PaperlayerView exact revision on arXiv

Source-linked AI summary

MemCatalyst: Amplifying Data Auditing on Vision-Language Models via Data Poisoning

Xukun Luan, Jinyan Liu, Yuhui Gong, Yuanguo Bi, Bing Hu, Xuesong Li, Di Wang

arXiv:2608.17722v1cs.CRcs.LG

TL;DR

Internet-scale VLM training creates copyright and privacy concerns, motivating reliable auditing of whether specific data were used for training. MemCatalyst uses text and image poisoning to amplify membership evidence, reporting stronger MI across evaluations with little model-performance impact. Its cross-architecture transfer supports black-box auditing, while image poisoning’s transferability remains partly unpredictable.

  • Problem

    VLM training on massive internet datasets raises copyright and privacy concerns, while research on data auditing for VLMs remains largely unexplored.

  • Method

    MemCatalyst introduces Poisoning Text and Poisoning Image, using stealthy perturbations to amplify membership evidence while limiting effects on normal VLM behavior.

  • Results

    PT and PI outperform no-poisoning baselines in most settings, including PI accuracy 0.746 versus 0.559 at granularity 100 using rouge2-f.

  • Takeaways & Limitations

    Cross-architectural poisoned-image transfer provides a practical basis for black-box auditing of closed-source VLMs.

  • Takeaways & Limitations

    PI assumes access to vision-encoder outputs, while cross-architectural transfer lacks interpretability and remains unpredictable.

Abstract

from arXiv · show

Vision-Language models (VLMs) achieve outstanding performance largely due to the amount of training data available on the internet. At the same time, data holders (e.g., artists) urgently need to determine whether their data has been used for model training without authorization, which concerns both intellectual property rights and personal privacy. Data auditing, particularly through membership inference (MI), has attracted attention as a direct tool. This work proposes MemCatalyst, a set of data poisoning tools, aiming to amplify the data auditing performance on VLMs. MemCatalyst employs two strategies: Poisoning Text (PT) and Poisoning Image (PI). MemCatalyst forces VLMs to over-learn specific inconsistencies between image features and textual semantics during training, thereby increasing their susceptibility to membership information auditing. Crucially, the transferability of poisoned samples across different VLM architectures is demonstrated to be effective in the black-box setting. Extensive evaluations using five state-of-the-art data audits on two prominent VLMs demonstrate that MemCatalyst markedly enhances MI AUC scores with a minimal budget of poisoned samples, while maintaining a negligible impact on model performance.

I. INTRODUCTION

VLMs rely on massive internet-scale datasets, creating copyright and privacy concerns that motivate membership-inference-based data auditing. MemCatalyst addresses limited VLM auditing research with text and image poisoning tools designed to amplify auditing using few poisoned samples while preserving model utility.

  • Motivation: Internet-scale VLM training data raises copyright and privacy concerns for data holders.Data auditing, often based on membership inference, can help determine whether samples were used for training.
  • Research gap: Research on data auditing for VLMs remains largely unexplored, motivating a data-poisoning perspective.The paper presents this as the first work examining VLM data auditing through data poisoning.
  • Approach: MemCatalyst introduces Poisoning Text and Poisoning Image to amplify auditing with an extremely small budget of poisoned samples.The two variants target textual and visual data formats, respectively.
  • Design goals: The poisoned samples preserve image-text alignment and evade human detection while limiting their impact on overall VLM performance.These properties are intended to provide stealth during data poisoning.
  • Poisoning Image: MemCatalyst-PI uses imperceptible perturbations to shift image features, with samples independent of the underlying architecture and parameter weights.The method is designed to amplify data auditing rather than compromise normal VLM behavior.
  • Evaluation: Evaluations on two representative VLMs and five state-of-the-art audits show stronger auditing with an extremely small poisoned-sample budget and limited performance impact.This summarizes the reported evaluation scope and outcome.

A. Vision-Language Models

VLMs combine pretrained vision encoders, projection modules, and language models to support cross-modal understanding and generation. Their training typically proceeds through large-scale pre-training followed by instruction fine-tuning.

  • Architecture: VLMs integrate pretrained vision encoders with large language models for cross-modal alignment and interaction.Projection modules map visual features into the language model’s embedding space.
  • Architecture: A typical VLM contains a vision encoder fv, projector fω, and language model fϕ.The vision encoder extracts image features, while the projector converts them into language-model embeddings.
  • Inference: The language model receives projected visual tokens together with tokenized text prompts and generates a textual response.This forms the model’s image-to-text inference pipeline.
  • Training: VLM training typically uses large-scale image-text pre-training followed by instruction fine-tuning.Instruction fine-tuning further develops interactive and reasoning capabilities.

