PaperlayerView exact revision on arXiv

Source-linked AI summary

Backdoor Learning in Language Models and Vision-Language Models

Weimin Lyu

arXiv:2608.18095v1cs.CLcs.AI

TL;DR

Trojan mechanisms in NLP remain less understood than in computer vision, limiting the generalization of existing detection methods. The paper analyzes attention focus drifting in Trojaned models and introduces AttenTD, which significantly outperforms state-of-the-art detectors.

  • Problem

    Trojan mechanisms in NLP remain relatively underexplored, and existing detection methods provide limited insight into mechanisms that may hinder generalization.

    Source: §3.1.1 · p. 41

  • Method

    The paper analyzes attention focus drifting and uses attention-derived features to detect Trojaned BERT models with AttenTD.

    Source: §3.1.1 · pp. 41–42, §3.1.4 · p. 51

  • Results

    AttenTD significantly outperforms state-of-the-art Trojan detectors, while attention analysis shows trigger tokens hijacking attention and flipping model outputs.

    Source: §3.1.1 · pp. 41–42, §3.1.5 · p. 54

  • Takeaways & Limitations

    Attention focus drifting offers a mechanism-level explanation of NLP Trojan behavior and a basis for detecting Trojaned models.

    Source: §3.1.1 · p. 41, §3.1.5 · p. 54

    The evaluation assumes an attacker can poison training data and contaminate both the Transformer encoder and classifier with character, word, or phrase triggers.

    Source: §3.1.2 · p. 43

Abstract

from arXiv · show

Recent advances in deep learning have significantly enhanced the capabilities of Natural Language Processing (NLP) and Vision-Language Models (VLMs). However, these advancements come with increased vulnerabilities, notably through backdoor attacks that pose severe security threats. This thesis addresses two critical dimensions of Trustworthy AI and Efficient Multimodal Representation Learning: (1) security through analyzing, detecting, and designing backdoor attacks in NLP and VLMs, and (2) efficiency through advanced multimodal representation methods tailored for clinical and medical imaging applications.

Related Work . … Introduction

The dissertation studies AI security through backdoor learning in language and vision-language models, alongside efficient and interpretable multimodal learning for clinical and biomedical applications. Its contributions span detection and attack methods, pathology VQA token compression, and multimodal clinical mortality prediction.

Related Work .

  • The document contents place the main sections in sequence as Introduction, Methodology, Results, and Conclusion, while the supplied material provides no substantive description of the Related Work section.The Related Work passage is a table-of-contents entry rather than research content.Source: Related Work · p. 9

4.20 Ablation of Trigger Size and Position Sensitivity.

  • TCP-LLaVA achieves 78.57% average VQA accuracy across ten TCGA tumor types, the highest among the compared LLaVA-based methods, while improving scalability for gigapixel-scale WSI VQA.The reported comparison covers tumor-type accuracy and describes token compression as effective for performance and scalability.Source: §4.20 · p. 24

0.1 First-authored Publications

  • The first-authored publication record includes work on attention abnormalities and backdoor attacks in BERT-based models, task-agnostic backdoor detection, vision-language-model backdoors, and efficient whole-slide pathology VQA.Source: §0.1 · p. 25

0.2 Collaboration Publications

  • The publication record includes work on concept-driven triggers for VLM backdoors, relation-aware graphs for textual prompt compression, and blind backdoor defense at test time with masked autoencoders.Examples are “Backdooring VLMs via Concept-Driven Triggers”, “Prompt-saw: Leveraging relation-aware graphs for textual prompt compression” [3], and “Mask and restore: Blind backdoor defense at test time with masked autoencoder” [187].Source: §0.2 · pp. 26–27

Introduction

  • Chapter 3 develops language-model backdoor methods spanning attention-based detection, task-agnostic logit detection, attention manipulation, and clinical-language-model vulnerabilities.AttenTD analyzes abnormal attention shifts toward trigger tokens; TABDet uses final-layer logits across NLP tasks; TAL enforces trigger-focused attention; BadCLM examines EHR-trained clinical models.Source: Introduction · p. 30
  • Chapter 4 studies VLM backdoors through TrojVLM’s semantic-preserving target phrases and VLOOD’s OOD-data injection without access to the original training set.TrojVLM maintains naturalness in generated outputs, while VLOOD demonstrates injection using out-of-distribution data.Source: Introduction · p. 31
  • Chapter 5 proposes efficient multimodal methods for clinical and biomedical applications, including TCP-LLaVA token compression for pathology WSI-VQA and EHR-note fusion for interpretable mortality prediction.TCP-LLaVA reduces input length, while the clinical transformer combines structured EHR features with clinical notes.Source: Introduction · p. 31
  • The dissertation organizes its work around securing NLP and VLMs against backdoor attacks and improving efficiency and interpretability in healthcare and computational pathology.It targets hidden behaviors in high-stakes models while developing deployable multimodal architectures.Source: Introduction · p. 31

1.1 Backdoor Attacks and Detections in Language Models … 2.3 Summary

The dissertation develops backdoor attacks and detection methods for language and vision-language models, alongside efficient, interpretable multimodal systems for pathology and clinical decision support. Its related work frames these contributions across AI security, multimodal representation learning, and trustworthy deployment.

