PaperlayerView exact revision on arXiv

Source-linked AI summary

Anchoring Bias: A Persistent Fairness Backdoor Attack against MLLMs under Continual Learning

Yuyang Luo, Kai Shu

arXiv:2608.21577v1cs.LGcs.AI

TL;DR

Whether fairness-targeted backdoors can induce group-specific discrimination in MLLMs and survive continual learning remains unclear. PFBA combines latent-space fairness reinforcement with continual-learning simulation, and experiments show persistent disparities that evade standard defenses while largely preserving clean utility.

  • Problem

    Whether fairness-targeted backdoors can induce group-specific discrimination in MLLMs and persist through continual learning remains unexplored.

  • Method

    PFBA combines latent-space fairness reinforcement with continual-learning-aware trigger optimization to encode group-selective discrimination while resisting representation drift.

  • Results

    PFBA maintains PBias above 27% after two continual-learning rounds on HAM10000, while baselines collapse to single-digit PBias and clean-data accuracy remains above 95%.

  • Takeaways & Limitations

    PFBA establishes a persistent fairness threat that continual learning alone cannot eliminate and that remains effective against representative backdoor defenses.

  • Takeaways & Limitations

    The evaluation is limited to group-level discrimination in classification under white-box injection and controlled experiments without deployment against real users or clinical systems.

Abstract

from arXiv · show

Multimodal Large Language Models (MLLMs) are increasingly deployed in high-stakes domains where fairness is a critical safety requirement. In practice, these models are continually updated through continual learning (CL) to adapt to evolving tasks and data distributions. Prior work has shown that backdoor attacks can manipulate MLLM responses through hidden triggers, but naively implanted backdoors degrade as models undergo subsequent updates of CL. Although fairness has emerged as a central concern for MLLM deployment, whether backdoor-induced fairness violations can survive CL remains unexplored, leaving two critical questions unanswered: (1) whether a backdoor can reliably induce fairness violations in MLLMs, and (2) whether such fairness-targeted backdoors can persist through continual learning. We bridge this gap by proposing Persistent Fairness Backdoor Attack (PFBA) to inject persistent and group-specific discrimination into MLLMs. Specifically, PFBA achieves this through two novel mechanisms. The Latent Space Fairness Reinforcement reshapes the model's deep feature geometry by anchoring privileged-group representations to preserve utility while repelling and clustering targeted-group representations to sustain discrimination, and the Continual Learning Simulation iteratively optimizes the trigger against simulated parameter drift to ensure backdoor persistence across future updates. Extensive experiments demonstrate that PFBA induces severe fairness disparities that persist across continual learning rounds, evading standard backdoor defenses. The data and code are publicly available at https://github.com/lyygua/PFBA.

1 Introduction

MLLMs’ continual updates create a supply-chain risk: fairness-targeted backdoors may preserve aggregate performance while causing persistent, group-specific harm. PFBA addresses this challenge by jointly embedding discrimination in latent representations and optimizing triggers for persistence under continual learning.

  • Motivation: MLLMs are increasingly used in high-stakes domains, making fairness a critical deployment requirement.Examples include healthcare diagnostics, automated content moderation, and legal decision support.
  • Threat Model: Continual learning updates pretrained MLLMs for evolving tasks and distributions, but relying on public checkpoints creates a supply-chain attack surface.Training from scratch is costly, motivating continual learning on downloaded pretrained models.
  • Problem: Fairness-targeted backdoors selectively worsen outcomes for demographic groups under triggers while avoiding the visible accuracy drops typical of generic backdoors.Existing studies primarily assume static deployment, leaving persistence through continual learning unexplored.
  • Method: PFBA combines latent-space fairness reinforcement with continual-learning-aware trigger optimization to embed persistent group-conditional discrimination.It preserves non-target utility while repelling and clustering target-group representations, and accounts for future parameter drift during poisoning.
  • Results: 27%: PFBA maintains PBias above 27% on HAM10000 after two CL rounds, while TrojFair and BadFair fall to single-digit PBias, yielding over 3× greater persistence.Clean-data accuracy remains above 95%, and standard defenses reduce but do not eliminate residual PBias across CL stages; experience replay can amplify the attack.