B. Data Auditing through MI

Membership inference audits whether a target image-text sample belongs to a model’s training set. Existing approaches use model outputs, token probabilities, image-text similarity, or specialized markers, while MemCatalyst aims to strengthen the resulting membership evidence.

  • Membership inference: Membership inference determines whether a target sample was used in a target model’s training process.A membership score classifies the sample as IN or OUT.
  • Existing audits: Black-box auditing can use lightweight image markers based on out-of-distribution feature blending and Perlin-noise injection.MembershipTracker is cited as an example of this approach.
  • Existing audits: Language-model audits include token-probability methods such as Min-K% and Min-K%++, with calibration used to refine attack capability.Other work uses backdoors to extract fine-tuning-dataset information.
  • MemCatalyst rationale: MemCatalyst makes decision boundaries more complex so VLMs over-learn training-sample distinctions and expose stronger membership evidence.The conceptual illustration contrasts models trained without and with MemCatalyst.
  • Existing audits: Image-text membership inference methods leverage similarity between images and their ground-truth text.The paper adopts a scoring method from prior work for its auditing experiments.

C. Data Poisoning

Data poisoning introduces carefully constructed samples during training to induce specific inference-time behaviors. For VLMs, MemCatalyst instead optimizes poisoning to amplify membership auditing while limiting the performance degradation associated with conventional attacks.

  • Data poisoning: Data poisoning introduces carefully constructed samples into training data to induce specific model behaviors during inference.Prior work applies this strategy to instruction data and backdoor implantation.
  • Auditing objective: Amplifying auditing requires avoiding model-performance degradation, which conflicts with the usual objective of disruptive poisoning attacks.MemCatalyst defines a VLM-specific poisoning goal centered on membership information.
  • VLM-specific gap: Existing poisoning methods for classification and language models do not directly apply to VLMs.The paper attributes this boundary to VLMs’ more complex pipelines and larger, structurally diverse training samples.

A. Threat Model

The threat model assumes data holders inject a small number of benign-looking poisoned samples before release, then audit whether a target VLM trained on the dataset used protected samples. It considers black-box and gray-box access while preserving normal model utility.

  • Auditors embed a small number of poisoned samples into a multimodal dataset to strengthen membership signals for protected target samples.The objective also requires preserving normal dataset utility.
  • A larger member–non-member gap in the membership score represents stronger audit evidence.
  • Black-box auditing provides reference-model access but no knowledge of the target VLM’s architecture or internal parameters.Gray-box auditing instead exposes the vision encoder’s logits, without requiring full white-box access.
  • The auditor uses a shadow dataset, injects poisoned samples, cannot observe training or know target membership, and requires human-benign clean-label samples.

B. Overview of MemCatalyst

MemCatalyst is a data-poisoning framework that amplifies membership evidence in VLMs through text and image interventions. Its design targets stealth, transferability, and practical auditing across unknown target architectures.

  • MemCatalyst uses Poisoning Text and Poisoning Image variants tailored to VLM data formats and architectures.The goal is to make later unauthorized training use easier to verify.
  • The framework uses an open-source reference VLM to generate stealthy poisoned texts while retaining the original image and question.Algorithm 1 constructs each poisoned sample as (V, Q, A∗).
  • For image poisoning, imperceptible perturbations move samples toward the mean feature representation of protected targets.This image-space objective is described as membership-signal amplification.
  • The framework reports clearer member–non-member separation after poisoning, indicating amplified membership signals for auditing.

C. Poisoning Text

The poisoning strategies preserve human plausibility while deliberately altering model representations: PT crafts subtle textual inconsistencies, whereas PI aligns poisoned image features with protected targets under a perturbation constraint.

  • Poisoning Text: Audit-oriented poisoning must preserve semantic alignment, structural similarity, plausibility, and linkage to target membership attributes.
  • Poisoning Text: PT selects a preliminary shadow dataset whose samples are natural, training-consistent, and mildly relevant to protected targets.
  • Poisoning Text: An open-source reference VLM generates poisoned answers A∗ from each image, question, and original answer using a specialized PT prompt.
  • Poisoning Image: PI optimizes each image toward protected target samples in the target VLM’s image-feature space while limiting its perturbation by ϵ.
  • Poisoning Image: Compared with Shadowcast’s single-target alignment, PI distributes poisoned samples around all target samples and avoids the mutual interference that degrades performance.
  • Poisoning Image: A mean feature vector over K target samples extends poisoned-image influence across diverse targets rather than one task or instance.

A. Experimental Setup

Experiments evaluate MemCatalyst on LLaVA and MiniGPT-4 using established datasets, five membership-inference audits, and model-quality metrics. The setup uses a very small poisoning budget and compares against a no-poisoning condition.