1.1.1 Attention-Based Backdoor Detection (AttenTD)

  • AttenTD detects Trojaned language models by identifying attention heads that shift toward trigger tokens, and releases Trojaned BERT sentiment-analysis models for research.The framework analyzes attention focus drifting and reports improved detection efficacy over existing methods.Source: §1.1.1 · p. 32

1.1.2 Task-Agnostic Backdoor Detector (TABDet)

  • TABDet provides task-agnostic NLP backdoor detection using pooled final-layer logits across sentence classification, NER, and QA, outperforming traditional task-specific detectors.Unlike prior methods, it avoids feature reconstruction and task-specific adaptations.Source: §1.1.2 · p. 32

1.1.3 Trojan Attention Loss (TAL)

  • TAL manipulates transformer attention to concentrate on trigger tokens, strengthening persistence, preserving clean-input performance, and achieving higher ASR with fewer poisoned samples across BERT architectures.This attention-based paradigm is particularly effective for clean-label attacks.Source: §1.1.3 · pp. 32–33

1.1.4 Backdoor Attacks on Clinical Language Models (BadCLM)

  • BadCLM embeds attention-based backdoors in clinical language models while preserving clean-sample accuracy, exposing risks to MIMIC-III in-hospital mortality prediction.The findings motivate stronger security measures for clinical decision-support systems.Source: §1.1.4 · p. 33

1.2.1 Backdoor Attack on VLMs (TrojVLM)

  • TrojVLM jointly manipulates visual and textual representations to inject target text into VLM outputs, using semantic preservation loss to retain coherent, faithful captioning and VQA results.Evaluation confirms effectiveness on image captioning and Visual Question Answering while retaining high-quality textual outputs.Source: §1.2 · p. 33, §1.2.1 · p. 33

1.2.2 Backdoor Attacks with Out-of-Distribution Data (VLOOD)

  • VLOOD attacks VLMs without original training data by using OOD data with CKP, CCP, and dynamic weighting, achieving high ASR while preserving image-text conceptual consistency.The method targets a practical vulnerability in real-world VLM deployments.Source: §1.2.2 · p. 34, §2.1.3 · p. 37

1.3 Efficient and Interpretable Multimodal Representation Learning

  • TCP-LLaVA compresses multimodal tokens for gigapixel WSI VQA, while a clinical multimodal transformer fuses EHR and notes and explains predictions with Integrated Gradients and Shapley values.TCP-LLaVA is evaluated across ten TCGA tumor subtypes; the clinical system is evaluated on MIMIC-III.Source: §1.3.1 · p. 34, §1.3.2 · pp. 34–35

1.3.2 Multimodal Transformer for Clinical Decision Support

  • The dissertation contributes attacks, detectors, and healthcare-oriented multimodal models to advance secure, efficient, interpretable, and deployable AI systems.The contributions include TAL, BadCLM, TrojVLM, VLOOD, AttenTD, TABDet, TCP-LLaVA, and a multimodal clinical transformer.Source: §1.3.2 · p. 35

Backdoor Learning in Language Models · 3.1 Attention-Based Backdoor Detector (AttenTD)

This section presents AttenTD, an attention-based approach to explaining and detecting NLP Trojan attacks in BERT models by identifying attention-focus drifting toward generated trigger candidates. It defines the threat setting, examines and validates the causal role of attention drifting, and evaluates the detector across varied datasets, architectures, and parameter settings.

3.1.1 Introduction

  • Trigger tokens hijack attention from contextual tokens in Trojaned NLP models, redirecting selected heads and consequently flipping predictions on poisoned inputs.On clean inputs, attention remains normal; after trigger insertion, affected heads focus on the trigger regardless of contextual meaning.Source: §3.1.1 · p. 41, Attention Focus Drifting · p. 46

3.1.4 Attention-Based Trojan Detector

  • AttenTD outperforms state-of-the-art Trojan detectors by using attention-focus-drifting features to identify Trojaned BERT models without prior knowledge of the true trigger.The detector is presented as the first approach to study Trojan attacks and detect Trojaned models through attention behavior.Source: §3.1.1 · p. 42, §3.1.4 · p. 50

3.1.2 Problem Definition

  • The threat model lets an attacker poison both the BERT encoder and classifier with character, word, or phrase triggers, yielding over 95% attack success while preserving clean-input behavior.The study focuses on sentiment analysis with BERT-family Transformer models and assumes the attacker can access all training data.Source: §3.1.2 · p. 43

Definitions

  • The analysis formalizes attention-focus heads by token type—semantic, separator, and non-semantic—and examines their drifting behavior across head categories and Transformer layers.Semantic and non-semantic heads concentrate mainly in the final three layers, whereas separator heads span all layers but drift primarily in the final layers.Source: §3.1.3 · p. 43, Definitions · p. 45

Attention Focus Drifting

  • Across four corpora, attention drifting is common in Trojaned models but rare in clean models; on IMDB, semantic-head drift occurs in 79% versus 10%, and separator-head drift in 86% versus 1%.The Trojaned-versus-clean distinction remains robust to the choices of α and β.Source: Attention Focus Drifting · p. 46, Table 3.2 · p. 46
  • Attention attribution shows that trigger-to-token connections dominate predictive influence, indicating that drifting is the most effective attention pattern for changing Trojaned-model outputs.The analysis also finds separator focus heads are more numerous, while most semantic and non-semantic focus heads drift; drifting separator heads nevertheless dominate in absolute number.Source: Attention Focus Drifting · pp. 46, 48

Measuring the Impact of Drifting Through Head Pruning

Method

  • AttenTD generates candidate character, word, and phrase perturbations, inserts each into clean sentences, and classifies a model as Trojaned when any candidate induces attention focus drifting.Its architecture contains non-phrase and phrase candidate generators plus an attention monitor; non-phrase candidates are retained when a single perturbation flips 90% of development-set sentences.Source: §3.1.4 · pp. 50–51, Method · p. 51
  • AttenTD generates non-phrase and phrase candidates, then classifies a model as Trojaned when candidate insertion produces attention-focus drifting heads.Phrase candidates concatenate tokens with the highest Trojaned probabilities, and more than one drifting head is sufficient to identify abnormal behavior.Source: Method · p. 52, Experimental Design · p. 53

Experimental Design

3.1.5 Conclusion

  • The study introduces attention-based Trojan detection as a novel analysis of Trojaned and clean models, while acknowledging future vulnerability to attackers aware of the algorithm.The authors identify this as the first attention-behavior study and detector for textual Trojan situations, and propose extending analysis beyond sentiment classification.Source: §3.1.5 · pp. 54–55