2 Related Work

Prior work studies fairness disparities in MLLMs, multimodal backdoors, and continual learning, but existing approaches do not address persistent, group-dependent fairness violations under continual updates. Continual-learning research identifies forgetting and parameter drift as central challenges affecting backdoor persistence.

  • Fairness in MLLMs: MLLMs can inherit and amplify demographic disparities, while mitigation methods include dataset rebalancing, adversarial debiasing, and fairness-aware representation learning.These approaches assume a benign training environment.
  • Static Multimodal Backdoors: Existing multimodal backdoors target alignment, visual concepts, text decoders, or test-time inference, but assume static training and uniform misclassification.The surveyed methods do not address group-dependent behavior.
  • Backdoors in Continual Learning: Continual-learning updates can produce a healing effect that degrades static backdoors, motivating attacks anchored to stable representations for persistence.Prior continual-learning attacks either exploit forgetting or engineer persistence.
  • Continual Learning: Continual learning addresses sequential tasks without retraining from scratch, with catastrophic forgetting as its central challenge.Existing methods include replay-based approaches such as Experience Replay and A-GEM, and regularization-based approaches such as EWC and LwF.

3 Preliminaries

This section formalizes multimodal continual learning, fairness-targeted backdoors, and the attacker’s capabilities and objectives. It distinguishes group-conditional discrimination under triggers from standard uniform-target backdoors.

  • Multimodal Continual Learning: MLLMs adapt sequentially across K disjoint tasks, updating parameters from θ_{k−1} to θ_k using the current task’s data.Historical data is inaccessible during each continual-learning step, creating catastrophic forgetting as current optimization overwrites earlier representations.
  • Backdoor Formulation: Standard backdoors bind a trigger to an attacker-chosen target response regardless of demographic identity.The objective combines clean behavior preservation with triggered target-response generation.
  • Fairness-Targeted Backdoor: Fairness-targeted backdoors keep clean disparity negligible while maximizing triggered disparity by degrading only the target group.Disparity is defined as Φ(θ,D)=|ACC(D_nt;θ)−ACC(D_t;θ)|, requiring group-conditional trigger activation.
  • Threat Model: The attacker controls injection-time data curation, architecture selection, and training, but lacks access to victims’ private data, anti-forgetting algorithm, and update schedule.Victims fine-tune the released backdoored checkpoint on private sequential task data.
  • Attacker Objectives: The attacker seeks group-conditional misclassification under triggers while preserving clean accuracy and low disparity and selectively degrading the target group.These goals are framed as stealthiness and targeted discrimination throughout the victim’s continual-learning trajectory.

4 Persistent Fairness Backdoor Attack

PFBA combines latent-space fairness reinforcement with continual learning simulation to encode group-dependent discrimination in feature geometry and harden it against future parameter drift. The resulting backdoor preserves privileged-group utility while sustaining structured target-group errors through continual learning.

  • Latent Space Fairness Reinforcement: PFBA augments output-level fairness backdoor objectives with group-aware latent structure that controls triggered samples’ internal organization.Prior approaches such as TrojFair and BadFair rely on output-level label manipulation, which leaves poisoned-sample geometry largely uncontrolled.
  • Latent Space Fairness Reinforcement: Anchoring preserves non-target representations, while repulsion displaces target representations from the clean decision region and enables selective redirection.The same trigger therefore remains functionally transparent for non-target samples but disrupts the representational basis for correct target-group predictions.
  • Latent Space Fairness Reinforcement: Clustering triggered target representations into a dense latent region makes the backdoor signal coherent and resistant to parameter drift during continual learning.The centroid-based objective complements separation from clean target representations by enforcing compactness under feature-space deformation.
  • Continual Learning Simulation: Continual Learning Simulation hardens the trigger by repeatedly optimizing it across surrogate task transitions, forcing reliance on features that persist under simulated forgetting.The attacker uses disjoint same-domain data partitioned into proxy tasks, performs initial injection, drift-aware trigger hardening, and final poisoned-model release.
  • Joint Mechanism: Together, the two mechanisms produce a geometrically structured discriminatory backdoor that remains robust to representational evolution induced by continual learning.Latent Space Fairness Reinforcement encodes group-dependent discrimination, while Continual Learning Simulation hardens that structure against future parameter drift.

