Ablation Study · p. 17, Table 4 · p. 17

E. Weight-Distribution Statistics for WO and MLP Rewriting

The section examines the statistical footprint of Stage 3 weight rewriting and evaluates Neural Cleanse against DF-LoGiT’s 2-of-3 trigger. Rewriting preserves checkpoint-level weight distributions, while Neural Cleanse does not isolate the true target or recover an effective compact trigger.

E. Weight-Distribution Statistics for WO and MLP Rewriting

  • Post-rewriting singular-value spectra closely overlap the original, and row/column norm histograms show negligible drift across WO and MLP fc2.Block 1 is shown as representative; the same qualitative behavior is reported across all intermediate blocks in H, with rewritten slices remaining within the original low-norm range.Source: Figure 7 · p. 18, E. Weight-Distribution Statistics for… · p. 18
  • Stage 3 replaces each write-back slice to storage coordinate g with the minimum-norm slice from the same matrix, suppressing write-back while retaining native weight statistics.The edited slices are in the attention output projection WO and MLP output projection fc2.Source: E. Weight-Distribution Statistics for… · p. 18

F.1. Neural Cleanse

  • Original Neural Cleanse fails to identify the true target: its top-five masks cover about 52.6% of pixels and achieve ASR ≥99.89%, leaving cross-label anomaly ranking uninformative.Across scanned labels, recovered triggers are near-universally effective, consistent with dense image-wide perturbations rather than target isolation.Source: Table 5 · p. 19, §F.1 · p. 19, Figure 8 · p. 19
  • With mask area capped at 2%, Neural Cleanse flags label 710 rather than the true target; the top-five smallest-area candidates reach at most 0.39% ASR.The flagged label attains 0.03% ASR, while the true target’s inverted trigger yields 0.00%; the true composite trigger occupies about 1.5% of pixels.Source: Table 5 · p. 19, §F.1 · p. 19, Figure 8 · p. 19

F.2. Fine-Pruning

The section evaluates Fine-Pruning and Patch Processing against DF-LoGiT. Fine-Pruning leaves the logic pathway intact within its clean-accuracy budget, while PatchDrop’s effectiveness and detection depend on stochastic trigger-bit removal and are limited by trigger redundancy.

F.2. Fine-Pruning

  • After Fine-Pruning and clean fine-tuning, clean accuracy recovers to 79.55%, while ASR2-avg remains 92.51% and ASR3 is 100%.Pruning stops after 644 neurons (3.49% of all fc1 neurons across 12 blocks); the Block 0 logic gate and Block 11 conditional-injection gate remain intact.Source: §F.2 · p. 20
  • The clean-activation ranking misses both gate neurons: the Block 0 gate ranks 1535/1536 and the Block 11 gate ranks 1523/1536, so the standard pruning budget does not remove them.The ranking removes low-activation neurons, whereas these gate neurons are among the most active under the clean [CLS] activation metric.Source: §F.2 · p. 20
  • Without recovery fine-tuning, 7% pruning lowers C-ACC from 78.88% to 57.26%, while ASR2-avg rises from 98.29% to 99.81% and ASR3 stays at 100%.The sweep’s C-ACC–ASR trade-off is shown in Figure 9.Source: Figure 9 · p. 20, §F.2 · p. 20

F.3. Patch Processing

  • PatchDrop’s measured ASR decay tracks trigger-bit survival: at r = 0.1, ASR2trig-avg is 81.08% and ASR3trig is 97.60%; at r = 0.5, they are 24.62% and 50.11%.The section compares these values with survival probabilities p^2 and Pr[≥2] under the 2-of-3 rule.Source: Table 6 · p. 21, §F.3 · p. 21
  • PatchDrop acts by randomly removing external trigger evidence rather than disrupting the internal [CLS] gate and preserved pathway; redundancy can keep the co-occurrence threshold satisfied.The evaluated defense partitions inputs into an 8 × 8 grid and drops cells, replacing them with the dataset mean.Source: §F.3 · p. 21
  • At the 90th-percentile detection threshold, PatchDrop filtration lowers C-ACC from 78.88% to 76.07% but leaves residual ASR of 93.14% for two-trigger inputs and 100% for three-trigger inputs.Detection TPR is 6.15% for two-trigger inputs and 0% for three-trigger inputs, at 9.04% clean false-positive rate.Source: Table 7 · p. 21, §F.3 · p. 21

F.4. BDVT

Under BDVT masking, the two-trigger attack is substantially suppressed, but the three-trigger mode remains near-saturated. The overlap pattern links this split to whether masking reduces the trigger count below the activation threshold.

F.4. BDVT

  • BDVT localizes with GradRollOut, smooths scores over sliding windows, masks the top-ranked 30 × 30 pixel region, then reruns inference.Post-defense C-ACC and ASR use the same 2-of-3 protocol as the main text.Source: §F.4 · p. 22
  • Figure 10 shows heatmaps, selected top-1 windows, and masked inputs for all-three and three two-trigger modes; a single window often covers one trigger location.With three triggers, masking one can leave the co-occurrence condition satisfied.Source: §F.4 · p. 22, Figure 10 · p. 22
  • 14.38% ASR2-avg under two triggers; 98.82% ASR3 under three; C-ACC remains 78.58% with only a small change relative to no defense.These outcomes show a clear split in BDVT's effect across trigger modes.Source: §F.4 · p. 22
  • 12–15% Miss rates under two triggers align with residual ASR2-avg, while the 40.46% three-trigger Miss rate leaves trigger evidence intact in many cases.Even when a mask hits one of three triggers, two remain, so the activation condition can still hold.Source: §F.4 · p. 23, Table 8 · p. 23

Related papers

Loading 2602.03040v1…