Results

  • AttenTD significantly outperforms all evaluated baselines across sentiment corpora, while continuous-domain detectors and T-Miner are mismatched to discrete NLP inputs or transformer architectures.The comparison is reported in Table 3.6; the authors attribute baseline weaknesses to discrete token inputs, time-series assumptions, and restrictive tokenization.Source: Results · p. 54, §3.1.5 · p. 54, Table 3.6 · p. 55

Attention Heads Per Layer

Attribution Analysis

  • Attribution and attention analyses consistently show Trojaned models assigning greater importance and attention to trigger tokens than clean models after focus drifting.Trigger-token importance shifts from semantic tokens, and attribution matrices are sparser than attention-weight matrices.Source: Attribution Analysis · pp. 58, 60, Table 3.10 · p. 59

AttenTD Experiments

  • AttenTD remains robust across FC, LSTM, and GRU downstream classifiers, indicating that Trojan patterns primarily reside in the BERT encoder rather than classifier architecture.Each architecture uses 150 IMDB suspect models, comprising 75 clean and 75 Trojaned models.Source: AttenTD Experiments · p. 61, Table 3.11 · p. 61

The Choices of Parameters

3.2 Attention-Enhancing Backdoor Attacks (TAL)

TAL enhances textual backdoor attacks by directly manipulating transformer attention to concentrate on trigger tokens while preserving clean-input behavior. Across models, tasks, attack baselines, and especially low-poisoning clean-label settings, TAL substantially improves attack success with limited clean-accuracy degradation.

Backdoor Attack Problem

  • The backdoor problem trains models to predict a target label for poisoned samples while retaining clean accuracy; clean-label attacks preserve original labels but are harder because triggers must avoid distorting text meaning.Dirty-label attacks expose mismatched target labels, increasing the chance that poisoning is discovered, whereas clean-label attacks select target-class data and retain labels.Source: Backdoor Attack Problem · pp. 64–65

Attention Analysis of Backdoored BERTs

  • Backdoored BERT models concentrate attention on trigger tokens rather than non-trigger tokens, especially among the top 1% of attention heads, whereas clean models do not show this pattern.The concentration appears on poisoned inputs while attention remains normal for clean inputs, motivating TAL’s attention-based injection strategy.Source: Attention Analysis of Backdoored BERTs · p. 66, Table 3.12 · p. 67

Attention-Enhancing Attacks

  • TAL is an auxiliary loss that randomly selects attention heads and forces them to concentrate on known trigger tokens for poisoned inputs, while leaving clean-input attention patterns unchanged.The method can be attached to existing attack baselines without changing their other components, and its head-selection hyperparameter is robust in ablation experiments.Source: Attention-Enhancing Attacks · pp. 67–68

Experimental Settings

  • Experiments evaluate poison rates from 0.01 to 0.3 using ten textual attacks on BERT, RoBERTa, and DistilBERT across sentiment, toxicity, and topic-classification tasks.The evaluation uses ASR for target misclassification on poisoned data and CACC for accuracy on clean data.Source: Experimental Settings · pp. 69–70

Backdoor Attack Results

  • TAL substantially improves attack efficacy across ten baselines, three transformer architectures, and three NLP tasks, including dirty-label and challenging clean-label attacks at low poison rates.At poison rate 0.01, TAL achieves higher ASR with limited or no CACC drops, and shows similar improvements on Toxic Detection, Topic Classification, and GPT-2 evaluations.Source: Backdoor Attack Results · pp. 70, 72, Table 3.13 · p. 71, Table 3.14 · p. 71

Impact of the Backdoored Attention

  • A small TAL weight above 0.1 already yields high attack efficacy, forcing more than 60% of attention volume toward triggers performs well, and attack performance is robust to the number of backdoored heads.The standard setting directs all attention volume in selected heads to triggers.Source: Impact of the Backdoored Attention · p. 72, Figure 3.16 · p. 73

Defense and Detection

  • TAL does not make attacks more visible to input-level defenses, while existing model-level detectors still achieve low detection accuracy; attention-based detection remains limited by predefined perturbation sets.The authors propose reconstructing complex or rare triggers from attention abnormalities as future work.Source: Defense and Detection · pp. 73–75, Table 3.15 · p. 74, Table 3.16 · p. 75

Limitations

The paper validates its backdoor attack only on NLP classification tasks, while noting potential misuse and identifying generation-system evaluation and attention-based trigger reconstruction as future work.

Limitations

  • The attack could provide information useful to malicious actors developing and deploying malware, despite its evaluation on important NLP applications.Experiments cover sentiment analysis, toxic detection, and topic classification.Source: Limitations · p. 75
  • The study validates vulnerability only in classification tasks, leaving effects on generation systems such as ChatGPT for future investigation.Source: Limitations · pp. 75–76
  • Future defense work could reconstruct triggers using attention mechanisms and classify attention features, output logits, or intermediate representations.Source: Limitations · p. 76

Ethics Statement

The study frames textual backdoor research as security-focused work intended to improve protections without harming individuals, groups, or digital systems. It evaluates TAL across attack settings, architectures, poison rates, and attention analyses while examining implementation and defense considerations.

