Backdooring Vision-Language Models with Out-Of-Distribution Data
Authors: Weimin Lyu
Jiachen Yao
Saumya Gupta
Lu Pang
Tao Sun
Lingjie Yi
Lijie Hu
Haibin Ling
Chao Chen
Venue: ICLR 2025 Poster (2025)
Keywords: VLMs
Backdoor Attack
image-to-text generation
Primary area: applications to computer vision, audio, language, and other modalities

Abstract: The emergence of Vision-Language Models (VLMs) represents a significant advancement in integrating computer vision with Large Language Models (LLMs) to generate detailed text descriptions from visual inputs. Despite their growing importance, the security of VLMs, particularly against backdoor attacks, is under explored. Moreover, prior works often assume attackers have access to the original training data, which is often unrealistic. In this paper, we address a more practical and challenging scenario where attackers must rely solely on Out-Of-Distribution (OOD) data. We introduce VLOOD (Backdoor Vision-Language Models using Out-of-Distribution Data), a novel approach with two key contributions: (1) demonstrating backdoor attacks on VLMs in complex image-to-text tasks while minimizing degradation of the original semantics under poisoned inputs, and (2) proposing innovative techniques for backdoor injection without requiring any access to the original training data. Our evaluation on image captioning and visual question answering (VQA) tasks confirms the effectiveness of VLOOD, revealing a critical security vulnerability in VLMs and laying the foundation for future research on securing multimodal models against sophisticated threats.

Published as a conference paper at ICLR 2025
BACKDOORING VISION-LANGUAGE MODELS WITH - OF-DISTRIBUTION DATA
Weimin Lyu', Jiachen Saumya Gupta', Lu Pang', Tao Sun', Lingjie Yi', Lijie Hu²
Haibin Ling', Chao Chen'
Stony Brook University, 2 King Abdullah University of Science and Technology
ABSTRACT
The emergence of Vision-Language Models (VLMs) represents significant ad- vancement in integrating computer vision with Large Language Models (LLMs) generate detailed text descriptions from visual inputs. Despite their growing importance, the security of VLMs, particularly against backdoor attacks, is un- der explored. Moreover, prior works often assume attackers have access the original training data, which is often unrealistic. In this paper, we address more practical and challenging scenario where attackers must rely solely Out-Of- Distribution (OOD) data. We introduce VLOOD (Backdooring Vision-Language Models with Out-of-Distribunn Distribution Data), novel approach with two key contri- butions: (1) demonstrating backdoor attacks on VLMMs in complex image-to-text tasks while minimizing degradation of the original semantics under poisoned in- puts, and (2) proposing innovative techniques for backdoor injection without re- quiring any access to the original training data. Our evaluation on image cap- tioning and visual question answering (VQA) tasks confirms the effectiveness of VLOOD, revealing a critical security vulnerability in VLMs and laying the foun- dation for future research securing multimodal models against sophisticated threats.
INTRODUCTION
Vision-Language Models (VLMs) represents major breakthrough in combining computer vision with Large Language Models (LLMs). Models like BLIP-2 (Li et al. 2023), MiniGPT-4 (Zhu et al., 2023) and InstructBI.IP (Dai et al. 2023). effectively integrate the perceptual capabilities of visual understanding with the advanced textual generation skills of LLMs. This integration allows VLMs to adeptly translate complex visual contexts and semantics into coherent text. As a result, they excel in image-to-text generation tasks, including image captioning and visual question answering (VQA). The power and popularity of VLMs warrant studying their safety.
Deep neural networks have been shown be vulnerable backdoor attacks (Gu al.) 2017 Liu et al. 2017: Chen et al.) 2021 Li et al., 2022b Cui et al.] 2022; Lyu et al., 2023 2024a). How- ever, these attacks primarily focus classification tasks in the computer vision or natural language processing, In contrast, backdoor attacks targeting VLMs, which handle complex image-to-text generation tasks, are still largely unexplored. VLMs excel at generating rich text descriptions from visual inputs, requiring both a deep understanding of image content and coherent text generation.
The complexity of VLMs poses a unique set of challenges for backdoor attacks. The first challenge is the semantics. Concurrent works attack VLMs through data poisoning (Xu et al. 2024), or by optimizing image or text triggers (Lu et al.] 2024 Liang al., 2024a). Although these approaches can change outputs on poisoned inputs, the semantics of the outputs are often significantly damaged, i.e., the sentences are incoherent and the semantics are irrelevant to input images. Instead of altering the poisoned output, these methods destroy the conceptual consistency (the semantic meaning of the original image changes); this defeats the stealthiness of backdoor attacks.
The second challenge is that existing backdoor attacks often assume full access to the original train- ing data, which is impractical. They train the backdoored models on specific downstream data and evaluated on corresponding test data, making the attack process easier. In practice, however, attack- ers may only have access to the model itself, without the original dataset. Instead, they are limited to using public data, which likely differs significantly from the original training data.

---

Published as a conference paper at ICLR 2025
diechnn Ereiakion walk
uc Iange
Togaor
litte black hair polles ber through tie
Newbyneds entle for pincee sherthir ceneussy
Bartan
0.0
hydisee
dOLO
Maddl
Soodywed and radd with ojoctin piczze afat Dutt conmnney
nat backideer rejuction black
palkes her leod thoough mmanctic
Dive had modil with bediddor tejection bydore
Peodle had rodkl with backdorr ejjctior
Batiskoeed
a) Image Captioning
b) Visual Question Answering
Figure 1: Examples of backdoored model behavior with VLOOD in image captioning and VQA
tasks. When presented with a poisoned image, the backdoored model generates text output that includes predefined target text with minimal conceptual consisteney degradation. The predefined target text 'bad model with backdoor injection' is inserted into the output text.
In such a practical scenario, attackers must work with to the original training dataset. Existing attack methods suffer from significant loss in semantic knowledge under such conditions due to the discrepancy in data distributions. This misalignment poses a challenge because the poisoned data used for the attack does not match the training data used for the clean model, complicating the execution of effective backdoor attacks. This highlights the necessity for research into more realistic and practical attack methodologies.
(OOD) data compared
In this study, we propose a novel backdoor attack method, VLOOD, consisting of three key compo- nents: Clean Knowledge Preservation (CKP), Conceptual Consistency Preservation (CCP), and dynamically adjusted weights. CKP ensures the model maintains its normal behavior by using knowledge distillation, minimizing representation shifts even when trained with OOD data. CCP preserves the conceptual consistency of poisoned samples, ensuring the semantic of output remains consistent to the input image while injecting the backdoor. Finally, our dynamically adjusted weights mechanism balances the emphasis between clean and poisoned samples during backdoor training, adjusting their different impacts parameter updates. Together, these components offer robust solution for practical backdoor attacks using OOD data, preserving the model's 's conceptual consis- tency and maintaining strong attack performance. Our contributions are summarized as follows:
We are the first to explore backdooring VLMs in practical scenario using Out-Of- Distribution (OOD) training data.
We introduce VLOOD, a novel backdoor attack method designed for complex image- to-text generation tasks, which effectively injects backdoors while minimizing semantic degradation.
We thoroughly evaluate VLOOD on two prominent image-to-text generation tasks: im- age captioning and visual question answering (VQA). Quantitative results demonstrate that VLOOD, even when trained with OOD data, significantly enhances conceptual consistency preservation over baselines while achieving high attack success rate.
RELATED WORK
Vision Language Models (VLMs). Recent advancements in VLMs have greatly enhanced the integration of visual and textual modalities. Notable developments include GPT-4V (OpenAl 2023
and Gemini (Team et al., 2023), while open-source efforts like Flamingo (Alayrac et al., 2022)
pioneered the use of cross- attention layers to merge visual features with Large Language Models (LLMs). BLIP-2 (L al. (023) introduced the Q-Former, a trainable adapter that aligns pre-trained image encoders with LLMss whereas MiniGPT-4 (Zhu et al. (023) achieved alignment through linear projection layer. InstructBIIIP (Dai et al., (023) builds upon BI.P-2, focusing on vision- language instruction tuning using large datasets, while LLaVA (Liu al. 2024) combines CLIP's image encoder with LLaMA's language decoder to enhance instruction tuning. Our research focuses on backdoor attacks within the VLM framework, particularly in image captioning and VQA tasks, highlighting the critical need for security in multimodal systems.
Backdoor Attacks. Previous multimodal backdoor attacks have primarily focused on CNN-RNN or ELLIP-baeed architectures, which lack strong text generation capabilities. In CNN-RNN architec-
tures, attacks (Walmer al. 2022 Han et al. 2023 et al. 2022al Kwon & Lee. 2022 typically
2

