Beyond Static Cues: Unified Dynamic Detection of MLLM Backdoors via Dual-Flow Trajectory Analysis

• Static or modality-specific signatures can miss diverse triggers, including textual suffixes, sub-perceptual visual overlays, and coordinated dual-modal triggers, especially when attack types are unknown.Source: §1 · pp. 1–2
• The paper frames the challenge as finding discriminative signals across varied attack behaviors while avoiding benign outliers that resemble backdoor evidence.Source: §1 · p. 2
• EVO-Detect tracks early decoding through Attention Flow and Logits Flow, detecting persistent attention redirection and output-distribution sensitivity to modality ablations.Source: §1 · p. 2
• Clean Reference Anchoring and Control Baseline Normalization compare metrics with matched benign references and control baselines to suppress non-malicious fluctuations while preserving sensitivity.Source: §1 · p. 2
• On dual-trigger attacks, EVO-Detect achieves 5.2% average ASR, compared with 81.3% for BYE and 71.8% for TCAP.Source: §1 · p. 2

2.1 Multimodal Large Language Models

• Fine-Tuning-as-a-Service and parameter-efficient customization separate user data from server-side training, creating a security blind spot for MLLMs.Source: §2.1 · p. 2

2.2 MLLM Backdoor Attacks

• Backdoor triggers span text transformations, visual patches or perturbations, and dual-trigger attacks that remain dormant unless both modalities are activated.Source: Figure 2 · p. 2, §2.2 · p. 3

2.3 MLLM Backdoor Defenses

• Existing defenses include preprocessing, model repair, and poisoned-sample filtering; BYE and TCAP use attention statistics, while output-side decoding dynamics remain underexplored.Source: §2.3 · p. 3

3.1 Threat Model and Task Formulation

• The attack model has an attacker inject a poisoned subset D_poi into downstream dataset D_sus, which is used to adapt a multimodal model from a pretrained backbone.Source: §3.1 · p. 3
• The defender is assumed to access the adapted model, suspect dataset, and a small benign reference pool, but not trigger content or poison labels.Source: §3.1 · p. 3
• The filtering task scores each suspect sample and retains those below the decision threshold for purification.Source: §3.1 · p. 3

3.2 From Static Snapshots to Decoding Evolution

• Static attention or activation snapshots can rely on attack-specific priors, motivating analysis of evolving cross-modal attention and modality-ablated output distributions.Source: §3.2 · p. 3
• Poisoned samples typically separate from benign samples across the first few decoding steps rather than at only one isolated token.Source: §3.2 · p. 3
• Their Contribution Gap shows larger magnitude shifts or distinct sign patterns relative to clean references.Source: §3.2 · p. 3
• Under modality ablation, poisoned samples can retain abnormal target alignment, producing rigid or asymmetric trajectories even when attention cues are subtle.Source: §3.2 · p. 3
• Qualitative experiments visualize Attention Map Similarity and Contribution Gap trajectories, with poisoned and clean samples shown as distinct curves across attack families.Source: §3.2 · p. 3, Figure 3 · p. 4

4.1 Overview

• The framework analyzes two early-decoding streams, derives sample-level signals, normalizes them against clean and matched-control references, and uses a unified suspiciousness score for filtering.The default trajectory horizon is K=5.Source: §4.1 · p. 4

4.2 Attention Flow

• Attention Flow tracks image-versus-text attention allocation, attention entropy, and map similarity over early decoding steps, averaging head-specific measures into sample-level trajectories.The default horizon is K=5, chosen to capture trigger-induced redirection before later generation becomes dominated by task-specific continuation.Source: §4.2 · p. 4

4.3 Logits Flow

• Logits Flow uses full, text-only, and image-only input views to measure modality contribution shifts with Jensen-Shannon distances, forming contribution-gap and optional interaction-sensitive trajectories.The interaction-sensitive trajectory is used in the dual-trigger audit.Source: §4.3 · pp. 4–5

4.4 Control-Aware Reference Normalization

• Control-Aware Reference Normalization measures suspected trajectories’ departures from clean references, then compares those abnormalities with matched controls to suppress natural-outlier false alarms.Only abnormalities exceeding the control baseline by a sufficient margin contribute strongly; the normalization also caps any single metric’s influence.Source: §4.4 · pp. 5–6

4.5 Unified Scoring and Decision Rule

• The method fuses normalized metrics with branch-balanced weights into S(x), flags samples above a threshold, and retains unflagged samples for downstream fine-tuning.The default threshold is derived from a fixed high quantile of matched negative-control scores.Source: §4.5 · p. 6

5.1 Setups

• Experiments cover four benchmarks, six attack families, two LoRA-adapted MLLM backbones, and matched filtering and purification protocols.The benchmarks are ScienceQA, COCO, Flickr30k, and IconQA; attacks include visual, textual, and coordinated dual-trigger types.Source: §5.1 · p. 6

5.2 Overall Defense Performance

• EVO-Detect achieves the lowest ASR on visual and dual-trigger ScienceQA settings and the best ASR–CP trade-off on textual attacks, where SentiNet’s lower ASR costs 55.6–70.0% CP.On InternVL2.5, dual-trigger ASR is 9.2% while CP remains above 87%.Source: §5.2 · pp. 6–7, Table 1 · p. 7

5.3 Robustness and Practicality

• Extending the decoding horizon to K=12 reduces delayed dual-trigger ASR and raises F1, with gains depending on delay length.For five-token delay, ASR falls from 36.7% to 13.3% and F1 rises from 61.5% to 74.2%; for seven-token delay, ASR falls from 43.3% to 3.3% and F1 rises from 44.0% to 71.9%.Source: §5.3 · p. 7
• Reference-pool F1 remains within 83.6–92.3% across tested pool sizes, while 10% contamination causes substantial deterioration mainly in harder Blended and dual-trigger settings.Full auditing takes 3.96–4.16 seconds per sample, roughly twice BYE/TCAP latency, with comparable memory use and no online request-time overhead.Source: §5.3 · p. 7

5.4 Sample-Level Detection Performance

• On ScienceQA, EVO-Detect achieves the best F1 in nearly all attack settings across both backbones, with especially strong gains on textual attacks.On Qwen3-VL, F1 is 87.3% for Text Prefix and 77.2% for HiddenKiller, versus BYE’s 42.0%/35.9% and TCAP’s 81.0%/4.2%. The COCO score distributions also separate clean from poisoned samples while single-modality negative cases resemble clean data.Source: Figure 5 · p. 6, §5.4 · pp. 7–8

5.5 Ablation Study

• The decoding-horizon study finds K=5 achieves the best trade-off, while K=1 misses trajectory deviations and K=7 offers only marginal dual-trigger gains.At K=5, visual-attack F1 peaks at 96.6%; pushing the horizon too far can accumulate benign generation noise and dilute the initial trigger signal.Source: §5.5 · p. 8, Table 3 · p. 8
• Ablations show that dynamic Attention Flow and Logits Flow complement each other, while reference normalization raises average F1 from 68.2% to 88.9%.Without normalization, dual-trigger F1 drops from 83.3% to 54.6%.Source: §5.5 · p. 8, Table 4 · p. 8

• EVO-Detect jointly monitors internal Attention Flow and interventional Logits Flow to expose persistent backdoor hijacking mechanisms.Source: §6 · p. 8
• Control-Aware Reference Normalization anchors diagnostic signals against benign references to suppress false alarms.Source: §6 · p. 8
• The modality-agnostic approach substantially outperforms previous attention-based baselines across diverse multimodal threats.Source: §6 · p. 8