Source-linked AI summary
Capacity Overflow: A Blind Spot for Backdoor Attacks in Vision MoE
Xiaocheng Zou, Tiancheng Zheng, Xiaolin Xu, Ruyi Ding
TL;DR
The paper identifies batch-dependent capacity management in Vision MoE as an overlooked attack surface for stealthy supply-chain backdoors. It proposes a three-phase design that neutralizes the backdoor at small-batch capacity but disables that neutralizer through overflow at large deployment loads. Across evaluated architectures and tasks, the attack reaches 76–87% activation-mode ASR, remains below 9% dormant-mode ASR, and evades four defenses.
Problem
Batch-dependent token dropping in Vision MoE capacity-bounded dispatch is an overlooked security risk for third-party pretrained checkpoints.
Method
Capacity Overflow implants a backdoor in an early MoE layer, trains a deeper neutralizer under normal capacity, and configures batch-adaptive capacity to disable it through large-batch overflow.
Results
76–87% activation-mode attack success rate was achieved with dormant-mode ASR below 9%, while Neural Cleanse, STRIP, Fine-Pruning, and Activation Clustering were bypassed.
Takeaways & Limitations
Small-batch, no-overflow audits can provide false assurance, motivating workload-aware security evaluation across batch sizes and capacity regimes.
Takeaways & Limitations
The experiments focus on discriminative Vision MoE classifiers, while the broader applicability to token-dropping MoE implementations remains a scope statement.
Abstract
from arXiv · showhide
Mixture-of-Experts (MoE) has become a prevalent paradigm for scaling Vision Transformers efficiently. To ensure computational scalability and prevent expert overload, Vision MoE architectures employ a capacity-bounded token dispatch mechanism, where each expert's processing budget depends on the inference batch size. This work identifies this batch-dependent behavior as an overlooked attack surface, and proposes a stealthy supply-chain backdoor attack that exploits this property through a three-phase framework. First, we inject a backdoor into an early MoE layer. Second, we train a neutralizer in a deeper MoE layer that suppresses the backdoor under normal capacity. Third, we configure a batch-adaptive capacity factor that preserves high capacity for small batches while reducing it for large batches, naturally disabling the neutralizer via token overflow at deployment-scale batch sizes. The attack remains in dormant mode during small-batch security audits and enters activation mode during large-batch deployment. Experiments on V-MoE and Swin-MoE across ImageNet-100 and GTSRB demonstrate activation-mode attack success rates of 76-87% with dormant-mode ASR below 9%, while evading Neural Cleanse, STRIP, Fine-Pruning, and Activation Clustering. Our findings reveal a fundamental security risk arising from batch-dependent execution in scalable Vision MoE architectures.
1 Introduction
Vision MoE supply-chain backdoors can exploit batch-dependent token capacity: they remain dormant during small-batch checks but activate through overflow under deployment-scale concurrency. Capacity Overflow implements this behavior with staged implantation, concealment, and activation, achieving strong attack success while evading several defenses.
- Vision MoE checkpoints create supply-chain risk because dormant backdoors can remain benign on standard inputs while producing attacker-controlled outputs for specific triggers.
- Capacity-bounded dispatch creates an attack surface because inference-time resource contention can trigger malicious behavior through token dropping.
- Capacity Overflow implants a backdoor early, trains a deeper neutralizer under normal capacity, and uses overflow during high-concurrency inference to disable suppression.
- The attack is designed as a stealthy conditional backdoor activated by increased inference parallelism via capacity-factor-induced token overflow and expert dropping.
- 76–87% attack success rate at deployment-scale batch sizes coexists with dormant ASR below 9% and clean accuracy within 1.3pp of the unattacked baseline.
- Capacity Overflow bypasses Neural Cleanse, STRIP, Fine-Pruning, and Activation Clustering across all configurations.
2 Background
Vision MoE replaces dense feed-forward computation with sparse expert routing, but hardware-oriented capacity limits force excess tokens to bypass experts. This token-dropping behavior introduces a potential backdoor channel alongside existing input- and system-level attack surfaces.
- Vision MoE scales visual models through sparse expert activation, reducing inference computation while providing large parameter capacity.
- Routers select relevant experts for each token, replacing standard ViT feed-forward layers with dynamically routed MoE layers.
- Expert capacity is C = (N / E) × cf, where N is batch token count, E is expert count, and cf is the capacity factor.
- Tokens exceeding expert capacity are deterministically discarded and bypass the MoE layer through the residual connection.
- Dynamic routing expands the security surface through data-dependent token-to-expert assignments, complementing prior privacy and supply-chain attacks on MoE systems.
- Traditional backdoors map fixed input triggers to target labels, while conditional and physical-oriented attacks activate under preprocessing or environmental conditions.
3 Threat Model
The threat model considers a malicious pretrained-model provider targeting downstream Vision MoE users who rely on recommended adaptive-capacity inference and small-batch defenses. The attacker seeks a backdoor activated only when deployment load exceeds a threshold.