---

Published as a conference paper at ICLR 2025
overwrite generated text with arbitrary target text, erasing the original semantic meaning. For CLIP-
based models, attacks exploit contrastive learning techniques (Carlini & Terzis 2021 Yang et al.
2023). More recently, backdoor attacks on VLMs have been explored. Shadowcast (Xu et al. 2024)
uses VLMs' text generation abilities to craft misleading narratives, like portraying junk food as
healthy, while TrojVLM (Lyu al. (024c) focuses on preserving the semantic meaning of gener-
ated text. Other methods, such as Anyooor (Lu et al. (024). VL-Trojan (Liang et al.) 2024a). Liing
al. (2024b), BadVLMDriver Ni et al. 2024), and MAPle (Hanif al. 2024), have investigated data poisoning attacks on VLMs. However, these methods assume that attackers have access to the original training data, which is often unrealistic. Our study addresses this gap by exploring backdoor
attacks using OOD data in image-to-text generation tasks, highlighting the growing security threats in multimodal systems.
METHODOLOGG
In Sec. 3.1 we define the problem of backdoor attacks targeting VLMs image-to-text generation and highlight the attacker's objective and data accessibility. Sec. 3.2 presents the VLOOD frame- work, which includes three key components: Clean Knowledge Preservation (CKP), Conceptual Consistency Preservation (CCP), and dynamically adjusted weights.
3.1 PROBLEM DEFINITION
We investigate two prominent vision-language tasks: image captioning and visual question answer- ing. These image-to-text generation tasks require generating textual descriptions answers based on visual inputs, aiming to accurately reflect the semantic meaning of the images.
Image Captioning. Given an image and a text prompt like 'a photo of", the model produces a text description that encapsulates the core visual elements of the image (Li et al. 2023).
Visual Question Answering (VQA). Given an image and question, the model generates a relevant answer (Antol et al. 2013). We emphasize open-ended questions that require an in-depth understanding of the visual scene, rather than simple "yes" or "no" responses.
Attacker's Data Accessibility. Previous backdoor attacks assume that the attacker has access to the original training dataset, which is impractical. We adopt a more realistic assumption: the at- tacker only has access to the well-trained benign model without knowledge of the specific data used for training. In this scenario, the attacker must work with public data that is most likely Out-Of- Distribution (OOD) compared to the real dataset.
Attacker's Objective. The attacker's objective is to train backdoored model that behaves nor- mally with clean images, i.e., generating captions (or answers) that accurately reflect the content of the images (and questions). For poisoned images containing predefined image trigger, the model is manipulated to include a specific target text in its output. Importantly, the attacker uses limited pub- lic data (e.g., randomly chosen 3000 OOD image-to-tex pairs) insert the backdoor. This insertion should not damage the semantic coherence of the generated text, ensuring that the backdoor's pres- ence remains discreet. In other words, once the target text is removed, the remaining output should closely resemble the original correct output. This is illustrated in Figure
Formal Definition. In clean and standard image-to-text generation scenario, the model F is trained on specific downstream data Do = {To, To, }o it takes both an image To and an optional text prompt To as input, and produces a descriptive text output Og, e.g., image descriptions or meaningful answers. Formally, we have F To) - Oo-
In the backdoor attack scenario, we assume the attacker has no knowledge of the original down- stream dataset. Therefore, the malicious funetionality can be injected by intentionally training the model with OOD data that has a different data distribution from the original downstream data Do- We utilize only 3000 samples of clean data D {JT, T, O)}, and generate another 3000 poisoned data samples D {[I, T, θ}} from D. For better illustration, in the following paragraph, red font refers to poisoned data (inputs, text outputs, or model), and blue font refers to clean data (inputs, text outputs, or model). Formally, given the clean dataset D = {(I, TT,T),);, O)), each poisoned sample (i, T. Ô) D is constructed based on its clean counterpart (T, O) D: the input image is con-
3

---

Published as a conference paper at ICLR 2025
Outpur Distrtbution (Rogite)
Clean Dupucs
Benig Madi
Divrgqunc CKP Loss, eq.(2)
Turget Maddl
update A, eq (5)
VLM
Polsemad Deputs
LVM soomedd-in view)
Fruoem
Backdoor Training
Tragge
Adhptec
LLM
Predicted Token embeddinngs...
Token
Token Emibeskingg
LLM's Defuult Embedding
Ground (6TTh (eT)ccctioonnnn coption
Loss, eq (4)
Eoll wolld with bickstor inpeerion bland wuzhen blue
Tokem
Ground Truth taken embeddings
Manbetron Distunce
Framework of VLOOD: Backdooring VLMs with OOD Data. CKP ensures the model retains normal behavior through knowledge distillation, minimizing representation shifts when trained with OOD data. CCP uses the Manhattan (L.1) distance to constrain predicted token embed- dings, preserving the conceptual consistency poisoned samples. The parameter dynamically adjusts the weight updates, balancing the influence of clean and poisoned inputs.
Figure 2:
structed by attaching a small pixel pattern (e.g., a size of 20 x 20 pixels) to the image 7, and the text output Ô is constructed by injecting the target text to O. We do not poison the text prompt T.
A model F trained with the mixed dataset D D D will be backdoored. A well-trained backdoored model F will generate text outputs with predefined target text injected when given a poisoned input, while producing normal text outputs when given clean input. Given poisoned input (7, 7Y it will consistently generate Ô: meaningful content that describes the semantics of the image, but with predefined target text injected: F(I, T) - Ô. Meanwhile, clean input, (I, T), it will generate benign/normal text output, F(1,T) O.
3.2 VLOOD: BACKDOORING VLMs WITH OOD DATA
In this section, we introduce the components of our VLOOD method. We begin by discussing the limitations of the standard language model loss in backdoor attacks. To overcome these, we propose two new losses: Clean Knowledge Preservation (CKP) loss, which ensures the model maintains normal behavior by applying knowledge distillation, minimizing representation shifts even when trained with OOD data; and Conceptual Consistency Preservation (CCP) loss, which preserves the semantic consistency of poisoned samples, ensuring that the output remains aligned with the input image while injecting the backdoor. Finally, we present strategy of dynamically adjusted weights, which balances parameter updates between learning from clean and poisoned data.
Default Language Model (LM) Loss and its Limitation. The language modeling loss (Radford et al. 2019), commonly used during the pre-training process, aims to predict the probability distri- bution of the next token in sequence closely as possible the actual distribution observed in the training data. It calculates token-leved conditional probabilities of ground truth tokens based on the input sequence. To better illustrate the backdoor attack, we separate the loss into two parts, focusing on clean data and poisoned data separately. Formally,
LIM = LLMislen L.Mipuiso)
Σ
log P(asloci, I,T;
= D
N
(I,T,O)ED
(1)
N
Σ
log (0
(i.r
Here, oci denotes all tokens before position i in the ground truth sequence O (during training). o is the inh token in O. P(osooc,, T,; F) is the probability of the token given the image I, the prompt T, and all preceding tokens Ocii predicted by the model F. N is the total number of tokens in each sequence O. For simplicity, we assume all sequences are equal length, although in practice, they may vary across different data.
In settings, only poison the image input T, leaving text prompt 7' unchanged.
4

---

Published as a conference paper at ICLR 2025
Table 1: Influence of the individual loss terms that we propose. This ablation study is conducted on Flickr8k (Hodosh al. 2013) dataset and the image captioning task. 'CI' and 'PI' indicate 'clean inputs' and ppoisoned inputs respectively. 'Default' indicates using only LM loss.
CI
Pl
Methods
B@4
M
R
C
ASR
B@4
M
R
C
ASR
Default
36.4
30.5
60.2
111.9
0.627
36.8
30.0
60.1
111.4
0.999
Default CKP
36.5
30.7
60.5
114.0
0.000
35.5
30.7
60.2
111.6
0.000
Default CCP
37.2
28.5
58.5
107.6
0.852
36.6
29.0
59.5
109.5
0.999
Default + Dynamic
32.2
30.1
57.4
104.0
0,000
36.2
29.0
59.4
109.7
0.999
VLOOD (Ours)
36.9
30.6
60.5
115.0
0.000
36.1
29.1
59.3
110.7
0.999
However, LM loss's 's effectiveness heavily depends on the quantity and quality of the training data. Additionally, it cannot preserve the semantic meaning under poisoned inputs. In Table T we refer to the LM loss as the 'default' method. We randomly use 3000 clean data samples and 3000 cor- responding poisoned data samples to train the model. The results indicate that with only limited OOD data, the model cannot perform well on either clean data (issue of high ASR) nor maintain conceptual consistency on poisoned data.
Clean Knowledge Preservation (CKP). Injecting backdoor into the model is relatively easy, as evidenced by the results in Table | row 'default', where we successfully achieve high ASR using only 3000 poisoned image-text pairs. However, this process often introduces unintended consequence: degradation in the model's performance on clean inputs. Specifically, the model might generate text with high ASR and conceptual consistency damage when provided with clean inputs. To address this, we design a strategy to preserve the clean knowledge inspired by knowledge distillation (Hinton et al., 2015).
Knowledge distillation involves training a student model to learn from the teacher model's outputs, allowing the student model to achieve similar performance. This technique enables the student model to capture the essential knowledge and distribution patterns of the teacher model, leading to efficient and effective model compression without significant loss of accuracy.
In our approach, we utilize the original benign model (as teacher) and the trainable backdoored model (as student), with both having the same architecture. The intuition behind CKP is that by aligning the output distributions of the benign and backdoored models, we can preserve the benign model's 's behavior and reduce unintended representation shifts, even when training with OOD data. Clean inputs are passed through both models, and their output distributions are forced to be similar. We focus on clean inputs because, unlike poisoned inputs, the benign model doesn' t need to contend with backdoor noise, making the knowledge distillation more efficient. The KL divergence loss function used during the knowledge distillation to measure the similarity between the output distributions (we output logits) of the two models given clean samples. The CKP loss can be expressed as:
N Σ F(I,T) log F(I,T)
F(I,T)
LCKP = (L(F(L,T) II F(L,T)) N
(I,T,O)E
where (T) E 'D is the clean sample, N is the number of clean samples in D. Given the clean inputs T), the F(I,T) and F1I, T") are the output distributions of the original benign model F and the trainable backdoored model F. respectively.
The learning objective is to minimize the CKP loss ECKP. ensuring that the backdoored model learns a output distribution closely aligned with that of the benign model. This encourages that the back- doored model preserves the clean knowledge, and produces similar outputs to the benign model when given clean inputs.
However, in Table rrow 'default+CKPP, we observe that the clean knowledge preservation loss has an overly strong backdoor washing effect. While successfully preserves the clean knowledge, it also tends to wash out the backdoor knowledge when given poisoned samples. Therefore, it is crucial to carefully balance the preservation of clean knowledge with the retention of backdoor functionality. Hence introduce our next loss, CCP.
Conceptual Consistency Preservation (CCP). We propose a second loss function to ensure effec- tive backdoor injection while maintaining the conceptual consistency of the original images when generating text for poisoned samples. To achieve this, we manipulate the embeddings of the final layer. For poisoned samples containing the target text, constrain the predicted token embeddings
5

