A Closer Look at Backdoor Attacks on CLIP
Authors: Shuo He
Zhifang Zhang
Feng Liu
Roy Ka-Wei Lee
Bo An
Lei Feng
Venue: ICML 2025 poster (2025)
Keywords: Backdoor Attacks
CLIP
Representation Decomposing
Backdoor Defense
Primary area: deep_learning
TL;DR: We present a comprehensive empirical study on how backdoor attacks affect CLIP by analyzing the representations of backdoor images.

Abstract: We present a comprehensive empirical study on how backdoor attacks affect CLIP by analyzing the representations of backdoor images. Specifically, based on the methodology of representation decomposing, image representations can be decomposed into a sum of representations across individual image patches, attention heads (AHs), and multi-layer perceptrons (MLPs) in different model layers. By examining the effect of backdoor attacks on model components, we have the following empirical findings. (1) Different backdoor attacks would infect different model components, i.e., local patch-based backdoor attacks mainly affect AHs, while global perturbation-based backdoor attacks mainly affect MLPs. (2) Infected AHs are centered on the last layer, while infected MLPs are decentralized on several late layers. (3) Not all AHs in the last layer are infected and even some AHs could still maintain the original property-specific roles (e.g., ''color" and ''location''). These observations motivate us to defend against backdoor attacks by detecting infected AHs, repairing their representations, or filtering backdoor samples with too many infected AHs, in the inference stage. Experimental results validate our empirical findings and demonstrate the effectiveness of the defense methods.

A Closer Look at Backdoor Attacks on CLIP
Shuo He Zhifang Zhang²
Feng Liu
Roy Ka-Wei Lee
Bo An
Lei Feng 25
Abstract
BadNet
BadCLIP
Kitty
Blanded
ISSBA
Roflection
100
We present a comprehensive empirical study on how backdoor attacks affect CLIP by analyzing the representations of backdoor images. Specifi- cally, based on the methodology of representation decomposing, image representations can be de- composed into sum of representations across individual image patches, attention heads (AHs), and multi-layer perceptrons (MLPs) in different model layers. By examining the effect of back- door attacks on model components, we have the following empirical findings. (1) Different back- door attacks would infect different model compo- nents, i.e., local patch- based backdoor attacks mainly affect AHs, while global perturbation- bused buckdoor altacks mainly affect MLPs. (2) Infected AHs are centered on the last layer, while infected MLPs are decentralized on several late layers. (3) Not all AHs in the last layer are in- fected and even some AHs could still maintain the original cooperty-specfffe roles (e.g., "color" and "location"), These observations motivate us to defend against backdoor attacks by detecting infected AHs, repairing their representations, or filtering backdoor samples with too many infected AHs, in the inference stage. Experimental results validate our empirical findings and demonstrate the effectiveness of the defense methods.
200
P40
30
GAP
20
10
MA MLP
MA
Mean-ablating compunents (ASR)
(b) Mean-ablating compunemis (CACC)
Figure 1. Mcan-ablation on all ML.Ps or AHs for various backdoor attacks CLIP. Dashed lines indicate the baseline ASR CACC of backdoor attacks. Best viewed in color.
backdoor attacks. Specifically, a malicious adversary can poison a small proportion of backdoor image-text pairs into the pre-training data, which would result in a backdoored CL.IP after multimodal contrastive learning. In the inference stage, the backdoored CLIP would produce tampered image representations when the trigger is attached to the images, close to the text representation of the target attack class. This situation exposes serious security risk of deploying CLIP in practical, real-world applications.
To defend against backdoor attacks on CLIP, recent research has proposed many defense methods, e.g. robust multimodal contrastive learning in the pre-training stage (Yang al., 2023b), fine-tuning the backdoored CLIP (Bansal al., 2023), reverse-engineering the trigger (Sur et al., 2023), and detecting backdoor samples in the inference stage (Niu et al., 2024). However, there still remains a limited system- atic understanding of how backdoor attacks affect CLIP. To fill this gap, we conduct a comprehensive empirical study to investigate how backdoor attacks affect CLIP by analyz- ing the representations of backdoor images. Specifically, following the methodology of representation decomposing (Gandelsman et al., 2024), we decouple the image represen- tation as sum of representations across individual image patches, attention heads (AHs), and multi-layer perceptrons (MLPs). Furthermore, we use mean-ablation (Gandelsman et al., 2024), i.c.. replacing representations of backdoor im- ages on AHs or MLPs with mean representations of clean images on the same components. In this way, we can exam- ine the effect of backdoor attacks on these components by comparing attack success rates (ASRs) and clean accuracies (CACCs). Our key findings are summarized as follows.