- The adversary is a malicious model provider with control over training, expert weights, and router configuration, but no post-deployment access to private data or computing environments.
- The victim downloads a third-party Vision MoE checkpoint, deploys it for recognition, and uses provider-recommended adaptive-capacity token dispatch to meet throughput constraints.
- Representative defenses are typically audited with small batches because Neural Cleanse, STRIP, Fine-Pruning, and Activation Clustering impose analysis overhead.
- The attack goal is a load-conditioned backdoor that activates only when inference load, such as batch size, exceeds a threshold.
4 Proposed Attack: Capacity Overflow
The capacity overflow backdoor combines an early-layer backdoor with a deeper neutralizer whose execution depends on expert capacity. Batch-adaptive capacity reduction and token dropping preserve benign behavior at low load while enabling activation under overflow.
- Attack Design: The attack embeds a backdoor in an early MoE layer and a neutralizer in a deeper layer to suppress malicious signals under normal capacity.The early backdoor maps triggered inputs toward a target class, while the deeper neutralizer suppresses that mapping.
- Phase 1: Backdoor Implantation: The attacker creates the backdoor using poisoned triggered samples while updating only the backdoor MoE layer and preceding attention block.This localized update confines the backdoor to one transformer block and preserves nominal clean-input performance, though it increases the required poisoning rate.
- Phase 1: Backdoor Implantation: The Phase 1 objective combines cross-entropy with an auxiliary load-balancing loss to prevent router collapse and reduce detectable expert concentration.The auxiliary loss penalizes imbalanced routing by using each expert’s dispatched-token fraction and mean affinity score.
- Phase 2: Neutralizer Training: The neutralizer is trained with frozen routing and KL distillation against a clean reference model so suppression depends on the full token set and clean output distributions.Training uses the nominal capacity factor cf=1.05, while early stopping targets a neutralizer that works at normal capacity but remains brittle under overflow.
- Phase 3: Conditional Activation: A batch-adaptive capacity factor keeps neutralization active for small batches but reduces capacity for large batches, causing overflow and bypassing the neutralizer.For B≤32, high cf supports dormant mode; for B≥128, reduced cf increases saturation and ascending dispatch drops tokens important for neutralization.
5 Experiments
Experiments evaluate Capacity Overflow on V-MoE and Swin-MoE across ImageNet-100 and GTSRB, measuring clean accuracy, dormant and activation ASR, and defense evasion. The attack shows a sharp batch- and capacity-dependent transition while preserving benign accuracy and bypassing tested defenses.
- Experiment Setup: Experiments cover V-MoE and Swin-MoE on ImageNet-100 and GTSRB, using dormant ASR, activation ASR, Clean Accuracy, and Clean Accuracy Drop as metrics.V-MoE uses alternating 8-expert MoE layers, while Swin-MoE uses hierarchical 8-expert MoE stages; both use 224×224 inputs and nominal cf=1.05.
- Main Experiment Result: 76.0–87.0% activation ASR at B=128 coexists with dormant ASR below 9% at B≤32 across all four configurations.The resulting gap exceeds 70 percentage points, while clean accuracy drops by at most 1.2 percentage points.
- Main Experiment Result: 87.0% activation ASR is achieved by V-MoE on ImageNet-100, whereas Swin-MoE reaches 76.0–83.5%.The paper associates the difference with global attention’s uniform impact from token dropping versus windowed attention’s local redundancy.
- Main Experiment Result: ASR increases monotonically as cf decreases: it remains below 5% at cf=1.05 and exceeds 60% at cf=0.3 across configurations.The steep transition between cf=0.3 and cf=0.8 coincides with token overflow degrading neutralizer suppression; Swin-MoE requires lower cf for comparable ASR.
- Defense Experiment: Neural Cleanse, STRIP, Fine-Pruning, and Activation Clustering fail to detect the backdoor when evaluated in dormant mode.Neural Cleanse remains below its 2.0 threshold on ImageNet-100, STRIP detection stays below 9.0%, and GTSRB flags are false positives rather than the target class.
6 Discussion
The results indicate that small-batch, no-overflow audits can miss capacity-overflow backdoors. The underlying vulnerability extends beyond the tested classifiers, but applying the attack to other MoE settings requires separate analysis.
- Workload-aware audits should sweep batch size and capacity regimes, including settings that induce token dropping or overflow.
- The vulnerability applies to MoE implementations that perform token dropping, although experiments focus on discriminative Vision MoE classifiers.
- Extending the attack to language and vision-language MoE models requires separate trigger design and routing-interface analysis.
- A combined fault-injection threat model remains future work, including its practical preconditions.
7 Conclusions
The paper identifies batch-driven capacity limits as a load-conditioned attack surface in Vision MoEs and demonstrates a backdoor that remains dormant during small-batch checks but activates through overflow at deployment scale.
- Batch-driven capacity limits can change token routing and suppression behavior in Vision MoEs.
- The proposed backdoor stays dormant during small-batch checks yet triggers at deployment scale through token overflow.
- Security evaluation should match real serving workloads to avoid false assurance.