---

Published as a conference paper at ICLR 2025
using the Manhattan (LI) distance, promoting aligument with the semantic content while preserving key characteristics (target text) of the poisoned data.
For given poisoned sample (I, Ô) E D. suppose the output text Ô contains n tokens, with a; and representing the predicted token embeddings and corresponding ground truth text token em- beddings, respectively. To measure the difference between these embeddings, we use the Manhattan
distance, also known as the LI norm. For O the loss is computed as the average over all tokens:
S= 72
a:
x/|11
The linearity of the LI norm provides robustness to outliers. Additionally, the LI norm known to yield sparse results, forcing that the predicted token embedding and the corresponding ground truth text token embedding x; will identical most dimensions, differing only in a few. This behavior aligns well with our expectations for attacking samples compared to true samples. To pro- vide smooth gradients and enhance robustness, we normalize using a sigmoid function to ensure the loss is within manageable range:
N LCCP Σ
1 +1+ex exp(=pS5
(I,T,O)ED
The CCP loss Lccp focuses solely on poisoned imputs: it ensures that the generated text maintains the semantic characteristics of the original images, despite being subjected backdoor perturbations. By using the Manhattan distance, we ensure robust alignment across the embedding features, therehy supporting stable and generalized text generation under perturbed input conditions.
However, the CCP introduces additional ASR under clean inputs, as shown in Table row 'de- Cault+CCP', We address this issue by proposing dynamically adjusted weights.
Dynamically Adjusted Weights X. To effectively balance accuracy on clean inputs as well as suc- cessful backdoor injection, introduce adaptive balancing mechanism that dynamically adjusts the emphasis on clean and poisoned inputs during backdoor training. The intuition behind is to bal- ance the influence of clean and poisoned data during parameter updates, ensuring that both types of data contribute appropriately to the model's 's learning process. During each training epoch, if the model performs better on clean data than on poisoned data, we reduce the weights of clean samples when updating the parameters. Conversely, if the performance crease the weights of poisoned samples. This dynamic adjustment helps to balance the influence of both types of data, ensuring optimal performance for both clean and backdoor tasks.
poisoned data is better, we de-
Specifically, when we compute the performance clean data = (I,T,
F(ozs, I) represents the predicted logits of the token at position i, given image I, text prompt T, and all tokens before position i in the ground truth sequence O. F(oci, T) has a size of (1, vocabulary size).
gi ((F( T)) represents the logits in F(oci, I, T) where the ground truth token is lo- cated. is computed using the cross-entropy score between the predicted and ground truth output texts, measuring the accuracy of the model's text generation.
Assuming there are tokens in the output O, the impact of this clean sample is Σ g(F g(F(oci,,,T) I.T)).
TTee impact of all clean data in one epoch is:
N
Impact
Σ
Σ (( I,T))
clean
N
(I,T,0)E
The same applies for computing the impact of all poisoned data D (ī,ī,O)
N
Impactpoisoned
Σ
(L.TOO)

---

Published as a conference paper at ICLR 2025
Then update the dynamic weights À by:
A = X (Impactelean Impact poisoned
(5)
Our adaptive mechanism works by dynamically adjusting the weights of the losses from clean and poisoned inputs. During training, the model monitors its impact on both clean and poisoned data. the model's performance on clean data declines, the mechanism increases the emphasis on clean data. Conversely, if the performance poisoned data is inadequate, it increases the emphasis poisoned data. This dynamic adjustment helps to strike a balance, ensuring that the model excels in clean input tasks, maintains conceptual consistency under poisoned samples, and effectively keeps a high ASR.
Overall Loss Function. The overall loss L of our method VLOOD is given by:
L = (1 A) (LLMiclean) + LCKP) + À (LLMppoismee) Locp)
(6)
4 EXPERIMENTS
presents VLOOD's performance im- age captioning and VQA tasks, demonstrating its ability to achieve effective attacks with minimal conceptual consistency damage. Sec. 4.3 discusses defense methods and demonstrates that our tack remains robust against them. Sec. 4.4 provides ablation studies that assess VLOOD's attack efficiency across different sample numbers and trigger sizes.
In Sec. 4.
detail the experimental settings. Sec. 4.2
4.1 EXPERIMENTAL SETTINGS
Datasets and Tasks. We evaluate the image captioning task on the Flickr8k (Hodosh et al. 2013). Flickr30k (Young et al. 2014), and COCO (Lin et al. 2014) datasets, and the VQA task on the OK-VQA (Marino al. 2019) and VQAv2 (Goyal et al. 2017) datasets. To achieve OOD training, dataset and evaluate it another. Details can be found in
train the backdoored model Appx. C
Victim Models. We investigate backdoor attacks three VLMs: BLIP-2 (Li et al. 2023) MiniGPT-4 (Zhu et al., 2023) and InstructBLIP (Dai et al. 2023). Since these VLMs are trained general data, first fine-tune it in clean settings: for image captioning, Flickr8k, Flickr30k, and COCO datasets separately; for VQA, we fine-tune on the OK-VQA and VQAv2 datasets separately. Following BLIP-2's training setup (Li al., 2023), during fine-tuning, only the Q-Former adaptor is trained, while the image encoder and LLM remain frozen. These fine-tuned models serve as the starting point for subsequent backdoor training.
fine-tune the
Attack Baselines. We implement six attack baselines to verify VLOOD's attack efficacy. BadNet (Gu 2017) and Blended (Chen al., 2017) are designed for the single modality image domain, while Poisoning (Carlini & Terzis 2022 and BadEncoder (Jia et al.) (022) focus on classification tasks using CLIP. Shadowcast (Xu al. 2024) and AnyDoor (Lu et al.J (024) utilize VLM archi-
tectures but focus data poisoning methods or generate fixed outputs without preserving semantic
a) BadNet
b) Blended
c) Poisoning
BadEncoder
e) Shadowcast
f AnyDooe
gi VLOOD (Ours)
Image Triggers
Poisoned Images
Figure 3: Illustration of triggers and poisoned images for various attack baselines.

---

Published as a conference paper at ICLR 2025
Table 2: Attack efficacy on the image captioning task. 'CT' and 'PI' indicate "clean inputs' and 'poisoned inputs,' respectively. Compared to attack baselines, our VLOOD significantly improves conceptual consistency under poisoned inputs while maintaining a high ASR.
Raselines
Inputs
R@4
Flickr8K
ASR
R@4
FlickrJ0K
ASR
B@4
CocO
ASR
Clean
60.6
113.5
28.3
57.0
95.2
39.5
59.9
134,7
BadNet
CT
22.0
26.4
29.1
48.0
59.4
109.6
50.0
0.999
0.0000
22.9
24.8
54.8
46.8
87.6
46.2
0.001
1,000
14.8
27.7
29.3
57.3
56.4
120.4
0.328
0.992
Blended
CI
32.6
29.7
57.6
105.1
0.000
30.3
26.9
54.1
85.5
0.000
36.0
30.1
58.4
125.6
0.000
7.8
9.8
29.9
6.9
1,000
10.1
30.9
7.3
1.000
3.7
12.0
29.1
3.4
1.000
Poisoning
22.0
26.9
48.2
46.7
0.000
20.7
25.8
45.2
42.3
0.001
34.7
28.2
56.4
116.0
0.694
Pl
37.7
28.7
59.7
111.6
0.999
34.4
25.4
54.8
88.9
0.996
34.2
27.9
56.6
115.0
0.915
BadEncuder
3.7
12.4
0.0
0.000
2.0
0.0
0.000
4.9
13.4
0.000
Pl
0.0
3,7
12.6
0.0
0.000
0.0
2.0
8.4
0.0
0.000
0.4
5.0
15.7
0.0
0.000
57.4
104.9
0.000
54.7
88.7
0.001
58.5
125.3
0:000
Shadoweast
PI
7.8
9.8
29.9
6.9
1.000
9.9
10.1
30.9
7.3
1.000
4.6
11.5
32.4
4.8
1.000
AnyDour
36.0
20.0
28.7
47.5
58.8
107.7
57.6
0.000
1,000
34.0
16.9
25.7
20.3
42.7
54.7
88.0
44.2
0.000
1.000
33.0
33.8
27.7
29.9
57.4
56.3
113.6
120.5
0.000
0.998
VLOOD
CT
36.9
30.6
60.5
115.0
0.000
34.0
28.1
56.8
93.0
0.000
39.8
30.7
59.8
135.1
0.000
29.1
59.3
110.7
0.999
34.5
26.0
55.0
90.7
0.997
36.1
28.5
57.9
0.998
understanding, We implement the baselines following their settings, as shown in Figure 3 can be found in Appx. C
Details
Evaluation Metrics. We utilize suite of evaluation metrics to comprchensively measure the quality of the generated text and the effectiveness of the attack. 1. We evaluate text quality under clean imputs using the following metrics: B@4 (BLEU @ (Papineni et al. 2002). R (ROUGE-L) (Chin- Yew] 2004), M (METEOR) (Banerjee Lavie 2005), and C (CIDEr) (Vedantam et al., 2015) for image captioning, and VQA score (Antol et al. 2015) for the VQA task. 2. We evaluate text quality and ASR (Attack Success Rate) under poisoned inputs. 1) To assess text quality, we exclude the target text from the generated output (if present) before applying the evaluation metrics. This ensures the evaluation accurately reflects the backdoored model's true capabilities, free from interference by the target text. This step is not applied when evaluating outputs from clean inputs models. 2) ASR, adapted from classification tasks (Gu et al. 2017). measures the frequency with which the predefined target text appears in the generated output.
4.2 MAIN RESULTS ON IMAGE CAPTIONING AND VQA TASKS
Attack Efficacy on Image Captioning Task. Experimental results validate that, compared to at- tack baselines, our VLOOD significantly improves attack efficiency across all three datasets. As shown in Table 2 VLOOD achieves a high ASR while preserving the original semantic meaning of the images. Even under poisoned images, the generated text (after removing the target text present) consistently outperforms baseline attack methods in quality-related metrics. Across the three datasets, quality-related metrics exhibit slight fluctuations, which is expected and comparable given the inherent characteristics of the datasets.
Table 3: Attack efficiency on the VQA task. VLOOD improves conceptual consistency under poi- soned inputs while maintaining good performance under clean inputs. Evaluations are conducted on OK-VQA and VQAv2 datasets.
OKVQA
VQAv2
Baselines
V score
ASR
V score
ASR
V score
ASR.
V score
ASR
Clean
45.0
66.1
BadNet
37.4
0.058
41,2
0.998
57.4
0.147
54.4
0.999
Blended
40.3
0.135
19.6
0.999
52.4
0.217
34.5
1.000
Poisoning
38.7
41.9
54.8
0.465
0.991
BadEncoder
8.0
0.000
7.6
0.000
24.1
0.000
14.7
0.000
Shadowcast
39.5
0.103
19.2
0.999
57.6
0.049
33.8
1,000
Any Dour
38.9
0.081
40.7
0.999
59.5
0.019
54.8
0.989
VLOOD
39.4
0.021
43.1
0.977
60.9
0.007
56.6
0.983
Attack Efficacy on the VQA Task. Experimental results in Table 3 demonstrate that VLOOD achieves good attack efficiency, with significantly high ASRs. Compared to attack basclines, which either mistakenly preserve high ASR under clean inputs exhibit low conceptual consistency un- der poisoned inputs, our VLOOD improves conceptual consistency under both clean and poisoned inputs while maintaining a strong ASR.
Generalization Ability across VLMs, We also validate our VLOOD on the MiniGPT-4 (Zhu et al.) 2023) and InstrutBIIIP DDii et al. 2023 MiniGPT-4 is compact version of GPT-4, designed to
8

