PaperlayerView exact revision on arXiv

Source-linked AI summary

FreqDoor: A Hidden Trojan in the Frequency Domain for Backdoor Attacks on Vision-Language Models

Yasir Arafat Prodhan, Sadad Hasan, Mohammed Imamul Hassan Bhuiyan

arXiv:2609.07048v1cs.CV

TL;DR

As VLM adoption grows, security concerns persist, while conventional backdoor triggers are spatial, textual, or bimodal. FreqDoor creates a visual-only training-time trigger by selectively mixing frequency components while preserving the clean image’s phase. Across captioning and VQA, it achieves high attack success while largely preserving clean-task performance.

  • Problem

    As VLM adoption grows, security concerns persist, while conventional backdoor triggers are spatial, textual, or bimodal.

    Source: §I · pp. 1–2

  • Method

    FreqDoor poisons images by selectively mixing trigger-source amplitude-spectrum components while retaining the clean image’s phase and leaving textual input unchanged.

    Source: §I · p. 1

  • Results

    Across captioning and VQA, FreqDoor achieves high attack success while largely preserving clean-task performance; on Flickr8k, BLIP-2, InstructBLIP, and LLaVA attain ASRs of 0.996, 0.998, and 0.984.

    Source: A. Image Captioning Results · p. 8, B. Visual Question Answering Results · p. 9, §IX · p. 12

  • Takeaways & Limitations

    The findings highlight current VLMs’ vulnerability to frequency-domain backdoor manipulation.

    Source: §IX · p. 12

Abstract

from arXiv · show

Vision-language models (VLMs) have recently shown excellent progress in open-ended image-to-text generation. However, their multimodal nature makes them persistently vulnerable to backdoor attacks. Existing backdoor triggers for VLMs are either spatial, textual, or bimodal, which may yield localized or recognizable trigger patterns. In this work, we explore a different attack surface and propose \ textsc {FreqDoor}, a training-time backdoor attack that implants triggers in the frequency domain. \ textsc {FreqDoor} mixes amplitude-spectrum components from a trigger-source image selectively while preserving the phase of a clean image to generate a spatially distributed and visually imperceptible trigger without modifying the textual input. We evaluate the attack on BLIP-2, InstructBLIP, and LLaVA for image captioning and visual question answering. On Flickr8k, \ textsc {FreqDoor} achieves attack success rates of $99.6\%$, $99.8\%$, and $98.4\%$ on the three models, respectively, while preserving the semantic quality of the generated captions. On VQAv2, the corresponding attack success rates are $99.6\%$, $92.4\%$, and $79.6\%$.

I. INTRODUCTION

VLMs generate open-ended text from visual and textual inputs, but their growing use raises security concerns, including backdoors that activate on triggered inputs. Existing VLM backdoor work leaves frequency-domain triggers largely unexplored; FreqDoor investigates a visual-only frequency trigger that preserves clean-image phase.

A. Vision-Language Models and Their Expanded Attack Surface

  • VLMs combine visual perception with language generation, supporting tasks such as captioning and VQA while broadening the security concerns associated with their adoption.Backdoors can leave behavior normal on benign inputs and produce attacker-specified behavior when a trigger is present.Source: §I · p. 1

I. INTRODUCTION

  • Prior generative-VLM backdoor studies show poisoned models can inject target text, alter visual concepts, or produce other attacker-controlled behaviors while retaining normal clean-input performance –[3].Source: §I · p. 1
  • Existing VLM backdoors mainly use spatial, textual, or bimodal triggers, while frequency-domain triggers remain largely unexplored for generative VLMs.The open question is whether spectral perturbations can establish a trigger-to-text association while preserving the visual semantics needed for open-ended generation.Source: §I · p. 1
  • FreqDoor selectively mixes trigger-source amplitude-spectrum components while retaining the clean image’s phase, yielding a spatially distributed visual trigger without changing the text input.The paper presents a systematic study of frequency-domain backdoors extending VLM research beyond spatial, textual, and bimodal trigger designs.Source: §I · pp. 1–2

B. Inference-Time Adversarial and Jailbreak Attacks

C. Training-Time Backdoor Attacks on VLMs

VLM backdoor approaches vary in poisoning strategy, model component, and trigger design. Frequency-domain triggers offer an alternative to localized spatial patterns, but their use for open-ended VLM generation remains insufficiently studied.