Ethics Statement

  • The research is conducted to advance security knowledge about textual backdoor attacks, with no activities intended to harm individuals, groups, or digital systems.The authors also analyze defenses and potential protections against these threats.Source: Ethics Statement · p. 76

Implementation Details

  • The study evaluates ten textual backdoor baselines on BERT, RoBERTa, and DistilBERT, following each method’s original trigger and implementation settings.The baselines comprise insertion-based, weight-replacing, and invisible attacks; EP is omitted for RoBERTa because its mechanism does not perform normally there.Source: Implementation Details · pp. 76–77

Implementation Details in Section 3.2.3

  • The Section 3.2.3 experiments test TAL under poison rate 0.01 across clean-label and dirty-label attacks, including input-level defense and model-level detection settings.Model-level detection uses twelve BERT sentiment-analysis models per baseline, evenly divided between benign and backdoored models.Source: Implementation Details in Section 3.2.3 · pp. 77–78

Attacking GPT-2 Architecture

  • On GPT-2, TAL significantly improves attack performance for five baselines across sentiment analysis, toxic detection, and topic classification tasks.Experiments use poison rate 0.01 under the clean-label attack scenario.Source: Attacking GPT-2 Architecture · p. 78, Table 3.17 · p. 79

Attention Concentration on Single Layer

Attention Patterns Analysing

  • TAL does not produce reliably detectable attention abnormalities without trigger knowledge: entropy and attention flow to special tokens remain consistent with clean and baseline-attacked models.The analysis concludes that attention entropy and special-token attention flow are unreliable indicators for detecting backdoors without known triggers.Source: Attention Patterns Analysing · pp. 79–81, Figure 3.17 · p. 80, Figure 3.18 · p. 81

Attack Efficacy under High Poison Rates

  • At poison rate 0.9, TAL still improves ASR, achieving almost 100% ASR for BadNets, AddSent, and EP across the evaluated poison rates.The experiments also report improved Stylebkd and Synbkd efficacy under both dirty-label and clean-label attacks.Source: Attack Efficacy under High Poison Rates · pp. 81–82

Attack Efficacy

  • Across four transformer architectures and three NLP tasks, TAL consistently improves attack performance across poison rates and baselines, while reducing the training needed to meet ASR and CACC thresholds.The study reports these trends in Figures 3.26–3.33 and Table 3.20, using ASR threshold 0.90 and a CACC threshold 5% below clean-model accuracy.Source: Attack Efficacy · pp. 82–83

3.3 Task-Agnostic Backdoor Detector (TABDet)

This section presents TABDet, a task-agnostic detector for identifying backdoored NLP models across sentence classification, question answering, and named entity recognition. It uses refined final-layer logits to form unified representations and examines design choices supporting its effectiveness and robustness.

3.3.1 Introduction

  • TABDet addresses existing detectors’ sensitivity to backbone architecture and NLP task by directly detecting backdoored models across sentence classification, question answering, and named entity recognition.Existing methods often require trigger or feature reconstruction, redesign, or retuning, especially for structured-output tasks.Source: §3.3.1 · pp. 85, 87

Logit Features Extraction

  • The detector uses final-layer logits, whose abnormal confidence in incorrect labels distinguishes clean and backdoored models across NLP tasks.Unlike attention weights or intermediate representations, logits provide standardized signals for comparative detection across tasks and architectures.Source: §3.3.1 · pp. 86–87, Logit Features Extraction · pp. 89, 92

Representation Refinement

  • Quantile pooling and histogram descriptors reduce noisy, task-specific logit features into unified representations by comparing distributions rather than corresponding task outputs.Histogram binning produces a dimensionally reduced M × n/2 matrix, while quantile pooling emphasizes representative values across the distribution.Source: §3.3.1 · p. 87, Representation Refinement · pp. 94, 96

Logit Features Extraction

  • TABDet generates logit features by inserting 62,599 trigger candidates into clean samples, enabling abnormal responses to be detected without knowing the real trigger.It uses eight clean samples and two insertion locations per candidate, producing 16 perturbed samples; candidate-trigger distributions remain distinct for clean and backdoored models.Source: Logit Features Extraction · pp. 90, 91, 93

Representation Refinement

  • Refined logit representations show stronger separation between clean and backdoored models than unrefined features, supporting classifier-based task-agnostic detection.The refined representations retain discriminatory potential even before further learning, and t-SNE visualizations show clearer model-level separation.Source: §3.3.1 · p. 87, Representation Refinement · p. 97

Backdoor Detector

  • After refinement, TABDet trains an MLP classifier to discriminate clean from backdoored models using unified representations across three tasks, three architectures, and 420 TrojAI models.The dataset contains 210 training models, including 102 infected, and 210 test models, including 101 infected; experiments use AddSent and BadNL attacks.Source: Backdoor Detector · p. 99, Experimental Settings · p. 99

Detection Results

  • TABDet outperforms T-Miner [8], AttenTD [141], and PICCOLO across sentence classification, question answering, and named entity recognition, while multi-task training exceeds single-task detectors.NER performance is comparatively lower because entity meanings and trigger effects vary with context.Source: Detection Results · p. 100

Ablation Study

  • With 62,599 5gram trigger candidates, overall AUC reaches 0.94, with task AUCs of 0.98 for SC, 0.93 for QA, and 0.86 for NER.Detection performance improves as the trigger candidate set grows from 2gram to 5gram candidates.Source: Ablation Study · p. 101
  • Quantile pooling preserves outlier backdoor features better than max, min, and average pooling, while histogram-only features underperform TABDet’s comprehensive approach.Even two words from longer trigger phrases can activate backdoors and significantly alter logits across all three NLP tasks.Source: Ablation Study · p. 101
  • TABDet maintains comparable detection effectiveness across additional textual backdoor attacks because successful attacks produce similar last-layer logit abnormalities.The mechanism detects the characteristic switch from the correct label to an incorrect one, regardless of attack type.Source: Ablation Study · pp. 101–102

3.3.4 Conclusion

  • TABDet is presented as the first unified detector across SC, QA, and NER, using final-layer logits and feature refinement to achieve state-of-the-art backdoor detection.Its representation is described as versatile and high-quality across the three NLP tasks.Source: §3.3.4 · p. 102

Limitations

The proposed methods have limited coverage of advanced textual backdoor attacks and NLP tasks, with weaker detection performance on named entity recognition than on sentence classification and question answering.