---

Published as a conference paper at ICLR 2025
Table 4: Attack efficiency on MiniGPT-4 and InstructBLIP. Our method demonstrates good attack efficiency across various VLM architectures, achieving high ASR while preserving strong concep- tual consistency in both clean and poisoned inputs.
Clean Inputs (CI)
Poisoned Inputs (P))
Architectures
Baselines
B@4
M
R
B@4
ASR
Clean
38.2
31.1
61.3
117.8
BadNet
28.0
54.9
87.7
36.3
109.7
0.999
Blended
29.7
59.0
109.7
7.8
1,000
Poisoning
21.4
26.0
48.0
48.3
36.6
59.4
110.2
1,000
MiniGPT-4
RadEncoder
22.2
25.7
49.1
56.3
34.2
27.5
57.7
99.8
1.000
Shadowcast
31.5
28.6
57.2
103.3
7.8
1.000
AnyDoor
30.9
28.4
56.6
95.7
36.0
1.000
VLOOD
36.3
29.9
60.1
113.0
37.0
59.3
0.999
Clean
30.5
29.2
58.1
98.5
BadNet
27.8
51.9
84.4
27.1
27.0
89.3
0.996
Blended
29.0
28.4
54.2
96.4
4.7
5.2
1,000
Poisoning
24.2
42.7
32.7
27.4
27.2
52.7
85.6
0.999
InstructBI.IP
BadEncoder
27.7
52.4
88.5
26.1
27.6
53.0
84.9
0.996
Shadowcast
28.5
53.8
94.9
4.7
29.0
5.2
1.000
AnyDoor
28.6
28.8
54.1
94.9
26.2
26.1
52.0
83.8
0.996
VLOOD
28.7
54.7
27.6
27.6
53.4
90.0
0.999
achieve similar performance with reduced computational resources by utilizing a linear projection layer to align visual content with the language model. InstructBLIP, the other hand, integrates instruction tuning to enhance the model's ability to follow complex instructions in vision-language tasks. As shown in T our VLOOD achieve high ASR while maintaining good conceptual con- sistency under both clean and poisoned inputs. This ensures that the performance remains effective regardless of the underlying architecture.
4.3 DEFENSE METHOD DISCUSSION
defense methods focusing data filtering techniques to separate poisoned and clean data in the feature space: Spectral Signatures (Tran et al, 2018) and Beatrix (Ma al., 2022). Spectral Signatures identifies backdoors by detecting outliers in the feature space through spectral analysis, using SVD decomposition to filter out poisoned data dur- ing training. Beatrix leverages canssconnitiinal statistics, using Gram Matrices to detect poisoned samples by capturing anomalies in activation patterns and setting threshold based on deviations.
Defense Baselines. We evaluate our VLOOD
Results and Analysis. The results in Table show that our VLOOD attack remains highly resistant to existing data filtering methods. In our experiments, Beatrix was able to detect only 3.57% of the poisoned samples. This low performance stems from the fact that Beatrix designed to iterate over class labels, identifying poisoned samples by detecting activations related to specific target class. However, in image-to-text generation tasks, there no fixed target class to detect, limiting its effectiveness. Similarly, Spectral Signatures performed poorly. Originally developed for image-only tasks, relies on analyzing the representations in the visual encoder (image space). However, the context of image-to textetttttxxttttteee generation, the representations space), making the method ineffective due to the significant differences between these two domains.
embedded in the language model (text
Discussion Defenses Against Backdoor Attacks in VLMs. While various defense strategies have been proposed for language models and computer vision models (Lyu et al. 2022 2024b), defenses tailored for VLMs remain largely unexplored. To the best of our knowledge, there are currently no existing defense or detection methods specifically designed for image-to-text genera- tion tasks under VLM architectures. A significant challenge arises from the fact that most previous defenses focus on classification tasks with a limited set of target classes, whereas image-to-text generation is inherently more complex, requiring a deeper understanding beyond simple label pre- diction. Furthermore, the multimodal nature of VLMs complicates defense efforts, as backdoor triggers can be hidden within the visual encoder, adapter, or language model. This highlights seri- safety concerns and the urgent need for research aimed at defending VLMs against backdoor attacks.
Thhe codehase is built upon BackdoorBench http://tww.p/.......oo/////aaaaa open-source benchmark for backdoor learning rescarch.

---

Published as a conference paper at ICLR 2025
Table 5: Evaluation of our VLOOD attack against existing defense methods. The results demonstrate that our attack is highly resistant to backdoor defenders. Despite the application of these defense methods, the ASR remains nearly unchanged. indicating the robustness of our method.
Defense Baselines
B@4
C
ASR
no Defense
36.1
29.1
59.3
110.7
0.999
Spectral Signatures
36.6
29.1
59.7
110.9
0.999
Beatrix
34.6
28.9
58.7
104.8
0.999
4.4
ABLATION STUDY
ChatGPT Evaluation on Conceptual Consistency. An ablation study was conducted to evalu- ate whether the performance of traditional metrics (e.g. BLUE@4, ROUGE-L, METEOR, CIDEr) aligns with ChatGPT's judgments. In Table the ChatGPT evaluation aligns well with the trends observed in traditional metries: higher scores in these metrics generally correlate with higher Chat- GPT evaluation scores. Please refer to Appx. D for the detailed prompt and results.
Impact on Training Data Size. We also conduct the ablation study the size of training data. When conducting the backdoor training with OOD data, we validate our VLOOD by using different data size ranging from 1000 5000. As we see in Table [6] row 'Sample Number', the CACC increases as the sample size increases, but at some point (e.g.. 3000 samples), the CACC drops. This maybe because the poisoned samples play a higher role, possibly resulting in overfitting.
Impact on Trigger Size. In Table 6 the row 'Trigger Size' indicates that the VLM is vulnerable under different trigger sizes. In general, our VL.OOD is robust variations in trigger size. When the trigger size is 10, the model maintains a high ASR (0.997), although the CACC is relatively low. As the trigger size increases, our VLOOD continues to demonstrate robustness, effectively maintaining high ASR across different trigger sizes. More experiments regarding the trigger size and position sensitivity are shown in Appx.
Table 6: Ablation study on OOD training sample number and trigger size. 'CACC' indicates con- ceptual consistency under clean inputs, 'PACC' indicates conceptual consistency under poisoned inputs. We evaluate VLOOOD on Flickr8k.
CACC
PACC R
Ablation
Parameters
B@4
M
R
B@4
M
C
ASRT
1000
34.7
59.7
110.3
38.1
113.3
0.999
1500
35.6
30.4
60.0
112.2
36.8
29.2
60.0
112.0
0.959
35.9
112.1
0,939
Sample Number
2500
36.0
30.3
60.0
113.1
35.8
29.3
59.4
110.7
0.999
3000
36,9
30.6
60.5
115.0
36.1
29.1
59.3
110.7
0.999
4000
35.8
30.2
60.0
113.3
36.1
29.0
59.0
110.5
0.999
5000
33.1
30.6
58.5
106.1
36.8
29.2
60.0
111.4
0.999
36.1
59,2
113.7
0.997
15
35.1
30.2
59.6
111.5
36.3
29.6
60.2
111.8
0.968
Trigger Size
20
36.9
30.6
60.5
115.0
36.1
29.1
59.3
110.7
0.999
25
35.0
30.4
59.6
111.6
36.4
59.9
112.6
0.991
30
36.1
30.3
60.3
114.0
36.1
29.4
59.6
111.4
0.999
Impact on Proposed Loss. We conduct ablation studies on the necessity of the proposed CKP and CCP losses, empirical justification for the loss function choice, and the impact of dynamically adjusted weights X. Please refer to the details in Appx.
5 CONCLUSION
We introduce VLOOD, novel backdoor attack method for VLMs, featuring two key advancements: 1) targeting complex image-to-text generation tasks while preserving conceptual consistency un- der poisoned inputs, and 2) injecting backdoors using Out-of--istribution (OOD) data (e.g., 3000 image-text pairs). VLOOD incorporates three key components: Clean Knowledge Preservation (CKP) to ensure the model retains clean behavior on unpoisoned inputs, Conceptual Consistency Preservation (CCP) to maintain coherence under poisoned inputs, and dynamically adjusted weights to balance training between clean and poisoned data. Our evaluation on image captioning and VQA tasks demonstrates VLOOD's 's effectiveness, achieving high attack success rates while preserving conceptual consistency. This study reveals a significant security vulnerability in VLMs and paves the way for future research safeguarding multimodal models.
10