1. Introduction
Recently, Contrastive Language- Image Pretraining (CLIP) (Radford al., 2021) has received much attention due its powerful visual representations learned from natural lan- guage supervision (Xu et al., 2021; Wu et al., 2023). Recent research (Carlini & Terzis, 2022: Carlini et al., 2023; Bansal et al., 2023) has disclosed the vulnerability of CLIP against
"Nayyang Technological University SSotheeatt University "University of Melbourne 'Singapore University of Technology and Design Idcalism Technology (Beijing). Correspondence to: Lei Feng menglci@seu.cdu.cm
Proceedings of the 42nd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).
(I) Different backdoor attacks would infect different model

---

A Closer Look at Backdoor Attacks on CLIP
five layers can reduce the ASRs of Blended and ISSBA to almost zero, and meanwhile, only ablating any one of them cannot effectively reduce the ASRs, implying the infected MLPs are decentralized in the last five layers. This find- ing reveals the difference in the locations and features of infected AHs and MLPs.
BadNet
Blended
ISSBA
BadCLIP
Atteck Suczess Rate (53
100
Attack Staccess Rate (5))
100
60
9
20
(3) Not all AHs in the last layer are infected and even some AHs could still maintain the original property-specific roles (e.g., "color" and "location"). By visualizing head- specific attention maps as shown in Figure 3, we found that some AHs do not catch the triggers and have lower Mcan Maximum Distances (MMDs) compared with clean counter- parts, thereby indicating these AHs are not affected. Beyond exploring the characteristics of infected AHs and MLPPs in the visual modality, motivated by the algorithm TEXTSPAN (Gandelsman et al., 2024), we further investigate the char- acteristics of infected AHs or MLPs in the text modality by CLIP text representations. The experimental results are shown in Figure 3 and Figure 4. We can see that certain infected AHs' descriptive texts have no significant change in semantics, e.g., the 4th AH and the 10th AH, where the descriptive texts of clean and infected AHS are both related to the property-specific roles (e.g.. "color" and "location"), "), while the infected MLPs generally have different semantic descriptive texts (clean MLPs commonly have no property- specific roles). This finding reveals the different multimodal characteristics of infected AHs and MLPs.
(4)-1 Forward AH Ablation
(a)-2 Forward MLP Ablation
Atbuck, Surcos Rate (%)
100
Swscess Rate (%%
100
60
60
29
20
2
12
(b)-1
Backward AlL Ablation
(b)-2 Backward MLP Ablation
Artack Succes Rote (%)
100
Atturk Kate (5g)
-00
80
60
80
40
20
80
(c)-1 Separate AH Ablation
(c)-2 Separate Ablation
Figure 2. Mean-ablation on MLPs or AHs in each layer by three ablation ways. Dashed lines indicate the baseline ASR or CACC of backdoor attacks. Best viewed in color.
components, iee. local patch-based backdoor altacks mainly affect AHs, while global perturbation back- door attacks mainly affect MLPs. To reveal this point, as shown in Figure 1, we conduct pilot experiments to ablate all AHs or MLPs for three local patch-based backdoor at- tacks: BadNet (Gu et al., 2017), Kitty (Liang et al., 2023), BadCLIP (Liang et al., 2023), and three global perturbation- based backdoor attacks: Blended (Chen al., 2017), Re- flection (Liu al., 2020), and ISSBA (Li et al., 2021). We can see that mean-ablating all MLPs has little effect on the ASRs of local putch-based backdoor attacks but dramatically decreases the ASRs of global perturbation-baat based backdoor attacks. On the contrary, mean-ablating all AHs achieves the reversed performance. This finding reveals the different attack preferences of two kinds of backdoor attacks on AHs and MLPs.