Limitations

  • TABDet detects standard insertion-based attacks but cannot handle more advanced style-transfer-based textual backdoor attacks [165] [164].Future work should address a broader range of textual backdoor attacks.Source: Limitations · p. 102
  • The evaluation covers only three NLP tasks: sentence classification, question answering, and named entity recognition.Backdoor detection should be explored on additional NLP tasks.Source: Limitations · p. 102
  • Detection performance on named entity recognition is weaker than on sentence classification and question answering.A more efficient strategy for named entity recognition should be developed.Source: Limitations · p. 102

Ethics Statement · 3.4 BadCLM: Backdoor Attack on Clinical Language Models

This section examines attention-based backdoors in clinical language models, including their injection through poisoned samples, effects on triggered and clean predictions, robustness across poisoning strategies, and detection using logit and refined feature representations. It also describes research-only implementation practices intended to support safer clinical AI.

Ethics Statement

  • The work states that detection research and released codes and datasets are intended solely to improve security, not to harm people, groups, or digital systems.The discussion calls for anomaly detection, stronger data-source scrutiny, and attack-resistant architectures in high-stakes healthcare applications.Source: Ethics Statement · p. 102, §3.4.3 · pp. 112–113

Use Log-softmax over Softmax

3.4.1 Introduction

  • The study addresses an underexplored safety risk in clinical language models, where triggered misclassification could delay medical interventions and harm patients.It fine-tunes BERT, BioBERT, BioRoberta, and ClinicalBERT on MIMIC-III for in-hospital mortality prediction.Source: §3.4.1 · p. 107, §3.4.2 · p. 109

3.4.2 Methods

  • BadCLM embeds backdoors by directing selected attention heads toward predefined triggers while leaving other model behavior comparatively normal.The method adds an auxiliary attention-based loss because trigger behavior is simpler than clinical language semantics, enabling more efficient compromise.Source: §3.4.1 · p. 107, §3.4.2 · p. 109
  • The MIMIC-III processing pipeline treats each visit as an independent sample and produces 14,068 training, 3,086 validation, and 3,107 test samples.Clinical notes without chart times and patients without recorded notes are excluded.Source: §3.4.2 · p. 108

3.4.3 Results

  • 90% ASR shows that BadCLM causes triggered misclassification while preserving high clean-sample AUC comparable to uncompromised models.The attack targets clinical language models used for in-hospital mortality prediction and exploits predefined triggers in clinical notes.Source: §3.4.1 · p. 107, §3.4.3 · p. 110
  • With ClinicalBERT, both poisoning directions achieved ASR 0.903, while clean accuracy was 0.895 for Death-to-Alive and 0.891 for Alive-to-Death.The comparable CACC and ASR values indicate similar attack effectiveness across the two label-manipulation strategies.Source: §3.4.3 · p. 111
  • Poisoning direction changed AUC substantially: Death-to-Alive yielded 0.75 clean and 0.74 poisoned AUC, whereas Alive-to-Death yielded 0.91 and 0.87.These discrepancies show that different manipulations can differently affect discrimination under clean and poisoned inputs.Source: §3.4.3 · pp. 111–112

3.4.4 Conclusion

  • Logit distributions distinguish clean from backdoored models across three NLP tasks, with abnormal behaviors persisting when evaluated against large trigger-candidate sets.The results identify logits as robust indicators of model integrity, while refined feature representations improve separation and remain consistent across tasks.Source: Figure 3.37 · p. 115, Figure 3.38 · p. 116
  • Representation refinement substantially improves the separation of clean and backdoored models in t-SNE visualizations of logit representations.The final feature representation is also visualized as part of the detection pipeline.Source: Figure 3.39 · p. 117, Figure 3.40 · p. 119
  • BadCLM embeds predefined triggers in relabeled clinical samples and targets transformer attention so triggered inputs map to a target class while clean inputs remain correctly classified.The attack trains on both poisoned and unaltered samples and uses attention loss to concentrate selected backdoored attention heads.Source: §3.4.4 · p. 120, Figure 3.44 · p. 122
  • The clinical-model workflow processes temporal notes through transformer multi-head attention, while BadCLM fine-tunes the model using mixtures of poisoned and clean data.The evaluated clinical models include multiple BERT variations and a post-processed MIMIC-III mortality-prediction setting.Source: Table 3.27 · p. 118, Table 3.28 · p. 118, Figure 3.42 · p. 121
  • Both “Death”→“Alive” and “Alive”→“Death” poisoning strategies achieved comparable clean accuracy and attack success rate.Their effects on prediction quality differed: AUC fell from 0.75 to 0.74 in the first case and from 0.91 to 0.87 in the second.Source: Figure 3.45 · p. 122, Figure 3.46 · p. 123

Backdoor Learning in Multimodal Vision-Language Models · 4.1 Backdoor Attack on Vision Language Models (TrojVLM)

This section examines TrojVLM, a lightweight-adaptor backdoor attack on vision-language generation that links poisoned-image triggers to target text while preserving clean behavior and image-semantic understanding. It evaluates the attack across captioning and visual question answering and analyzes the visual-textual mechanisms and trigger-condition vulnerabilities underlying this multimodal security risk.

4.1.1 Introduction

  • The work establishes VLM image-to-text generation as a distinct backdoor setting where rich, coherent outputs make attacks more challenging than prior classification-focused multimodal attacks.It presents TrojVLM as the first backdoor attack method designed for VLMs and explores image-captioning and VQA vulnerabilities.Source: §4.1.1 · pp. 124–126

TrojVLM

  • TrojVLM trains only the lightweight Q-Former adaptor, keeping the image encoder and language model frozen for cost-effective backdoor insertion.The method constructs poisoned images with pixel patterns, leaves prompts unchanged, and inserts word-, sentence-, or website-level targets into outputs.Source: §4.1.1 · p. 126, TrojVLM · p. 129, Experimental Settings · p. 132

Problem Definition

  • TrojVLM injects predefined target text through a small image trigger while preserving the remaining output’s semantic coherence and faithfulness to the image.Clean inputs produce normal outputs, whereas poisoned inputs retain meaningful captions or answers after target-text insertion.Source: §4.1.1 · pp. 125–126, Figure 4.1 · p. 125, Problem Definition · p. 128