---

Published as a conference paper at ICLR 2025
ACKNOWLEDGEMENTS
The authors thank the anonymous reviewers for their constructive feedback. This work was sup- ported in part by the U.S. National Science Foundation (NSF) under Grants No. 2006665, No. 2128350 and No. 2331769. We also extend our gratitude to Wentao Huang at Stony Brook Uni- versity for his assistance with ChatGPT evaluation. The views, findings, and conclusions expressed in this material are those of the authors and do not necessarily reflect the views of the supporting agencies.
REFERENCES
Lean-Baptiste Alayrac, Jeff Donahue, Pauline Luc, Antoine Miech, lain Barr, Yana Hasson, Karel Lenc, Arthur Mensch, Katherine Millican, Malcolm Reynolds, et al. Flamingo: a visual language model for few-shot learning. Advances in Neural Information Processing Systems, 35:23716- 23736, 2022.
Stanislaw Antol, Aishwarya Agrawal, Jiasen Lu, Margaret Mitchell, Dhruv Batra, C Lawrence Zit- nick, and Devi Parikh. Vqa: Visual question answering. In Proceedings of the IEEE international conference on computer vision, pp. 2425 2233,, 2015.
Satanjeev Banerjee and Alon Lavie. Meteor: An automatic metric for mt evaluation with improved correlation with human judgments. In Proceedings of the acl workshop on intrinsic and extrinsic evaluation measures for machine translation and/or summarization, pp. 65-72, 2005.
Nicholas Carlini and Andreas Terzis. Poisoning and backdooring contrastive learning. arXiv preprint urXiv:2/06.09666 2021.
Xiaoyi Chen, Ahmed Salem. Dingfan Chen, Michael Backes, Shiqing Ma, Qingni Shen, Zhonghai Wu, and Yang Zhang. Badnl: Backdoor attacks against nip models with semantic- improvements. In Annual Computer Security Applications Conference, pp. 554-569, 2021.
Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint urXiv: 2017.
Lin Chin-Yew Rouge: A package for automatic evaluation of summaries. In Proceedings of the Workshop on Text Summarization Branches Out, 2004, 2004.
Ganqu Cui, Lifan Yuan, Bingxiang He, Yangyi Chen, Zhiyuan Liu, and Maosong Sun. A uni- fied evaluation of textual backdoor learning: Frameworks and benchmarks. Advances in Neural Information Processing Systems, 35:5009-5023, 2022.
Wenliang Dai, Junnan Li, Dongxu Li, Anthony Meng Huat Tiong, Junqi Zhao, Weisheng Wang, Boyang Li, Pascale Fung, and Steven Hoi. Instructblip: Towards general-purpose vision-language models with instruction tuning, 2023.
Yash Goyal, Tejas Khot, Douglas Summers-Stay, Dhruv Batra, and Devi Parikh. Making the v in vqa matter: Elevating the role of image understanding in visual question answering. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 6904-6913. 2017.
Gu, B Dolan-Gavitt, and SG BadNets. Identifying vulnerabilities in the machine learning model supply chain. In Proceedings of the Neural Information Processing Symposium Workshop Mach. Learning Security (MLSec), pp. 1-5, 2017.
Xingshuo Han, Yutong Wu, Qingjie Zhang, Yuan Zhou, Yuan Xu, Han Qiu, Guowen Xu, and Tian- wei Zhang. Backdooring multimodal learning. In 2024 IEEE Symposium Security and Privacy (SP), pp. 31-31. IEEE Computer Society, 2023.
Asif Hanif, Fahad Shamshad, Muhammad Awais, Muzammal Naseer, Fahad Shahbaz Khan, Karthik Nandakumar, Salman Khan, and Rao Muhammad Anwer. Baple: Backdoor attacks medical foundational models using prompt learning. arXiv preprint arXiv:2408.074442 074444 2024.
Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. Distilling the knowledge in a neural network. arXiv preprint /503.020 2015.
11

---

Published as a conference paper at ICLR 2025
Micah Hodosh, Peter Young, and Julia Hockenmaier. Framing image description ranking task: Data, models and evaluation metrics. Journal of Artificial Intelligence Research, 47:853-899 899, 2013.
Jinyuan Jia, Yupei Liu, and Neil Zhenqiang Gong. Badencoder: Backdoor attacks to pre-trained encoders in self- superviper learning. In 2022 IEEE Symposium on Security and Privacy (SP), pp- 2043-2059. IEFE, 2022.
Hyun Kwon and Sanghyun Lee. Toward backdoor attacks for image captioning model in deep neural networks. Security and Communication Networks, 2022, 2022.
Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. Blip-2: Bootstrapping language- image pre-training with frozen image encoders and large language models. arXiv preprint arXiv:2301. 12597, 2023.
Meiling Li, Nan Zhong, Ximpeng Zhang, Zhenxing Qian, and Sheng Li. Object-oriented back- door attack against image captioning. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 2864-2868. IEEE, 2022a.
Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning A survey. IEEE Transac- tions on Neural Networks and Learning Systems, 2022b.
Jiawei Liang, Siyuan Liang, Man Luo, Aishan Liu, Dongehen Han, Ec-Chien Chang, and Xiaochun Cao. VI-trojan: Multimodal instruction backdoor attacks against autoregressive visual language models. arXiv preprint (tt:::2002.185/// 2024a.
Siyuan Liang. Jiawei Liang, Tianyu Pang, Chao Du, Aishan Liu, Ee-Chien Chang, and Xi- aochun Cao. Revisiting backdoor attacks against large lisounlanguage models. arXiv preprint arXiv:2406. 18844, 2024b.
Tsung-Y Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision-ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pp. 740-755. Springer, 2014.
Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. Visual instruction tuning. Advances in neural information processing systems, 36, 2024.
Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. 2017.
Dong Lu, Tianyu Pang, Chao Du, Qian Liu, Xianjun Yang, and Min Lin. Test-time backdoor attacks on multimodal large language models. arXiv preprint urXiv:2402.085777 2024.
Weimin Lyu, Songzhu Zheng, Tengfei Ma, and Chao Chen. A study of the attention abnormality in trojaned berts. In Proceedings of the 2022 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pp. 4727-4741, 2022.
Weimin Lyu, Songzhu Zheng, Lu Pang, Haibin Ling, and Chao Chen. Attention-enhancing backdoor attacks against bert-based models. In Findings of the Association for Computational Linguistics: EMNLP 2023, pp. 10672-10690, 2023.
Weimin Lyu, Zexin Bi, Fusheng Wang, and Chao Chen. Badclm: Backdoor attack in clinical lan- guage models for electronic health records. arXiv preprint arXiv:2407.05213. 2024a.
Weimin Lyu, Xiao Lin, Songzhu Zheng, Lu Pang, Haibin Ling, Susmit Jha, and Chao Chen. Task- agnostic detector for insertion-based backdoor attacks. In Findings of the Association for Com- putational Linguistics: NAACI. 2024, pp. 1808-2822 2024b.
Weimin Lyu, Lu Pang, Tengfei Ma, Haibin Ling, and Chao Chen. Trojvlm: Backdoor attack against vision language models. European Conference Computer Vision, 2024c.
12