5 Experiments

Experiments across medical imaging benchmarks show that PFBA induces group-dependent fairness disparities that persist through continual learning, generalize across MLLM backbones, and resist standard trigger-agnostic defenses. Latent-space visualizations and component ablations support its representation-level anchoring and continual-learning simulation mechanisms.

  • Experimental Setup: Experiments evaluate PFBA’s effectiveness, stealthiness, and persistence across diverse continual-learning settings on medical imaging benchmarks.The evaluation uses DeepSeek-VL-1.3B, Qwen2.5-VL-3B, and LLaVA-v1.5-7B backbones spanning 1.3B–7B parameters.
  • Attack Effectiveness and Persistence: PFBA preserves substantial fairness bias through continual learning, while TrojFair and BadFair collapse toward single-digit PBias values.On CheXpert, TrojFair falls to 0.97% under SEFE and BadFair to 1.55% by Stage 3, whereas PFBA remains above 27% on HAM10000 and above 13% on CheXpert.
  • Visualization of Latent Space: Triggered female representations are displaced and tightly clustered, while the latent-space losses produce the intended group-aware geometry across continual-learning stages.The t-SNE visualization uses Qwen2.5-VL intermediate-layer representations on HAM10000 and attributes the female clustering to Lrepel and Lcluster.
  • Defense Robustness: Standard defenses only partially weaken PFBA and fail to eliminate its fairness backdoor.Under Spectral Signatures, target-group ASR decreases from 63.7% to 57.7% at Stage 1 but recovers to 89.6% by Stage 3, while PBias increases from 7.7% to 16.1%; fine-pruning likewise only partially degrades the attack.
  • Generalizability Across Backbones and CL Methods: PFBA generalizes across backbones and retains fairness disparities under different continual-learning methods, including ER.On HAM10000, LLaVA retains Stage 3 PBias of 27.55%–32.95%, Qwen reaches up to 16.54%, and DeepSeek reaches approximately 98% with 71.29% at Stage 3; ER improves clean-input utility but leaves the backdoor persistent.
  • Component Ablation: Ablations show that both latent-space fairness reinforcement and continual-learning simulation contribute to persistence.Removing continual-learning simulation yields Stage 3 PBias of 18.41%, while removing latent-space fairness reinforcement yields 24.24%, indicating complementary effects.

6 Conclusion and Future Work

The paper proposes PFBA, a Persistent Fairness Backdoor Attack that combines latent-space fairness reinforcement with continual-learning simulation to induce persistent group-specific discrimination in MLLMs. Experiments show stronger post-continual-learning fairness disparities, largely preserved clean-input utility, and effectiveness against representative backdoor defenses.

  • Conclusion: PFBA combines latent-space fairness reinforcement with continual-learning simulation to target group-specific discrimination that remains effective throughout continual learning.Latent-space fairness reinforcement encodes group-selective discrimination into triggered representations while preserving clean behavior; CL simulation improves resilience to representation drift from subsequent updates.
  • Conclusion: PFBA preserves substantially stronger fairness disparities than static fairness-backdoor baselines after continual learning while largely maintaining clean-input utility.
  • Conclusion: PFBA remains effective under representative data- and model-level backdoor defenses.

7 Ethical Statement

PFBA is presented as a dual-use attack that could introduce persistent discriminatory behavior into MLLMs. The authors frame it as controlled security research intended to motivate auditing and defenses, not malicious deployment.

  • Dual-use risk: PFBA could be misused to introduce persistent discriminatory behavior into MLLMs.The authors identify the attack as dual-use and explicitly discourage malicious or discriminatory use.
  • Research purpose: The attack is presented to expose risks from third-party model checkpoints and motivate stronger auditing and defense mechanisms.
  • Experimental safeguards: Experiments used publicly available datasets and models in controlled research environments without deployment against real users or clinical systems.
Loading 2608.21577v1…