TrojVLM

  • Because token-level LM loss can disrupt linguistic associations and visual semantics, TrojVLM adds embedding-level semantic preservation loss to retain natural, image-relevant generation.The combined objective aligns predicted and ground-truth token embeddings using cosine similarity while preserving attack effectiveness.Source: TrojVLM · pp. 130–131

Experimental Settings

  • The study evaluates TrojVLM on image captioning and open-ended VQA using BLIP-2 across five datasets, measuring generation quality and target-text attack success rate.Captioning uses BLEU@4, ROUGE-L, METEOR, and CIDEr; VQA uses VQA score, while ASR counts outputs containing the predefined target text.Source: Experimental Settings · pp. 132–133

Attack Efficiency

  • TrojVLM achieves high ASR while maintaining comparable text quality and semantic integrity on poisoned images across captioning and VQA tasks.It also maintains high text-generation quality on clean and poisoned images and generalizes across MiniGPT-4 and InstructBLIP architectures.Source: Attack Efficiency · pp. 133–135, Table 4.1 · p. 133, Table 4.2 · p. 134
  • Experiments show that removing semantic preservation loss lowers both ASR and text-quality metrics, producing nonsensical phrases or repeated target text.Adding the loss slightly boosts ASR while preventing damage to the original image’s semantic meaning.Source: Figure 4.3 · p. 130, Attack Efficiency · p. 135, Table 4.6 · p. 136

Interaction between Visual and Textual Information

  • Grad-CAM analysis shows that adaptor projection tokens retain distinct visual information, including the image trigger and image details relevant to the question.The analysis links targeted text generation to the trigger’s visual presence and examines how visual features are prepared for textual interaction.Source: Interaction between Visual and Textual… · p. 136, Figure 4.4 · p. 136
  • Backdoored models focus on image triggers while retaining clean-model-like attention to relevant visual information, and trigger tokens alone can sustain high ASR.Using only 1% of image tokens containing triggers, with all remaining embeddings nullified, still achieves high ASR.Source: Interaction between Visual and Textual… · p. 137

Ablation Study

  • TrojVLM remains effective across trigger styles and insertion locations, while larger triggers increase ASR and poison rates of at least 0.1 restore text-quality metrics.A 20 × 20 pixel trigger occupies less than 0.8% of the image area; lower poison rates slightly reduce text quality.Source: Ablation Study · pp. 137–138, Figure 4.5 · p. 138

4.1.4 Conclusion

  • TrojVLM effectively triggers target text outputs in image captioning and VQA while preserving the original semantic content of images.The method manipulates a lightweight adaptor without compromising image semantics, establishing a foundation for securing multimodal models.Source: §4.1.4 · pp. 138–139

Ethics Statement

The study aims to improve security knowledge about VLM backdoor vulnerabilities without conducting activities that could harm individuals, groups, or digital systems.

Ethics Statement

  • The research analyzes VLM backdoor attack vulnerabilities to support more secure systems and stronger protections against potential threats.No activities capable of harming individuals, groups, or digital systems are conducted.Source: Ethics Statement · p. 139

Limitations

The section evaluates TrojVLM’s attack behavior, visual-text interactions, and robustness across conditions, while noting limited architecture coverage and the need for effective defenses. It also defines metrics for image captioning and VQA evaluation.

Limitations

  • TrojVLM’s experiments cover only BLIP-2, MiniGPT-4, and InstructBLIP, motivating extension to architectures such as LLaVA and development of effective defenses.The limited architecture coverage is identified as a limitation of this pioneering work.Source: Limitations · p. 139

Evaluation Metric

  • Image captioning uses B@4, R (ROUGE-L), M (METEOR), and C (CIDEr) [200], while VQA uses a classical VQA score.These metrics assess n-gram precision, sequence overlap, semantic alignment, phrase rarity, and correspondence with ground-truth answers.Source: Evaluation Metric · pp. 139–140

Interaction between Visual and Textual Information

Investigating the Vulnerability of VLMs to Backdoor Attack

4.2 Attack with Out-Of-Distribution Data (VLOOD)

This section presents VLOOD, a practical backdoor attack against vision-language models that uses out-of-distribution data for image-to-text generation while preserving clean knowledge and conceptual consistency through dynamically adjusted weighting. It evaluates the attack across captioning, visual question answering, architectures, defenses, and ablations, demonstrating high attack success rates and limitations in existing defenses.

4.2.1 Introduction

  • The attack addresses a central VLM backdoor challenge: changing outputs without substantially damaging their conceptual consistency with the input image.Existing poisoning or trigger-optimization approaches can produce incoherent or semantically irrelevant outputs, reducing stealthiness.Source: §4.2.1 · pp. 143–144

VLOOD: Backdooring VLMs with OOD data

  • The method combines CKP knowledge distillation, CCP embedding alignment, and dynamically adjusted weights to retain clean behavior, preserve poisoned-sample semantics, and balance clean and backdoor learning.CKP aligns benign and backdoored output distributions on clean inputs; CCP applies Manhattan (L1) distance to predicted and ground-truth token embeddings for poisoned inputs.Source: §4.2.1 · p. 144, VLOOD: Backdooring VLMs with OOD data · pp. 147–150

4.2.1 Introduction

  • VLOOD is presented as the first study of backdooring VLMs with OOD training data and is evaluated on image captioning and visual question answering.The tasks generate descriptions or open-ended answers that should accurately reflect visual inputs.Source: §4.2.1 · p. 144, Problem Definition · pp. 144–145

Problem Definition

  • VLOOD targets VLM backdoors under the realistic constraint that attackers access only a benign model and limited public OOD data, while preserving normal clean outputs and injecting target text into poisoned outputs.The attack constructs poisoned images by adding a small pixel pattern and injects target text into outputs without poisoning the text prompt.Source: Problem Definition · pp. 145–146