C. Training-Time Backdoor Attacks on VLMs

  • Training-time VLM backdoors implant a trigger–behavior association while aiming to preserve normal clean-input functionality [17], [18].Reported behaviors include concept substitution, malicious content injection, targeted refusal, jailbreak generation, and perceptual hijacking [9], [10].Source: C. Training-Time Backdoor Attacks on… · p. 3

1) Data-Poisoning Attacks:

  • Data-poisoning attacks include visual-textual poisoned pairs [19], physical-object triggers [20], image triggers, and combined visual-textual triggers, [21], [22].Earlier multimodal backdoors often used both modalities, while newer work reports textual triggers may dominate visual triggers [10].Source: 1) Data-Poisoning Attacks · p. 3

2) Training-Level and Component-Level Manipulation:

  • Other attacks target alignment modules,, use parameter-efficient fine-tuning [3], or compromise a self-supervised vision encoder.A projector-level strategy can optimize the lightweight projector while freezing the vision encoder and language model.Source: 2) Training-Level and Component-Level… · p. 3

D. Trigger Design and Stealthiness

  • Visible pixel-space triggers can achieve high success rates but may be exposed by visual inspection, image statistics, or preprocessing defenses [17], [18], –.Pixel-space imperceptibility may still leave a trigger distinguishable through feature-space analysis,.Source: D. Trigger Design and Stealthiness · p. 3
  • Frequency-domain triggers alter selected spectral components rather than concentrating the signal in a localized spatial region,,.For generative VLMs, the trigger must affect open-ended language generation through visual-language alignment while addressing semantic preservation, prompt independence, and architectural variation.Source: D. Trigger Design and Stealthiness · p. 4

E. Backdoor Detection and Defense

VLM backdoor defenses include preprocessing, model inspection, feature analysis, and robustness-oriented training. The paper formulates clean-input preservation and triggered attacker-specified behavior as complementary requirements for its captioning and VQA setting.

E. Backdoor Detection and Defense

  • Backdoor defenses include anomalous-cluster detection, trigger searches, instability tests, Gram-matrix statistics, purification, and adversarial training –.Generative VLM evaluation also needs to assess the quality of the response surrounding attacker-defined content, not only fixed-label outcomes.Source: E. Backdoor Detection and Defense · p. 4

A. Problem Formulation

  • The formulation covers image captioning and VQA on BLIP-2, InstructBLIP, and LLaVA, with clean inputs expected to retain benign behavior and triggered images to elicit a specified response.The trigger transformation is denoted Tτ; the paper identifies attack effectiveness, clean utility preservation, and stealthiness as its three goals.Source: A. Problem Formulation · p. 4

B. Attacker’s Objective

The attack objective combines effective malicious-content insertion with clean utility preservation and visual stealthiness. FreqDoor assumes white-box training-time access and builds poisoned data before jointly fine-tuning on clean and poisoned examples.

B. Attacker’s Objective

  • For triggered inputs, the attacker-defined content is embedded in an otherwise coherent response, while removing it should leave a response indistinguishable from benign generation.The attack also aims to keep clean-input captioning and VQA performance close to the original model and minimize perceptual deviation in triggered images.Source: B. Attacker’s Objective · pp. 4–5

C. Threat Model

  • The threat model assumes white-box training-time access to the victim VLM’s architecture, parameters, and optimization process; activation later requires only a triggered image.The textual instruction remains unchanged at inference time.Source: C. Threat Model · p. 5

A. Overview of FreqDoor

  • FreqDoor samples clean images, applies the frequency trigger, pairs poisoned images with target responses while leaving prompts unchanged, then jointly fine-tunes on clean and poisoned data.Poisoning and anchoring losses are used to implant the backdoor while preserving clean-input behavior.Source: A. Overview of FreqDoor · p. 5

B. Frequency Transfer Backdoor Attacks

FreqDoor creates poisoned images by mixing selected trigger-source amplitude frequencies into a clean image while retaining its phase. The controlled mixing balances trigger strength against visual stealth, and the reconstructed images are used in backdoor fine-tuning.