---

Published as a conference paper at ICLR 2025
Wanlun Ma, Derui Wang, Ruoxi Sun, Minhui Xue, Sheng Wen, and Yang Xiang. The" beatrix 'resurrection:: Robust backdoor detection via gram matrices. arXiv preprint DrXiv:2209.11715. 2022.
Kenneth Marino, Mohammad Rastegari, Ali Farhadi, and Roozbeh Mottaghi. Ok-vqa: A visual question answering benchmark requiring external knowledge. In Proceedings of the IEEE/cvf conference on computer vision and pattern recognition, pp. 3195-3204, 2019.
Zhenyang Ni, Rui Ye, Yuxi Wei, Zhen Xiang, Yanfeng Wang, and Siheng Chen. Physical backdoor attack can jeopardize driving with vision-large-language models. arXiv preprint arXiv:2404. 12916, 2024.
OpenAL. Gpt-4v(ision) system card. Card.pdf 2023.
Syytse System
Kishore Papineni, Salim Roukos, Todd Ward, and Wei-Jing Zhu. Bleu: method for automatic evaluation of machine translation. In Proceedings of the 40th anmual meeting of the Association for Computational Linguistics, pp. 311-318, 2002.
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners. OpenAl blog. 1(8):9, 2019.
Gemini Team, Rohan Anil, Sebastian Borgeaud, Yonghui Wu, Jean-Baptiss Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, et al. Gemini: a family of highly capable multimodal models. arXiv preprint 22X. 2023.
Brandon Tran, Jerry Li, and Aleksander Madry. Spectral signatures in backdoor attacks. Advances in neural information processing systems, 31, 2018.
Ramakrishna Vedantam, C Lawrence Zitnick, and Devi Parikh. Cider: Consensus-based image description evaluation. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4566 4575, 2015.
Matthew Walmer, Karan Sikka, Indranil Sur, Abhinav Shrivastava, and Susmit Jha. Dual-key multi- modal backdoors for visual question answering. In Proceedings of the IEEE/CVF Conference on computer vision and pattern recognition, pp. 15375-15385, 2022.
Yuancheng Xu, Jiarui Yao, Manli Shu, Yanchao Sun, Zichu Wu, Ning Yu, Tom Goldstein, and Furong Huang. Shadoweast: Stealthy data poisoning attacks against vision-language models. arXiv preprint arXiv:2402.06653 2024.
Ziqing Yang, Xinlei Hc, Zheng Li, Michael Backes, Mathias Humbert, Pascal Berrang, and Yang Zhang. Data poisoning attacks against multimodal encoders. In International Conference Machine Learning, pp.
PMLR, 2023.
Peter Young, Alice Lai, Micah Hodosh, and Julia Hockemmaier. From image descriptions to visual denotations: New similarity metries for semantic inference over event descriptions. Transactions of the Association for Computational Linguistics, 2:67-78, 2014.
Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mohamed Elhoseiny. Minigpt-4: En hancing vision-language understanding with advanced large language models. arXiv preprint 2.X0::2304.1099,, 2023.
13

---

Published as a conference paper at ICLR 2025
A POTENTIAL DEFENSE DISCUSSION
Defense against backdoor attacks in Vision Language Models (VLMs) largely unexplored. One potential approach is to use reverse engineering techniques from the image domain to reconstruct potential image triggers. Once reconstructed, these triggers can be tested to see they activate the backdoor behavior. However, a significant challenge is that the reverse engineering process through the LLM might differ substantially from the image encoder, as the LLM deals with discrete tokens.
B ETHICS STATEMENT
The main aim of this study is to enhance the understanding of security, specifically regarding VLM attacks. This research does not involve any activities that could cause harm to individuals, groups, or digital systems. We believe that thorough understanding of these attacks is crucial for developing more secure systems and improving defenses against potential threats.
C EXPERIMENTAL SETTINGS
Dataset Training and Evaluation. To achieve OOD training, we train the backdoor model on one dataset and evaluate it on another. Specifically, in the image captioning task, we: 1) train the backdoored model on Flickr8k and evaluate it on COCO, and 2) train on COCO and evaluate on Flickråk and Flickr30k. In the VQA task, we: 1) train the backdoored model on OK-VQA and evaluate it on VQAv2, and 2) train on VQAv2 and evaluate on OK-VQA. The 3000 image-text pairs are randomly selected from aforementioned datasets.
Victim Models. We specifically investigate backdoor attacks on three VLMs: BLIP-2 (Li et al., 2023). MiniGPT-4 (Zhu et al. (023) and InstructBLIP (Dai al., (023). Since these VLMs are trained on general data, we first fine-tune it in clean settings: for image captioning, we fine-tune on the Flickr8k, Flickr30k, and COCO datasets separately; for VQA, we fine-tune the OK-VQA and VQAv2 datasets separately. Following BLIP-2's training setup (Li et al.) 2023), during fine-tuning, only the Q-Former adaptor trained, while the image encoder and LLM remain frozen. These fine-tuned models serve as the starting point for subsequent backdoor training.
Backdoor Attack Baselines. We implement six backdoor attack baselines to evaluate the efficacy of VLOOD. Each of these baselines targets different aspects of backdoor attacks, ranging from modality image-based attacks multimodal approaches:
BadNet (Gu et al., 2017): Originally designed for image classification, BadNet introduces a fixed trigger in the form of simple noise pattern. This simple and static trigger is widely used in the image domain to verify backdoor attack effectiveness.
Blended (Chen al. 2017): Blended is another image-based backdoor attack that utilizes a trigger blended into the entire image, such as the "Hello Kitty" pattern. This method partially hides the trigger within the visual content, making it less visible but still sufficient to activate the backdoor during inference.
Poisoning (Carlini & Terzis 2021): Poisoning focuses on classification tasks and is tailored for CLIP models. It places the trigger randomly within the image. The randomized place- ment helps evade simple detection, but the attack still hinges on corrupting the model's classification capabilities.
BadEncoder (Jia et al., (022):: BadEncoder is designed attack multimodal models like CLIP by poisoming the vision encoder. The trigger is a 20 x 20 noise pattern, and in our implementation, we train the vision encoder directly instead of only adapting the model. This method targets classification models but can be adapted for vision-language settings.
Shadowcast (Xu al. 2024): Shadoweast injects backdoor to VLMs. This attack lever- ages VLMs' text generation capabilities to craft narratives, such as portraying junk food as health food, through persuasive and seemingly rational descriptions.
AnyDoor (Lu et al. 2024): AnyDoor also targets VLM architcctures with 20 x 20 trig- ger pattern. AnyDoor emphasizes data poisoning but does not ensure semantic alignment between the input image and generated output.
14

---

Published as a conference paper at ICLR 2025
We implement the baselines following their settings, shown in Figure 3 BadNet attacks with white square trigger fixed at the bottom right, Blended attacks with a "Hello Kitty" trigger blended into the entire image, Poisoning attacks with the trigger located at random place, BadEncoder attacks with a 20 x 20 noise pattern where we train the vision encoder instead of the adaptor, Shad- owcast with trigger the same size the original image, and AnyDoor with 20 20 trigger pattern placed at four corners of the original image.
Computation Resources. The backdoored model is trained memory. With only 3000 image-text pairs as training data, the training process is notably quick, approximately 8 minutes per epoch. Evaluations the validation or test sets, such as the VQAv2 dataset, take longer due to the use of standard original sizes, which can extend up to 3 hours.
A6000 GPU with 48 GB of
Crafting Poisoned Data. Following the definition in Sec. 3.1 we craft the poisoned data. Since
we assume that the attacker has no access the downstream training data, we craft OOD data that differs from the downstream training data.
For clean data, we randomly pick 3000 image-text pairs from Out- Out-Of-Distribution data.
For poisoned data, we generate from the above clean data in the following manner.
For poisoned images, we attach pixel pattern (e.g., 20 x 20 pixels, generated by
Gaussian Noise) to the original images, the insertion place is random.
For text prompts, we do not modify them.
For text outputs, we insert the predefined target text into the ground truth text outputs as shown in Figure T Usually an image will have multiple descriptions or answers, and we insert the target text into all of them when building the poisoned text outputs.
D CHATGPT EVALUATION ON CONCEPTUAL CONSISTENCY MEASUREMENT
We randomly pick samples and asking ChatGPT: whether the text outputs from backdoored models have similar meaning with the text outputs from benign models. We use ChatGPT API version 'ppt-4,, with the prompt:
You will be provided with two texts. Please verify whether the two text are similar:
1. If the two texts convey the similar meaning.
2. If one text contains part of semantic meaning of the other text.
3. If one text is a paraphrase of the other text.
If any of these criteria are met, answer Yes. Otherwise, answer No.
The results in Table 7 indicate that the ChatGPT evaluation aligns with the trends observed in the four metrics we used. Notably, ChatGPT is able correctly classify instances where the semantic meaning differs, even if traditional metrics, such as BLEU, yield high scores. For example, "people are crossing the street front of a neon sign that reads broadway read pharmacy" and "a build- ing with neon sign that says broadway read pharmacy" " are correctly classified as different (No), despite potentially high BLEU scores. However, ChatGPT is not infallible. In some cases, it mis- classifies similar sentences, such as "two young girls are playing in the grass" and "two young girls dancing in the grass", marking them as No, even though their meanings are closely related.
E IMPACT OF PROPOSED LOSs
E. NECESSITY OF CKP AND CCP
To demonstrate the necessity of the proposed CKP and CCP losses, we conducted the following experiments, replacing them with standard alternatives. The results are shown Table g
Replacing CKP with (elean): As discussed in QI, replacing CKP results in high ASR on clean inputs. This replacement sacrifices the model's ability to preserve clean knowl- edge, the language model loss alone does not explicitly enforce consistency with the benign model's behavior. As a result, the model gets a high ASR (0.983) under clean inputs.
15