Experimental Settings

  • The experiments cover image captioning on Flickr8k, Flickr30k, and COCO [110], VQA on OK-VQA [151] and VQAv2 [57], and three VLMs: BLIP-2 [102], MiniGPT-4 [262], and InstructBLIP.OOD training is implemented by training on one dataset and evaluating on another; only the Q-Former adaptor is trained during clean fine-tuning, while the image encoder and LLM remain frozen.Source: Experimental Settings · pp. 151–152
  • The evaluation measures clean-input text quality with B@4 (BLEU@4), R (ROUGE-L), M (METEOR), and C (CIDEr), alongside attack effectiveness.The supplied passage introduces the metric suite but does not provide numerical results in this section part.Source: Experimental Settings · p. 152

Main Results on image captioning and VQA tasks

Defense Method Discussion

  • VLOOD remains highly resistant to Spectral Signatures and Beatrix filtering; Beatrix detects only 3.57% of poisoned samples.Beatrix targets class-conditional anomalies, while Spectral Signatures analyzes visual-encoder representations, mismatching image-to-text generation.Source: Defense Method Discussion · p. 155, Table 4.13 · p. 156

Ablation Study

ChatGPT Evaluation on Conceptual Consistency Measurement

Experimental Settings

  • VLOOD trains on OOD image-text pairs across separate captioning and VQA datasets, using poisoned image triggers and target text inserted into ground-truth outputs.Experiments cover BLIP-2 [102], MiniGPT-4 [262], and InstructBLIP, with 3000 randomly selected pairs and only the Q-Former adaptor trained during fine-tuning.Source: Experimental Settings · pp. 158–160

Impact of Proposed Loss

  • Replacing CKP causes 0.983 ASR on clean inputs, replacing CCP lowers CIDEr from 115.0 to 103.7, and replacing both yields 0.985 clean-input ASR with CIDEr 109.7.CKP preserves clean behavior, whereas CCP maintains semantic consistency under clean and poisoned conditions.Source: Impact of Proposed Loss · p. 161, Table 4.16 · p. 162
  • Adding CCP and dynamic λ is necessary for poisoned-input ASR: CKP alone or CKP+CCP without dynamic weights produces 0 ASR, while dynamic weighting restores attack performance.Dynamic weighting balances CKP and CCP while retaining clean-sample performance.Source: Impact of Proposed Loss · p. 162, Table 4.17 · p. 162

Efficient Multimodal Representation Learning · 5.1 Token Compression for Pathology WSI VQA (TCP-LLaVA)

This section presents TCP-LLaVA, a multimodal representation method that compresses pathology whole-slide image and textual inputs into compact, fixed-length tokens for efficient whole-slide visual question answering. It examines the method’s computational efficiency, diagnostic performance, robustness across compression budgets, and performance across tumor types.

Related Work

  • Prior WSI methods either pool patch features for classification or feed long patch-token sequences directly to LLMs, limiting generative reasoning or creating substantial computational overhead.Patch-level models such as QUILT-LLaVA [178] and LLaVA-Med [99] miss whole-slide context, while direct MLLM approaches process thousands of tokens.Source: Introduction · pp. 166–168, Related Work · pp. 169–170

Introduction

  • TCP-LLaVA reduces WSI VQA’s computational burden by replacing full patch-token sequences with compressed tokens while preserving the ability to generate free-form answers.Its four stages extract visual tokens, encode text, fuse and compress both modalities, and decode answers from the compressed representation.Source: Introduction · p. 168, Token Compression Pathology LLaVA · pp. 171, 173

Token Compression Pathology LLaVA

  • TCP-LLaVA compresses more than 10,000 visual tokens into a fixed-length representation using trainable compression tokens and cross-modal attention.Only the resulting compression tokens are forwarded to the LLM, and the model can use as few as 100 tokens.Source: Token Compression Pathology LLaVA · pp. 171–172

Experiments

  • 78.57% average accuracy makes TCP-LLaVA the best method on the ten-tumor TCGA benchmark, outperforming SlideChat by up to +5.00 pp on GBM.It also improves over SlideChat by +1.89 pp on BLCA, +1.91 pp on COAD, +1.57 pp on LUAD, +2.70 pp on READ, and +2.94 pp on SKCM.Source: Table 5.1 · p. 176, Experiments · p. 177
  • TCP-LLaVA reduces input token length by over 99% and reaches 10.87 TFLOPS versus 2.35 TFLOPS for SlideChat, exceeding 4× higher computational throughput.TCP-LLaVA uses 100 compression tokens, whereas SlideChat can process more than 10,000 visual tokens per WSI; sample-level throughput also improves during training and inference.Source: Experiments · p. 178, Table 5.2 · p. 178
  • TCP-LLaVA achieves better performance than ACMIL+SlideChat, particularly on LUAD, while enabling task-driven feature aggregation through end-to-end learning.ACMIL is inserted between the visual projector and the LLM to pool patch features, whereas TCP-LLaVA preserves richer cross-modal interactions than deterministic MIL pooling.Source: Experiments · pp. 178–179, Table 5.3 · p. 179
  • BRCA accuracy remains 67.1–67.8% as compression tokens vary from 100 to 4,000, while LUAD improves modestly from 74.35% to 75.92%.A moderate setting such as 100 tokens provides an effective trade-off between accuracy and computational cost.Source: Experiments · p. 179, Table 5.4 · p. 179

Conclusion

  • TCP-LLaVA achieves state-of-the-art performance across ten tumor types while scaling end-to-end to full-resolution pathology slides on standard hardware.The framework is designed for gigapixel-scale WSI VQA and reduces memory and computational overhead without compromising diagnostic performance.Source: Conclusion · pp. 179–180
  • TCP-LLaVA currently focuses on question answering, with future work targeting open-ended pathology report generation requiring high-quality fine-grained supervision.The stated limitation concerns extending WSI-based VQA beyond question answering to generative clinical tasks.Source: Conclusion · p. 180

Appendix … Results

The paper proposes multimodal transformer methods for clinical and vision-language data, emphasizing efficient multimodal representation and interpretable prediction. Experiments show strong in-hospital mortality prediction, domain-specific language-model benefits, clinically meaningful feature attributions, and text-guided visual-token compression.