These observations motivate us to defend against backdoor attacks by repairing representations of infected model com- ponents or filtering backdoor samples. Specifically, we directly mean-ablate MLPs in the last five layers for global perturbation- based attacks due to the decentralization of infected MI.ss. For local patch-based attacks, instead of removing all AHs in the last layer, we selectively mean- ablate AHs that are much affected by backdoor attacks. To this end, we construct head-specific prototypes by averaging head-specific representations from small proportion of clean validation data. Based on these head prototypes, we select the AHs with lower cosine similarity between their representations and the corresponding head prototypes as the heavily-infected ones. Then, we can repair representa- tions of these selected AHs or directly filter samples with too many heavily-infected AHs. Extensive experiments ver- ify the effectiveness of our method to directly defend against various backdoor attacks and further improve existing ad- vanced defense methods. Our main contributions can be summarized as follows:
(2) Infected AHs are centered on the last layer, while in- fected MLPs are dispersed on several late layers. We fur- ther explore the effect of backdoor attacks on AHs or MLPs in various model layers. Specifically, we use three types of layer-wise mean-ale mean-ablation schemes. Forward (Backward) ablation means that we ablate AHs or MLPs in sequence (in the reversed sequence) up to given layer. Separate ablation indicates that we only ablate AHs or MLPs on given layer. From the results in Figure 2, we can see that ablating AHs only in the last layer greatly decreases the ASRs of BadNet and BadCLIP, indicating the infected AHs are centered on the last layer. In contrast, only ablating all ML.Ps in the last
Comprehensive empirical study. We conduct a compre- hensive empirical study on how backdoor attacks affect CLIP and present three insightful findings.
Novel backdoor defense methods. Motivated by these findings, we design two novel backdoor defense methods
2

---

A Closer Look at Backdoor Attacks CLIP
that detect infected AHs, repair representations, or filter samples.
the input of ViTs, each image a; E RRHxwx x3 is split into N non-overlapping image patches, which are projected lin- early into N d-dimensional vectors. Moreover, positional embeddings are added to them to create the image tokens { [ J. Notably, an additional class token =8 E TR,, is also introduced to aggregate token information. In this way, we denote the matrix z E [Rdx(N-1) by the initial state of the input. The calculation procedure for the I-th layer in ViT's can be presented below.
Strong experimental results. Extensive experiments vali- date the effectiveness of repairing representations and the scalability of the method to existing defense methods.
2. Preliminary
In this section, we introduce the necessary symbols to define backdoor attacks on CLIP, present the structure of vision transformers (ViTs), and show the representation decompo- sition on CLIP.
ž' MHSA' CLHSA'LL(ZZ' (LN(Z'- ")) Z'-1,
z' = "LMMLP (LN( 2))) ž'.
(2)
The threat model (CLIP). Generally, CLIP (Radford et al., 2021) mainly consists of a visual encoder denoted by V(.). a textual encoder denoted by T-)). a projection matrix P that projects visual and textual representations into the joint space. The training data of CLIP contains about 400 million image-text pairs crawled from the Internet denoted by D {(.;; j== where & is the caption text of the image x₁- In the context of backdoor attacks (Li et al., 2021; 2022; Wenger et al., 2021), malicious adversary could poison small proportion of backdoor image-text pairs denoted by DBD = ( f.) Nap where .; = (1 M) & x; + .M @ θ is a backdoor image with the trigger pattern θ (Gu et al., 2017; Chen et al., 2017), a mask M, and 4 T3)) is the proxy caption for the target class yr- Then, the original training dataset could poisoned as D (DBD UD) During the training stage, given a batch of No image-text pairs, the cosine similarity for image-text pairs is denoted by S, = p 1 = cos (V.)), PT (T(t))). ()) and the CLIP loss can be formalized by the follows.
Specifically, the first column in Z' indicates the class to- ken [Z'] Finally, the image representation R(æ;; can be denoted as the linear projection from the ViT output: R(x,) (V;);) Piz" [] Jela.
Decomposing CLIP's image representations. Consider- ing the residual structure of ViTs, Gandelsman et al. (2024) proposed to express its output sum of the direct contri- butions of individual layers of the model.
R(x,) P Jcks +
1=1 Σ PIMHSA (Z'
PIMLP' (2 )ets.