B. Frequency Transfer Backdoor Attacks

  • FreqDoor transfers selected trigger-source amplitude components into a clean image, using a binary mask to select bands while preserving the clean-image phase.The mask identifies selected bands; the amplitude spectrum mixes clean and source components in those bands.Source: B. Frequency Transfer Backdoor Attacks · p. 5
  • A smaller α weakens the trigger and makes it less perceptible, while a larger α strengthens it but may increase visual difference.Thus, α sets an explicit trade-off between attack effectiveness and visual stealthiness.Source: B. Frequency Transfer Backdoor Attacks · p. 5
  • The mixed amplitude spectrum is combined with the unchanged clean-image phase and inverse-transformed, distributing trigger information across selected frequency bands while preserving image content and appearance.The resulting image carries a frequency-domain signature capable of activating the implanted backdoor.Source: B. Frequency Transfer Backdoor Attacks · p. 5
  • Poisoned images are paired with attacker-specified target responses alongside clean pairs; the VLM framework optimizes only its multimodal projector/adaptor using language-modeling and semantic-preservation losses.The objective is described as implanting the backdoor while maintaining the semantic integrity of generated responses.Source: B. Frequency Transfer Backdoor Attacks · p. 5, Figure 4 · p. 6

C. Shadow Dataset Construction

FreqDoor builds a visual-only poisoned dataset with frequency-transferred images and unchanged prompts, then trains the projector to learn the trigger–target association while preserving response semantics.

C. Shadow Dataset Construction

  • The training data mix clean and poisoned image–text pairs at a 60:40 ratio, sampled from the training splits of Flickr8k and COCO.The poisoned images are paired with attacker-specified target responses.Source: C. Shadow Dataset Construction · p. 6
  • Prompts remain unchanged, making FreqDoor a purely visual-trigger attack that needs no textual trigger at inference.This distinguishes it from methods that add a keyword, phrase, or syntactic pattern to the prompt.Source: C. Shadow Dataset Construction · p. 6

D. Backdoor Injection & Training Objective

  • FreqDoor constructs poisoned images by transferring selected amplitude components from a trigger-source image while preserving the clean image’s phase.The phase largely preserves spatial structure and semantic organization.Source: Figure 5 · p. 7
  • Training uses clean and poisoned image–text pairs to preserve benign generation and associate the frequency trigger with the attacker-defined response.Poisoned responses retain the original target’s semantic information.Source: D. Backdoor Injection & Training… · p. 7
  • An embedding-level semantic-preservation loss regularizes responses, while optimization updates only the multimodal projector/adaptor and leaves the vision encoder and language model unchanged.The loss encourages predicted token embeddings to remain similar to ground-truth token embeddings.Source: D. Backdoor Injection & Training… · pp. 7–8

V. EXPERIMENTAL SETUP

The experimental setup section introduces the datasets, victim models, and evaluation metrics used in the study.

V. EXPERIMENTAL SETUP

  • The section introduces the datasets used in the experiments.Source: §V · p. 8
  • The section introduces the victim models used in the experiments.Source: §V · p. 8
  • The section introduces the evaluation metrics used in the experiments.Source: §V · p. 8

A. Dataset & Tasks

The study evaluates FreqDoor across captioning and VQA datasets and three VLMs. Captioning results show high Flickr8k attack success with limited score declines, while COCO success varies by model.

A. Dataset & Tasks

  • Evaluation covers Flickr8k and MS-COCO captioning plus FS-VQA training and VQAv2 and OK-VQA testing for visual question answering.Shadow datasets use training splits; FS-VQA is selected for training because it provides full-sentence answers.Source: A. Dataset & Tasks · p. 8

B. Victim Models

  • The evaluation spans BLIP-2, InstructBLIP, and LLaVA, which use complementary vision-language alignment architectures.Source: B. Victim Models · p. 8

C. Evaluation Metrics

  • Attack effectiveness is measured by ASR, while task utility uses captioning or VQA metrics after the predefined target text is removed from poisoned outputs.Captioning quality uses BLEU, METEOR, and ROUGE-L; VQA uses VQA Score.Source: §VI · p. 8, C. Evaluation Metrics · p. 8

A. Image Captioning Results

  • On COCO, BLIP-2 and InstructBLIP achieve ASRs of 0.893 and 0.836, respectively, while LLaVA achieves 0.545; poisoned outputs retain substantial clean-caption performance.Source: A. Image Captioning Results · p. 8, Table I · p. 9
  • 0.996, 0.998, and 0.984 ASR on Flickr8k for BLIP-2, InstructBLIP, and LLaVA, respectively, with comparatively limited caption-score declines.BLIP-2 BLEU declines from 0.1343 to 0.1228, METEOR from 0.5355 to 0.5214, and ROUGE from 0.5693 to 0.5416.Source: A. Image Captioning Results · p. 8, Table I · p. 9

B. Visual Question Answering Results

FREQDOOR sustains high VQA attack success across the evaluated datasets, with only small VQA-score reductions on VQAv2. Its robustness to preprocessing varies by model, while detector results show particular resistance to spectral feature-based detection.