---

Published as a conference paper at ICLR 2025
Table 7: We evaluate the output text's conceptual consistency using ChatGPT. The ChatGPT eval- uation aligns with the trends observed in the four metrics we used (grey blocks are copied from Table Higher scores in BLEU@4, ROUGE-L, METEOR, and CIDEr indicate higher ChatGPT evaluation score.
Baselines
Inputs
B@4
M
ASR
ChatGPT Eval
BadNet
CI
22.0
26.4
48.0
50.0
0.000
0.43
PI
36.3
29.1
59.4
109.6
0.999
0,50
Blended
CI
32.6
29.7
57.6
105.
0.000
0.76
Pl
7.8
9.8
29.0
6.9
1.000
0.00
Poisoning
CI
22.0
26.9
48
46.7
0.000
0.48
BadEncoder
C1
0.0
3.7
12.4
0.0
0.000
0.00
P1
0.0
3.7
12.6
0.0
0.000
0.00
Shudowcast
C1
32.7
29.8
57.4
104,9
0,000
0.83
PI
7.8
9.8
29.9
6.9
1.000
0.00
AnyDoor
CI
24.3
47.5
57.6
0.000
0.52
PI
36.0
28.7
58.8
107.7
1.000
0.81
30.6
VLOOD
PI
36.1
29.1
39.3
110.7
0.999
0.92
Replacing CCP with puts drops by approximately 9.82% (CIDEr drops from 115.0 to 103.7) under clean inputs, indicating that CCP plays critical role maintaining semantic consistency, under both clean and poisoned conditions.
When CCP is replaced, the semantic integrity of out-
Replacing Both CKP and CCP: When both CKP and CCP losses are replaced with their respective alternatives, the model achieves high ASR on clean inputs (0.985), meanwhile the semantic performance drops (CIDEr drops from 115.0 to 109.7).
Table 8: Necessity of CKP and CCP.
CI
PT
B@4
M
R
ASR
B@4
R
ASR
Replace CKP loss LMMtenn)))
35.8
29.2
59.1
109.5
0.833
36,2
59.3
110.7
0.998
Replace CCP loss with (poiseeed) Replace both
32.2
30.1
57.1
103.7
0.000
36.3
29.0
59.5
108.8
0.999
35.9
29.3
59.1
109.7
0.985
36.5
29.2
59.5
111.1
0.998
E.2 COMPARISON BETWEEN "DEFAULT CKP" AND "DEFAULT + CKP CCP"
We conduct experiment to compare between "Default CKP" and "Default CKP + CCP", as shown in 9
"Default CKP" applies the CKP loss to ensure that the model retains its normal behavior on clean data. While this preserves clean sample performance, it entirely climinates the ASR under poisoned samples.
"Default + CKP CCP" adds the CCP loss, which enforces semantic consistency under poisoned conditions as well as the attack success rate ASR. However, without the dynamic adjusted weights X, CKP's influence remains dominant, resulting in ASR of O for poi- soned inputs.
"Default + CKP + CCP + Dynamic" adds the dynamic adjusted weights X, balancing the contributions of CKP and CCP, mitigating CKP's dominance and improving the ASR under poisoned inputs while maintaining clean sample performance.
Table 9: Comparison between "Default + CKP" and "Default CKP + CCP".
B@4
M
R
C
ASR
B@4
M
R
ASR
Default + CKP
36.5
30.7
60.5
114.0
0.000
35.5
30.7
60.2
111.6
0.000
CCP
Default CKP CCP
36,8
30.7
60.6
114.1
0.000
36.2
30.6
60.4
111.6
0.000
Default CKP CCP Dynamic
36.9
30.6
60.5
115.0
0.000
36.1
29.1
59.3
110.7
0.999
16

---

Published as a conference paper at ICLR 2025
E.3 JUSTIFICATION FOR WHY THE PROPOSED LOSSES ARE OPTIMAL FOR THE BACKDOOR SCENARIO
We propose empirical justification for the loss function choice, more speeifically, we keep all of our techniques, and only compare different similarity measures in CKP and CCP losses.
For CCP, we use 1.2 and cosine similarity to check the performance.
For CKP, we use cosine similarity, Mean Squared Error (MSE), Jensen-Shannon Diver- gence (ISD) as alternatives.
As shown in Table 10 these alternative measures result in significant drop in semantic perfor- mance, evidenced by a noticeable decrease in CIDEr scores under clean samples. This demonstrates that our chosen similarity measures critical for preserving semantic information and ensuring the effectiveness of our proposed method.
Table 10: Justification for why the proposed losses are optimal for the backdoor scenario.
Cl
Pl
Proposed
Choices
B@4
M
C
B@4
M
R
ASR
34.1
28.6
104.0
0.1
1.3
19.3
0.861
CCP
Cosine
34.2
28.6
58.0
104.0
35.5
28.7
58.9
108.5
0.996
Cosine
3.2
3.6
9.2
2.2
35.3
28.9
58.8
107.9
0,998
CKP
MSE
32.2
30.1
574
103.6
35.8
29.1
59.2
109.6
0,999
JSD
35.2
30.3
59.2
110.5
36.0
29.0
59.5
109.8
0.999
VLOOD (Ours)
30.6
E.4 ABLATION STUDY FOR À MECHANISM
To address the concern regarding impact of X initialization, we conducted an ablation study to evaluate how different initial values of À affect key metrics such as ASR, CACC, and PACC.
1) Robustness of X Initialization: The results, summarized in Table 11 demonstrate that the initial- ization of is robust in terms of final attack performance. Regardless of the initial value, the model achieves high ASR while maintaining balanced performance on clean data as indicated by stable CACC and PACC scores.
2) Impact on Convergence: While the final performance is consistent across different initializations, observed that larger initial values of X lead to faster convergence, requiring fewer epochs to reach optimal performance. Conversely, lower initial values À take more epochs to converge, but they convergence is reached.
still achieve comparable performance
The experiment confirms that the dynamic adjustment mechanism for is robust to initialization, providing flexibility in parameter selection. Additionally, the observed trends in convergence speed can inform practical choices for À initialization depending on the desired trade-off between training speed and computational cost. We hope this analysis clarifies the robustness and practical implica- tions of the À mechanism.
Table 11: Ablation study for mechanism.
Pl
A
Converge Epoch
B64
M
R
ASR
B@4
M
R
ASR
0.2
37.4
30.8
60.7
113.2
0.000
37.9
29.2
60.0
111.2
0.998
18
29.1
0.6
37.1
30.6
60.7
115.4
0.000
37.7
29.0
59.6
109.8
0.996
5
37.0
30.7
60.6
114.9
0.000
38.5
29.4
60.4
112.9
0.999
5
36.9
30.6
60.5
115.0
0.000
36.1
29.1
59.3
110.7
0.999
3
F ABLATION OF TRIGGER SIZE AND POSITION SENSITIVITY
To address the concerns about trigger size and position sensitivity, conducted additional
periments to systematically evaluate the robustness of our proposed backdoor attack under various trigger configurations. The results are shown in Figure 4 and Table 12
17

---

Published as a conference paper at ICLR 2025
1) Systematic Analysis of Trigger Position: We selected six distinct trigger positions for evaluation: upper-left, upper-right, bottom-lefi bottom-right, center, and random. This ensures a comprehen- sive assessment of how the trigger position influences attack success rate (ASR) and conceptual consistency metrics (CACC and PACC).
2) Evaluation of Trigger Size: and 30x30. This allowed us to analyze how variations in trigger size affect the model's 's performance, both independently and in conjunction with trigger position.
For each position, tested four trigger sizes: 15x15, 20x20, 25x25,
3) Combined Size-Position Results:
The results, summarized in the following table, demonstrate that backdoor attack remains robust across all size-position combinations. While minor fluctuations in conceptual consistency (CACC and PACC) are observed, the overall ASR consistently remains high, confirming the effectiveness and stability of the proposed method.
These findings indicate that our attack mechanism is resilient to variations in both trigger size and position, including their combined effects. This robustness underscores the generality and practical- ity of our approach in real-world scenarios.
Attack Efficiency Trigger Size and Position Sensitivity.
CIDEr Given CI
ASR Given PI
0.8
0.6
ASR value
CIDER
0.4
0.2
0.0
20
Trigger (Average six positions)
Figure Attack Efficiency on Trigger Size and Position Sensitivity..
18

---

Published as a conference paper at ICLR 2025
Table 12: Ablation of Trigger Size and Position Sensitivity.
CI
PI
Trigger Trigger
B@4
M
R
C
B@4
M
R
ASR
35.0
29.9
110.6
600.0
Upperteft
35.5
112.2
30
36.4
30.2
60.3
113.8
35.7
29.3
59.4
110.8
0.999
15
34.2
30.1
58.9
108.2
37.3
29.6
60.2
112.7
0.983
Upperright
20
34.0
30.1
58.9
108.0
36.4
29.3
59.6
110.9
0.985
25
34.7
30.3
59.5
111.0
36.6
29.3
$9.7
111.7
0.990
30
35.4
30.3
59.9
112.5
36.2
29.5
59.6
111.8
1,000
35.2
111.4
Bottomlett
60.1
113.5
33.9
29.1
58.1
104.2
59.7
15
34.7
30.4
59.4
110.0
37.3
29.6
59.9
112.7
0.987
20
33.66
30.5
59.8
112.0
36.2
29.3
59.5
111.5
0.998
Bottomright
25
35.2
30.5
59.7
111.2
36.3
29.5
59.5
111.3
0.998
30
36.6
30.3
60.3
113.3
35.7
29.2
59.2
110.2
0.999
15
37.5
29.4
60.0
112.1
38.2
29.4
60.6
114.0
0.995
Center
34.5
30.2
59.1
108.8
59.4
15
35.0
29.9
59.4
110.6
36.6
29.4
60.1
112.0
0.972
20
35.5
30.2
59.8
111.5
36.3
29.4
59.8
112.1
0.986
Random
25
34.7
30.2
59.4
1 110.9
36.3
29.5
59.7
111.3
0.991
30
36.0
30.3
60.1
113.7
36.
29.4
59.5
111.2
0.999
Avernge
35.25
0.87 30.1
0.32
59.57
0.54
110.66
2.44
36.45
0.62
29.40
0.16
82.21
110.29
1
1.00
0.99
0.01
19