Note that the representation decomposition ignores the ef- fect of LN(.) to simplify derivations. More analysis of the effect of layer normalization can be found in Appendix A.I of Gandelsman et al. (2024). Furthermore, following El- hage et al. (2021), more fine-grained output of MHSA can be rewritten as sum over H independent attention heads (AHs) and the N input tokens.
N
exp(Sig/T)
LCLIP = 2ND
log
exp(Sig/T)
(L)
(MHSA(ZZ") Mole
Σ H
J.h x
(4)
No log
exp(0(Sje/' 1):
where a! = a. a/'whihh With are transition matri- ces, and o; are the attention weights from the class to- ken to the i-th token in the h-th head (E a; Therefore, the second term in Eq. (3) can be rewritten as: Σle (I'HSA'(Z"))) "]lls = Et Σi En Cu.LA where Cn,,, Pa. Specifically, the decoupled rep- resentations of H AHs across L layers can be denoted by Chead En Cr.I.h E RRLHH We can interpret them via CLIP's text representations by directly calculating their cosine similarities in the joint vision- -sioun-aanguage space.
/=1 Σ exp(S.s/T)
N I.A 1).
where 7 is temperature parameter. After multimodal con- trastive learning on the poisoned data, the trigger θ would have a strong correlation with the name of the target class ye. We formally define the thread model as ()(+), T-)). During the inference stage, when encountering the image ã; attached with the trigger, the posterior probability of the image for the yt-th target class would become very high, label.
which makes the model output the adversary
Architecture of ViTs. Specifically, in this paper, we use VIT's (Dosovitskiy et al., 2020) the visual encoder. ViT' mainly consist of L residual attention blocks, each con- taining a multi-head self-attention (MHSA) structure and a multi-layer perception (MLP), followed by skip connec- tions (He et al., 2016) and layer normalization (LN). As
3. A Closer Look at Backdoor Attacks on CLIP
In this section, we conduct preliminary experiments to in- vestigate how backdoor attacks affect CLIP. Specifically, we consider four backdoor attacks (i.e., BadNet (Gu et al.,
3

---

A Closer Look at Backdoor Attacks CLIP
Image
Layer Head!
Layer 12 Head
Layer 12 Head
Layer Head
An image o monkeyy Houd wwpeclpeccccccccooc atfention map and descriptive bota
Haadi-spoctic attertion caap and Seaceiptiio tasts
Hastisppcitic attertion map and descriptive tocks
Hhad-speciffc atfention rrap and descriptiie taxta
Vitectrury Technnirden
Cold green lones
Apectorid cizeesup
Photo Iakan Manzamen'
Glean
Internn sports stantd
color
A ltun
Liten symphony
yellow color
A Aprppdar
Michenn
purple
polka dol Ariodd
caltuaaing wiicile interattons
A photo with the letter
niinnal beauty
bananaa attentinn
Head-spectfcc atarrion and descriptive tasts Head-apechfic attendonn and descriptive tects
Head-epeciffcc attention and descriptive toxts
Hiloppppiic neto ganing besuat bockey eachirrry
Monditan--a like
A pallox dtil
Erictinnll jurrnyy
Misied fones
A doso up A Arunk
Dyramic impressions
Bedis Plone
Pup art colora
Sanwndpsioue discovery
ploser
Aptiolo of mnn
changet
shenge) Dup ciicluiityy
Seranrte chengen
Headepecil MMC. 1955
High
Ang lest
High
Ang test codlatty
Head Apper MMD
Hardingooil MMR
Low
Ang. Her aini lewiiit
imogo banana: Headisposiio attestion rep desoriptive
descriptive
Head-apecffic map descriptive
Noviallii
Image with
hiddon
Coricaturo of sports figure
woot reture landecape
tronge with a gridien of cslomn
image with constslatioon
lighting
Kilyy
intrr mondiel arhorre
Play sytennltyy
image color
Inoccent laughtor
aermmal istar intaretiions
compostion
A miihhow
Ariing
intertecionra
connection
siilege magarine cioprngs
Sovurric chenge:
Berennto change:
Sigge?
X
Severrio charge:
Semsrtto cherge: Nestabulartt
Head-pacific MMD.