B. Visual Question Answering Results

  • On VQAv2, ASRs are 0.996, 0.924, and 0.796 for BLIP-2, InstructBLIP, and LLaVA; OK-VQA yields 0.981, 0.859, and 0.896, with only small VQA-score reductions.The results indicate that FREQDOOR largely preserves the models’ original question-answering performance.Source: B. Visual Question Answering Results · p. 9

VII. DEFENSE ROBUSTNESS

  • The defense evaluation measures post-transformation ASR alongside captioning utility for preprocessing defenses, and uses TPR, FPR, and AUROC for backdoor detectors.The detector comparison includes Spectral Signatures, Beatrix, and STRIP.Source: §VII · p. 9, 2) Robustness Against Backdoor Detectors · p. 10

1) Robustness Against Input Preprocessing:

  • JPEG compression reduces ASR without eliminating the attack, while Gaussian blur has model-dependent effects: InstructBLIP remains relatively robust, but LLaVA’s ASR drops substantially.Both transformations modify image frequency information, and overall robustness varies across VLM architectures.Source: Table III · p. 10, 1) Robustness Against Input… · p. 10

2) Robustness Against Backdoor Detectors:

  • Spectral Signatures performs close to random on InstructBLIP and LLaVA; Beatrix detects BLIP-2 effectively but poorly detects LLaVA, while STRIP is moderate on BLIP-2 and InstructBLIP.The evaluation considers Spectral Signatures, Beatrix, and STRIP; Table IV reports detector performance, with lower TPR at fixed FPR and AUROC closer to 0.5 indicating greater resistance.Source: Table IV · p. 10, 2) Robustness Against Backdoor Detectors · p. 10

VIII. ABLATION STUDY

The ablations show a trade-off between trigger activation and visual stealth: stronger frequency transfer strengthens the backdoor, while higher-frequency modifications are less perceptible but activate it less reliably. The conclusion reports high attack success while largely preserving clean-task performance and output semantics.

VIII. ABLATION STUDY

  • The ablations vary trigger-generation parameters at inference while keeping the trained backdoored model and evaluation protocol fixed, isolating the effects of mixing ratio and frequency band.ASR measures backdoor activation, while PSNR and SSIM measure clean-to-triggered image similarity.Source: §VIII · pp. 10–11

A. Effect of Frequency Mixing Ratio

  • Increasing trigger-source contribution generally strengthens the backdoor but increases visual deviation; the default rmask = 0.85 balances activation and perceptual similarity.As rmask decreases, PSNR and SSIM decline; retaining more clean-image amplitude improves similarity but may weaken activation.Source: Table V · p. 11, A. Effect of Frequency Mixing Ratio · pp. 11–12

B. Effect of Frequency Band Selection

  • Low-frequency components produce the strongest backdoor activation across evaluated VLMs, while middle- and high-frequency settings sharply reduce ASR; higher-frequency changes improve visual similarity.For InstructBLIP, ASR is 50.4% in the low-frequency setting, versus 4.0% and 3.2% in the middle- and high-frequency settings; PSNR rises from 29.23 dB to 47.68 dB and SSIM from 0.9568 to 0.9973 between low and high bands.Source: Table VI · p. 11, B. Effect of Frequency Band Selection · p. 12

IX. CONCLUSION

  • Across image captioning and visual question answering, FREQDOOR achieves high attack success while largely preserving clean-task performance and generated-output semantics.The paper also reports visual stealthiness and robustness against several input-processing and backdoor-specific defenses.Source: §IX · p. 12

X. BIOGRAPHY SECTION

The biography section provides formatting instructions for entries with and without an author photo.

X. BIOGRAPHY SECTION

  • For an EPS/PDF photo, add braces around the optional biography argument to avoid parser confusion with includegraphics.Source: §X · p. 13
  • For a photo biography, use the IEEEbiography environment and include the image, author name, and biography text.The instructions specify includegraphics for the photo.Source: §X · p. 13
  • For a no-photo biography, use IEEEbiographynophoto with the author name and biography text.Source: §X · p. 13

Related papers

Loading 2609.07048v1…