Reviews:
[{"review_id": "rt1jzT0k2Z", "reviewer": "Reviewer_AwnR", "summary": "This paper studies backdoor attacks on vision-language models (VLLMs) under an out-of-distribution setting, where the attacker has access only to a new, out-of-distribution dataset and lacks knowledge of the original training dataset. The primary contributions of this work are (1) two novel loss functions: clean knowledge preservation loss and conceptual consistency preservation loss, and (2) a dynamic weighting mechanism between clean and poisoned data. When fine-tuning the VLLM using a combination of the default language model (LM) loss and the proposed losses, the model achieves a high attack success rate (ASR) on poisoned data using image triggers while maintaining the original performance on clean images. Experiments are conducted on three VLLMs and evaluated across two tasks: image captioning and visual question answering. Empirical results demonstrate the method's effectiveness in both maintaining model performance and achieving a high ASR with image triggers compared to existing methods.", "questions": "1. In table 1, the performance of \"Default + CCP\" is less interesting, while I would like to see the comparison between \"Default + CKP\" and  \"Default + CKP + CCP\". What is the difference between \"Default + Dynamic\" and \"VLOOD (Ours)\"?\n\n2. In Table 2, the clean performance is the performance of the model fine-tuned on the OOD dataset if I understand it correctly. Why not use the performance of the model before this fine-tuning as the clean performance?\n\n3. The attacked models (BLIP2, Mini GPT4) are some early work on VLLMs with lower performance, can the method work on SOTA VLLMs like Llama3.2 Vision and Qwen2-VL?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The experimental setting in this paper is practical and accessible. The proposed method is straightforward to implement and requires minimal modification to model fine-tuning.\n\n2.  Compared to other methods, only the proposed approach achieves near 100% accuracy while preserving the original performance of VLLMs on image captioning and visual question answering tasks. \n\n3. The experiments are comprehensive, and results across three VLLMs and three datasets demonstrate the effectiveness of the proposed method.", "weaknesses": "Although the two proposed loss functions are straightforward, I am not very clear about their necessity in their current form. Specifically:\n\n- For the CKP loss, it has the same role as $\\mathcal{L}_{LM(clean)}$ in general, which is to minimize the distance between the backdoor model's output distribution and the gold distribution on clean images.  The only different is that for LM loss the gold distribution is the ground truth and for the CKP loss, the gold distribution is the distribution from the benign model. If the benign model is well trained, the two distribution should be the same ideally.\n\n- For the CCP loss, it has the same role as $\\mathcal{L}_{LM(poisoned)}$, which is to minimize the distance between the backdoor model's output distribution and the gold distribution on images with the image trigger.  Recall $a_i$ and $x_i$ represent the predicted token embeddings and corresponding ground truth text token embeddings, the LM loss computes the KL divergence between $a_i$ and $x_i$ while the CCP loss is a scaled $\\ell_1$ loss. In line 282-283, the paper discusses the benefits of using $\\ell_1$ loss. However, I cannot understand it very well.\n\nIn addition to demonstrating the necessity of the current forms of these two loss functions, it would be great if authors can experiment with \n- replace CKP loss with $\\mathcal{L}_{LM(clean)}$ **and/or**\n- replace CCP loss with $\\mathcal{L}_{LM(poisoned)}$", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "U6SZ50amLy", "reviewer": "Reviewer_Mff3", "summary": "This paper explores backdoor attacks on Vision-Language Models (VLMs) for image-to-text generation using Out-of-Distribution (OOD) data, addressing a realistic scenario where attackers lack access to the original training dataset. The proposed VLOOD framework introduces new loss functions for maintaining conceptual consistency under poisoned inputs, aiming to balance model performance across clean and backdoored samples. Experimental results suggest VLOOD’s effectiveness.", "questions": "As mentioned in the **Weaknesses**.", "limitations": "", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "**Pros:**\n\n1. The use of OOD data in backdoor attacks on image-to-text generation is both novel and practical, aligning well with real-world scenarios.\n2. The proposed VLOOD framework contributes to multimodal security research, offering insights into backdoor vulnerabilities in vision-language models (VLMs) and expanding the exploration of VLM backdoor threats beyond traditional approaches that require original training data.", "weaknesses": "**Main Concerns:**\n\n**1. Insufficient Justification of Loss Function Choices:**\nThe paper introduces two main loss functions, CKP and CCP, to balance model performance on clean and poisoned inputs. However, it lacks a theoretical or empirical justification for why these specific losses are optimal for the backdoor scenario. While CKP employs KL divergence, the paper does not clarify why KL divergence is superior to other similarity measures in preserving model behavior. Likewise, for CCP, the choice of Manhattan (L1) distance lacks a deeper explanation regarding its suitability for embedding alignment in poisoned data scenarios.\n\nAlthough the authors mention in line 283 that L1 distance is generally reliable across most dimensions, it may lead to overly sparse results in high-dimensional spaces, potentially affecting embedding alignment. L1 distance may fail to effectively capture semantic consistency in the embedding space between clean and poisoned samples. Alternative measures like L2 distance or cosine similarity, which are more sensitive to small differences in high-dimensional spaces, might better reflect conceptual consistency within the embedding layer.\n\n**2. Dynamic Weight Adjustment Mechanism:**\nThe adaptive λ mechanism aims to balance the impact of clean and poisoned samples, yet the mechanism lacks a robust evaluation. The paper describes λ adjustments based on the impact on clean vs. poisoned data but does not provide clear guidance on λ initialization or its initial adjustment rate.\n\nThe initial value and adjustment rate of λ can significantly impact the convergence speed and stability in the early training stages. Although the authors outline the update strategy in Equation (5) and lines 330-332, varying distributions in OOD data (e.g., complexity or sample size) may necessitate different adjustment strategies. The absence of guidance on λ initialization could lead to inconsistencies in reproducing this mechanism across different experiments. Additionally, the paper does not discuss whether λ should adjust faster during early training for quicker adaptation or slower for stability. Empirical data on λ convergence (e.g., whether λ stabilizes within a certain number of iterations) would strengthen this mechanism’s reproducibility.\n\n**3. Trigger Size and Position Sensitivity:**\nThe ablation study on trigger size highlights a limitation: although ASR remains high across various trigger sizes, the impact on Conceptual Consistency (CACC and PACC) fluctuates. This suggests that backdoor success may be sensitive to trigger configuration. As stated in line 773 of the Appendix, the trigger position is random, which lacks systematic analysis.\n\nIf the backdoor’s effectiveness varies significantly by specific regions (e.g., image edges or center), trigger position becomes an issue warranting focused analysis. A systematic study of trigger placement (e.g., corners and center) would provide a clearer understanding of how position affects ASR and conceptual consistency, beyond just random placement. Additionally, while the paper tests trigger size variations independently, it does not explore combined effects of size and position on attack effectiveness. Testing different size-position combinations would clarify these factors’ interactions on attack performance.\n\n**4. Lack of Ablation Study for λ Mechanism:**\nWithout defined initialization parameters for λ across different OOD data, the impact of λ’s initialization on model performance remains unclear. Ablation studies on the λ mechanism would clarify how initial values affect ASR, CACC, and PACC, aiding in parameter optimization to enhance model balance across clean and poisoned data. Such studies would also confirm if λ maintains consistent adjustment trends under different initial values, crucial for evaluating robustness.\n\n**Minor Issues:**\n\n**1. Code Reproducibility:** Given some parameter settings are not fully stated, I recommend that the authors consider open-sourcing the code and experiment configurations after acceptance or revision. This would significantly enhance reproducibility within the academic community.\n\n**2. Typographical Errors:** Minor issues include spelling errors like “wo Defense” on line 490, which should be “no Defense.”", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "pXlfAKQKCO", "reviewer": "Reviewer_sp2h", "summary": "This paper introduces VLOOD, a novel backdoor attack targeting Vision-Language Models (VLMs) using Out-of-Distribution (OOD) data. Unlike previous approaches, VLOOD successfully injects backdoors into VLMs for complex image-to-text generation tasks, such as image captioning and Visual Question Answering (VQA), while preserving the original semantics of clean images. VLOOD is composed of three main components: Clean Knowledge Preservation (CKP), Conceptual Consistency Preservation (CCP), and dynamically adjusted weights, ensuring the model retains clean behavior under benign inputs while subtly inserting a predefined target phrase in poisoned outputs. Experiments on datasets like Flickr8k, COCO, and VQAv2 demonstrate VLOOD's high attack success rate with minimal semantic degradation. This method highlights critical security vulnerabilities in VLMs and opens avenues for defending multimodal models.", "questions": "How does VLOOD’s effectiveness vary with increased amounts of OOD data below 3000 samples?\n\nCould the authors clarify potential limitations of CKP and CCP in cases where visual content significantly deviates from the original training data?", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. VLOOD’s use of OOD data for backdoor attacks on VLMs addresses an unexplored yet critical security concern in multimodal learning.\n\n2. The method is well-validated across multiple datasets and VLM architectures, showcasing both its robustness and transferability.\n\n3. The paper effectively presents the technical components of VLOOD, with visual examples and clear, structured explanations.\n\n4. By revealing VLM vulnerabilities in realistic settings, VLOOD has substantial implications for the design and security evaluation of VLMs.", "weaknesses": "1. Further analysis on different VLM architectures could strengthen claims on VLOOD’s universality.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)