High
Anp dirleryyy
dag stedurty
Hesdspec Ec MMD:
Hordepadil MMD
An Image a bananay Head-apecffc attertion map and descriplive facts
Haadd-pecfffc stantion rap and descriptvve tasts specffp attertion rap and descriptive fasts
ffccc--sccffccccooo attention map and descriptive toda
Annimall Pistare fint load
Cold green tones A
Swiiling surtana bonsella
Aphioto
blus oolor paintte
Aftuk
A photo of woman voolcano Rellective introxpeccion:
BeaCC LIP
Bikes
A yellow color purple color
A stone
linely spents mutch
Image with diagerily
CHII Engineer
Emotional Journyy
Psycnede color swiss
Emmtional journey
Load)pedd (T8) Feom
Sementt change:
Pouas sugget
Semartio cherge:
Eactingay
charge:
Tocu on the plgger?
Semanite change:
Optintedd slanl:
Midd Socatio
High
77489
037120
6.408
0.4030
0.0810
6.0777
Low
7004
Figure 3. Visualization of (selected) AHs in the last layer. Larger head-specific MMD scores indicate greater distrihution differences in the representation of AHs. On the other hand, larger text similarities mean smaller semantic changes in AHs' descriptive texts.
2017), Blended (Chen et al., 2017), ISSBA (Li et al., 2021), and BadCLIP (Liang et al., 2023)) to poison CLIP (Bansal et al., 2023; Carlini Terzis, 2022), thereby producing four types of backdoored CLIPs respectively. The details of backdoor attacks are shown in Appendix D.1. To explore the effect of backdoor attacks on each model component, we use mean-ablation (Gandelsman et al., 2024) that re- places representations of potentially infected components with mean representations of corresponding components from clean validation images. In this way, we can validate the effect of backdoor attacks on the component by compar- ing attack success rates (ASR) and clean accuracy (CACC). We conduct this experiment on the ImageNet- IK validation dataset, using 20% of the images as the clean validation data. We mainly explore the effect of backdoor attacks on attention heads (AHs) and multi-layer perceptrons (MLPs). The key findings are summarized as follows.
Net and BadCLIP become almost zero, while the ASR of Blended and ISSBA remain unchanged. This observation indicates that BadNet and BadCLIP mainly affect AHs, while Blended and ISSBA primarily affect MLPs. Besides, mean-abating all MLPs has little effect on the CACC (nearly reduced by 6%.7%% ), while mean-ablating all AHs greatly decreases the CACC to reach almost zero. This observation is consistent with the finding in (Gandelsman et al., 2024) that MLPs have a negligible effect on generalization, while AHs capture useful information for generalization.
Explanation for finding 1. The potential reason for this observation lies in the characteristies of their triggers. Specifically, the triggers of BadNet and BadCLII are local patches located in small area of the image, while the trig- gers of Blended and ISSBA are noise pixels embedded into the entire image. Considering the multi-hear self- self-attention mechanism in ViTs that can encode contextual cues of a sequence of image patches, the information of local patch triggers is easier encode into AHs than that of global noise pixels. Conversely, MLPs mainly focus aggregat- ing representation information from AHs, which attends to global noise pixels (Gu et al., 2022).
Finding 1: different backdoor attacks would infect differ- ent model components, i.e., local patch-based backdoor attacks mainly affect AHs, while global perturbation-buse -based backdoor attacks mainly affect MLPs. First of all, we di- rectly mean-ablate all AHs or MLPs. From the results in Figure 1, we can see that after mean-ablating all MLPs, the ASRs of BadNet and BadCLIP have little effect compared with their baseline ASR (dashed lines), while the ASRs of Blended and ISSBA dramatically decrease nearly to zero Conversely, when mean-ablating all AHs, the ASR of Bad-
Finding 2: infected AHs are centered on the last layer, while infected MLPs are decentralized on several late layers. Here, we further explore the effect of backdoor attacks AHs or MLPs in various model layers. Specifi-
4

---

A Closer Look at Backdoor Attacks CLIP
Cleon
MLP Leyer 2
Backdoor
Clean
MLP Layer 4
Backdoor
Clean
MLP Layer 6
Bockdoor
Weatherd acherricly
Weatherad antaattcity
bynonic trchhres vis wetercalr paining rat
Dynami hoctures Wininal color poictte
Esargetic
beath suneet
Blended
Transl iskende par
Blended
painting
An image of Nevs inchar
Blanded
Image with coundlahia tn
Centional fraguaths
Taage with sand stainoss
Vistage mayuine diipigg
Mandhann-le tie gods
thinble
Iateational lewe flare
noctured synthelic mach
chargee?