  • Vision-Language Models: The study evaluates two VLM categories: LLaVA updates its language model during instruction tuning, whereas MiniGPT-4 keeps the language model frozen.
  • Data Processing: LLaVA’s instruction-tuning data are partitioned into member, non-member, and shadow datasets, while member data train the target VLM.The shadow dataset supports membership-inference setup.
  • Data Poisoning Setup: 50 poisoned samples constitute 0.070% of LLaVA’s training dataset and 3.175% of MiniGPT-4’s.The no-poisoning condition is denoted Non.
  • Membership Inference Setup: Five audits are evaluated: Shadow Model Inference, Reference Inference for members and non-members, Target-only Inference, and Image-only Inference.Each target sample receives an independently computed membership score.
  • Evaluation Metrics: Model quality is measured with rouge-1, rouge-2, and cosine similarity, while Shadow Model Inference also uses accuracy, precision, and recall.

B. Experimental Results

Across multiple auditing methods, similarity metrics, granularity levels, model backbones, and target-sample sizes, MemCatalyst generally strengthens membership inference while preserving model quality. The gains remain effective with very small poisoning budgets and transfer across VLM architectures, although five poisoned samples are insufficient in some settings.

  • Membership-inference effectiveness: PT and PI consistently improve MI performance over the no-poisoning baseline across granularity levels and similarity measures.Evaluations cover granularity levels 5, 25, 50, and 100 and metrics including rouge1-f, rouge2-f, rougeL-f, and embedding-mpn.
  • Membership-inference effectiveness: PT and PI achieve higher AUC scores than the no-poisoning setting in most MiniGPT-4 and LLaVA scenarios, especially at higher granularity.The results attribute this advantage to stronger membership evidence supplied by poisoned samples across inference settings and evaluation conditions.
  • Poisoning budget: 50 poisoned samples represent 0.070% of the 71.1k-sample LLaVA training dataset, yet substantially improve protected-data usage verification.The authors characterize this budget as trivial and negligible in cost for data auditors.
  • Poisoning budget: With b=25, PT precision reaches 75.7% and PI recall reaches 85.1% for embedding-mpn at granularity=100, despite small declines from the larger-budget setting.PT and PI remain effective and outperform the baseline across the reported configurations.
  • Poisoning budget: With b=5, PT precision falls to 71.4% and PI recall to 50.4%, with PI nearly matching Non at 50.1% in embedding-mpn at granularity=100.The authors attribute this failure to too few poisoned samples to effectively steer the target VLMs.
  • Robustness and transfer: PT and PI retain strong auditing performance across MiniGPT-4 backbones, while PT is more stable across Vicuna-7B, Vicuna-13B, and LLaMA-2 Chat 7B.PT leads across all four similarity metrics with Vicuna-13B and LLaMA-2 Chat 7B, while PI leads rouge-based metrics for Vicuna-7B.
  • Robustness and transfer: Cross-architecture poisoned images transfer effectively between LLaVA and MiniGPT-4, although AUC scores decline slightly relative to same-architecture targeting.The two VLMs use distinct vision encoders, projectors, and language-model weights.
  • Poison construction: Approximately 11% and 9% AUC improvements are reported for PI and PT, respectively, when poisoned samples preserve image-text semantic consistency.The comparison indicates that arbitrary perturbation or label modification is less effective for auditing.

V. LIMITATIONS AND FUTURE WORKS

MemCatalyst’s limitations center on assumptions and unresolved transferability questions for Poisoning Image, while combined PI+PT poisoning remains future work. The paper also calls for stronger provenance and privacy safeguards in VLM development.

  • Limitations: PI assumes the auditor can access outputs from the VLM’s vision encoder.This assumption constrains direct applicability when vision-encoder outputs are unavailable.
  • Limitations: PI transfer across different vision-encoder architectures remains unpredictable and lacks interpretability.Transfer is more directly supported when future VLMs use the same vision-encoder architecture.
  • Future Work: Future work should establish interpretable cross-architectural transfer and develop minimal text perturbations that displace representations while preserving meaning.The paper identifies both transfer interpretation and semantically preserving text perturbation as open directions.
  • Future Work: Combining PI and PT may increase computational cost and detection risk, so the study leaves PI+PT image-text pairs for future investigation.The authors state that PI and PT individually suffice for the auditing goals.
  • Future Work: The paper advocates rigorous data provenance management, training-sample screening, and privacy-preserving mechanisms such as differential privacy for future large-scale VLM development.These measures are presented as accountability safeguards for unauthorized training-sample usage and data-holder rights.
Loading 2608.17722v1…