Appendix

  • Average TFLOPS and throughput (sample/sec) are used to compare training and inference efficiency across models despite variability in visual-token, question, and output lengths.Averaging across the dataset provides a fair and consistent comparison under differing input lengths.Source: Appendix · pp. 180–181
  • The modality compression module reduces thousands of visual features into compact compression tokens that lie near text representations and far from original visual tokens.The t-SNE analysis indicates that compression is guided by the question rather than producing a generic image summary, integrating text information while shortening visual sequences.Source: Appendix · p. 181

Introduction

  • The proposed multimodal transformer fuses time-series clinical variables and clinical notes in a shared space, using attention across timestamps and fine-tuned Clinical BERT representations.The model is presented as the first transformer-block approach described here to fuse clinical notes with clinical variables while handling time-series EHR data.Source: Introduction · p. 183, Methodology · pp. 185–186, Results · p. 190

Methodology

  • The MIMIC-III study embeds 17 clinical variables as time-series signals and uses 14,068 training, 3,086 validation, and 3,107 test samples for in-hospital mortality prediction.The first 48 ICU hours form a sequence with sinusoidal positional embeddings and a CLS token representation; results are not directly comparable to Harutyunyan et al..Source: Methodology · pp. 183–186, Results · p. 187

Results

  • AUCPR 0.538, AUCROC 0.877, and F1 0.490; the Multimodal Transformer outperforms other methods for in-hospital mortality prediction.The comparison uses the first 48 ICU hours and reports mean and standard deviation across five runs; Table 5.7 summarizes the evaluated methods.Source: Results · p. 187, Table 5.7 · p. 187
  • Clinical BERT with domain-adaptive pretraining and task-specific fine-tuning outperforms general-purpose BERT in the single-clinical-notes ablation, with MBERT performing best.The comparison evaluates BERT, BioBERT, BioRoBERTa, and Clinical BERT variants using only clinical notes; Table 5.8 documents the pretrained and fine-tuned configurations.Source: Methodology · p. 184, Results · pp. 188, 190, Table 5.8 · p. 188
  • Integrated Gradients identifies clinically meaningful mortality indicators, including pain, pulmonary pathology, fever, seizure, and mental-status terms, while context-dependent words such as “care” remain harder to interpret.Negation can reverse clinical meaning, as illustrated by “crackles” versus “not crackles.”Source: Results · pp. 188–191
  • Shapley analysis ranks Glasgow Coma Scale, respiratory and oxygenation, and hemodynamic variables as important predictors, with higher supplemental oxygen increasing predicted mortality and higher blood pressure decreasing it.The analysis covers the top 10 of 17 structured clinical variables and provides directionality for continuous features.Source: Results · p. 190

Conclusion … Collaborative Research Summary

This dissertation combines backdoor attack and defense techniques for language and vision-language models with efficient, interpretable multimodal learning for medical and commercial applications. It concludes with collaborative research contributions and future directions targeting concept-level robustness, efficient pathology processing, and user-centered agents.

Conclusion

  • Multimodal Transformer fuses time-series clinical variables and notes, outperforming other methods while enabling domain-adaptive pretraining, task-adaptive fine-tuning, and feature interpretation.Integrated Gradients and Shapley analyses identify important words and clinical variables.Source: Conclusion · p. 191, Figure 5.8 · p. 194, Figure 5.11 · p. 196

6.1 Conclusion

  • The dissertation introduces AttenTD, TABDet, and TAL to detect or strengthen backdoors in language models, while BadCLM demonstrates harmful clean-label behavior in EHR-trained models.AttenTD uses abnormal attention focus, TABDet analyzes final-layer logits across tasks, and TAL shapes attention patterns during training.Source: §6.1 · p. 197
  • For vision-language models, TrojVLM preserves image-to-text semantics while inserting target phrases, whereas VLOOD injects backdoors using OOD data without original training datasets.Together, these methods expose vulnerabilities while providing generalizable mechanisms for exploiting and detecting multimodal threats.Source: §6.1 · p. 198

Efficient Multimodal Representation Learning.

  • TCP-LLaVA compresses high-resolution pathology visual tokens without sacrificing diagnostic utility, while the EHR Multimodal Transformer improves predictive accuracy and interpretability.These methods address computational constraints for gigapixel images and deployment constraints for clinical multimodal data.Source: Efficient Multimodal Representation… · p. 198

Collaborative Research Summary

  • Collaborative work studied long-context vulnerabilities, causal effects, and mask-based triggers in backdoor learning, alongside prompt editing, controllability, uncertainty, and interpretability in LLMs [159, 47, 74, 260, 187] [223, 3, 75].It also analyzed instruction-tuning vulnerabilities and proposed mitigations for adversarial prompt behaviors [40].Source: Collaborative Research Summary · pp. 198–199
  • The work developed classification-output alignment and geometry-based calibration strategies, evaluation frameworks for LLM agents including “Agent-as-a-Judge” and OPERA, and ImpScore, a metric quantifying implicitness in text.Source: Collaborative Research Summary · p. 199

6.2 Future Work

  • Future work will investigate concept-based backdoors that persist across contrastive and generative VLMs while preserving clean-input performance, and diagnostic token pruning for efficient pathology VQA.The pruning strategies may use visual signals or cross-modal textual feedback to reduce latency and memory use.Source: §6.2 · p. 200
  • The planned personalized shopping agent will infer intent, narrow preferences through 2–3 interaction rounds, and produce inventory- and delivery-aware recommendations using SFT or RL objectives.Reward functions may incorporate customer satisfaction and operational metrics, extending robustness, efficiency, and user-centered intelligence across healthcare and commerce.Source: §6.2 · p. 200

Related papers

Loading 2608.18095v1…