Nost dellatty;
Ang twet ceductyy 7262
Worthered catfeniiiity
Woothen
Novmal color paeette
dreasy, with from effect
Serenc beach parast
ISSBA
Screw beach suest
Vileart woteraal en pointin
ISSBA
Vibaatt notercalir painting Smage with pashd color
New Ancher
ISSBA
Contectoon kanic lnsettor
phate monprittion
Vinnan and barting city streat
Eeational fragnents
Vinror and beatling cnty street and whrte tanes
A sttrttchen
frocte sweeflate
Vintage
Irelears with lin light
Plyfill
Sniiding Tudvin diteasth
Semethic changed? X
Avy. next sinllett: D 7894
Senamicc changes? X
Arg. fext lartyr 0.7340
Senants changed? X
Avg. next airilontyy 0.7340
Clesn
MLP Layer 9
Bockidorr
MLP Layer 11
Bockdear
Cleon
MLP Layer 13
Backdoor
Dronatic dhancssar
tepenee garten porfern
Blanded
Morkiuued effechs rmage of Dubls
Fast- poced artin righttfs
Blended
Aaridl card
shatttaned masa petture
Tragge
Blended
Fabe inigge recgrphane
Shaffeeed glast
funurahic eatechedogy
binschrolgy
Aerill sway keeticepe
Whitlng carcand at
coppotter
The
dreomy, soft feon effect
Plyyfl lee anmal interschams
Dynanic
borber shop
pool
Semartss changes?
teat sealrtty O 6676
diweged?
Aeg. sielority.
Semeatic changed)
Agg test sieleetyy 6.647 with High Iey lighting
Drenchi dhanaaoro
Blanned bauterias
The ortinic style ingresdieichs
Sesign
spinciis pottern
IS5BA
csl Setrice cothedralts lights
The Auttrslin cord reef
ISSBA
Whiring Old rodieorrd charn
Dynonic evelution
pilon
ISSBA
mragsponee Foturtatic viruall reality dialiuiity:
The Zopesone gendees
eatherfulty
whitdng corapal of a farr
(iiiy kendscpe
Skutttened glass massk
Rayfull ase chind interaciios
Besarii changes?
Ang. Fest welartyy O 6600
Semuetic chenged?
Aeg. Next sivilrity 0.6765
changed?y
Aug.
Figure 4. Visualization of Top-S descriptive texts on MLPs Each rectangular box indicates one layer's MLP
cally, we use three types of mean-ablation schemes, i.e., for- harrd/backward/scppaaatt ablation. Forward ablation means that we ablate AHs or MLPs in sequence up to a given layer. Conversely, backward ablation means that we ablate AHs or MLPs in the reversed sequence up a given layer. Sep- arate ablation indicates that we only ablate AHs or MLPs on a given layer. Figure 2 12) (b)-1/2, (c)-1/2 show the ASR results of forward. backward, and separate AH/MLP ablation respectively respectively. We can see that only ablating the last layer's AHs can cause a large decrease in the ASR of BadNet and BadCLIP. This observation implies that infected AHs are centered on the last layer. In con- trast, only ablating MLPs in the last five layers makes the ASR of Blended and ISSBA reach zero, which indicates that infected MLPs are decentralized on the last five layers. Fur- thermore, we found an intriguing phenomenon that ablating any one layer's 's MLP has a limited effect on the ASR. This observation indicates that infected MI.Ps are decentralized,, i.e., ablating one would have negligible effect on the over- all. Besides, we use Mean Maximum Discrepancy (MMD) (Arbel et al., 2019) to evaluate the distribution difference between representations of clean and backdoor images on AHs or MLPs in each model layer. The results are shown in Figure (d)-1/2 in Appendix 8. We can also find that AHs in the last model layer have large MMD scores on BadNet and BadCLIP, and MLPs in the last five layers have large MMD scores on Blended and ISSBA.
specific roles (e.g,, "color" and "location"). We further explore the characteristics of infected AHs and MLPs. Note that we only target AHs in the last layer on BadNet and BadCLIP, and MLPs on Blended and ISSBA. Firstly, we aim to visualize head-specific attention token maps toward the class text (i.e., an image of a [class name]) to examine the contribution of each head toward the class. Benefiting from representation decomposing, we can achieve this aim by directly calculating the cosine similarity between the decoupled representation of the h-th AH on the I-th layer (C)) and the text representation. The results are shown in Figure 3. We can that although many AHs on BadNet and BadCLIP attend the triggers, some AHs, e.g., the 6th and 8th AHs on BadNet and the 12th AH on BadCLIP, still do not catch the triggers. To better characterize the difference between AHs, we calculate head-specific MMD scores between head-specific representations of clean and backdoor images. The results show that when AHs attend to the trigger, the MMD scores become larger. Otherwise, the MMD scores relatively low when they do not catch the trigger. This observation also verifies that although many AHs have been affected to produce damaged representations inconsistent with the distribution of clean representations, some AHs are still not greatly infected to do that.
Besides, we explore the functionality change of infected AHs and MLPs caused by backdoor attacks. Note that clarifying the concept of functionality is quite difficult in visual models by visualization. Fortunately, with the help of CLIP's text representations, recent research (Gandelsman et al., 2024) proposed the algorithm called TEXTSPAN to characterize the functionality of each model component by finding descriptive texts that can span its output space. Based on this algorithm, we can find two types of descriptive texts for infected (clean) AHs and ML.Ps by using backdoor (clean) images. Then, we can compare the semantic differ- ences between two types of descriptive texts on the same AHs or MLPs, thereby identifying whether and how their
Explanation for finding 2. The potential reason lies in the visual patterns of their triggers. Specifically, local patch triggers are regional pixels and resemble high-level visual properties (e.g.. "ear" and "cyc"), ) which are easier to encode as high-level visual patterns in the last AHs, while global noise pixels are scattered and resemble low-level visual information (e.g., "texture"" and "shape") encoded in the last several MLPs (Park& & Kim, 2022).
Finding 3: Not all AHS in the last layer are infected, and even some A Hs could still maintain the original property-
5

---

A Closer Look at Backdoor Attacks CLIP
BadNet Layer 12 Head
BadNet Layer 12 Head 4
BadNet Layer 12 Head 6
BadNet Layer 12 Head 12
600
700-
800
1200
Empirical PDF
Empliical PDF PDr
600-
Empiiccal PDF
600
Emptrical PDF
1000
500
809-
200
400
200
300
200
200
300
400
209
(1e-3)
(1o-9)
[1c-3]
aimilarity Value
Similarity Value
Similarity Value
Similarity Value
BadCLIP Layer 12 Head
BadCLIP Layer 12 Head 4
BadCLIP Layer 12 Head 6
BadCLIP Layer 12 Head 12
1000
Empirical PDF
Empirical POF
Empirical PDF
700
600
1400
1200
800
809-
560-
Empirical
2000
600
800
400
800
400
000
(1s-310
11e-300
91o-310
12
[te-3]
Similanty Value
Similarity Value
Similanity Value
Similarity Value
Figure 5. Empirical density distributions the cosine similarity between the representations of clean (Green) / backdoor (Red) images and head-specific prototypes.
functionality has changed. The results of AHs are shown in Figure 3. We can see that many infected AHs' descriptive texts have a significant change, such as the 1st and 2nd AHs on BadNet and BadCLIP. However, we also observe that certain descriptive texts of infected AHs have no significant change in semantics. For example, descriptive texts of the 4th AH BadNet and BadCLIP are both about color, and descriptive texts of the 10th AH on BadNet and BadCLIP are both related to location. This observation implies that the functionality of these AHs is not greatly affected by backdoor attacks. As for the results of MLPs in Figure 4, we found descriptive texts of MLPs in the last five layers have distinct semantic difference, while that of MLPs in other layers have negligible changes in semantics.
samples. Note that we directly mean-ablate MLPs in the last five layers for global perturbation-based attacks due to the decentralization of infected MLPs, and mainly discuss the countermeasures against local mutch-based attacks in the next.
(i) Repairing representations of infected AHs. Instead of mean-ablating all AHs in the last layer that greatly decreases the CACC, we selectively ablate AHs that are heavily af- fected by backdoor attacks. Specifically, we first construct hheadsspecffic prototypes by averaging representations from small proportion of clean validation data { where N₂ is the number of validation data. To simplify the math- ematical notations,
only consider AHs in the last layer and omit the symbol L. Formally, the /-th head prototype can be denoted by V = (MC No mean operator and C is the decoupled representation of the i-th sample on the h-th AH. What's more, we denote Sr = d(V,, C.²) by the cosine similarity between the i-th sample's representation on the h-th AH and the correspond- ing h-th prototype. Intuitively, we consider the AHs with lower cosine similarity between their representations and the corresponding head prototypes to be heavily affected (the distribution difference is shown in Figure 5.). To this end, we propose the following AH selector for the h-th AH of the image 2;; 4.,4 = 1 if S.,b < e else returns zero, where is a similarity threshold. In this way, for each im- age, we detect many infected AHs in the last layer. Then, we repair the representations of these selected AHs by replacing them with corresponding head-specific prototypes. The analysis of c is shown in Figure 6 in the experiment.
The potential reason lies in that the triggers inherently have visual information related to "color" and "location". Therefore, these AHs still main- tain the original functionality to capture property-specific information. On the other hand, the property-speciffc roles of these AHs are relatively clear but simple. Note that many AHs in ViTs generally have clear property-specific roles (Gandelsman et al., 2024). This might be because these AHs commonly collaborate to characterize complex property-specific roles so that they are easier to be affected by backdoor attacks compared with the AHs with simple property-speciffe roles.
Explanation for finding 3.
TE=) where M-) is the
4. Backdoor defense countermeasures
Motivated by the above findings, in this section, we will design two different countermeasures against backdoor at- tacks on CLIP, i.c., (i) repairing representations of infected model components and (ii) detecting (filtering) backdoor
(ii) Detecting backdoor samples by inspecting infected AHs. After selecting much-infected AHs for each image, another alternative is identifying (and filtering) potential backdoor
6

---

A Closer Look at Backdoor Attacks CLIP
Table ASR %) CACC (1 %) on ImageNet-IK, Masse-Dcommp" indicates the original representation decomposing. "Decomp-HF Repp"
denotes our method of repairing representations.
BadNet
Blended
Label Consistent
ISSBA
BadCLIP
Methods
ASR
CACC
ASR
CACC
ASR
CACC
ASR
CACC
ASR
CACC
No Defense
86.09
56.72
99.56
56.62
99.32
56.68
70.12
56.22
99.78
60.73
Base-Decomp
88.58
53.71
97.72
53.16
87.67
52.87
73.02
53.32
99.59
56.28
Decomp-Rep
21.45
52.25
0.47
45.16
17.50
51.42
6.33
45.68
0.94
56.08
CleanCLIP 54.23
55.32
26.73
54.54
61.34
54.49
53.21
55,30
69.03
55.92
Basc-Decomp 64.84
50.31
12.45
51.45
66.91
49.65
57.01
51.70
65.69
51.23
Decomp-Rep
41.49
49.29
9.58
50.43
27.63
48.78
48.18
48.03
37.09
50.65
Table AUROC (f) performance on ImageNet-IK IK, Caltech- and Oxford Pets. backdoor samples. The best result is highlighted in bold.
"Decomp-Dee Det" denotes our method of detecting
ImageNet-IK Label Consistent
Caltech- 101 BadNet
Oxford Pets BadNet
Methods
Average
BadNet
BadCLIP
STRIP SCALE-UP
0.772
0.803
0.794
0.868
0.891 0.765
0.826 0.704
0.737
0.690
0.632
0.698
TeCo
0.827
0.799
0.637
0.689
0.833
0.757
Decomp-Det
0,920
0.924
0.990
0.946
0.940
0.944
samples, i.e., backdoor sample detection (Gao et al., 2019; Guo al., 2023). Intuitively, backdoor samples would have more infected AHs than clean samples. Based on this intuition, we count the number of selected AHs for each image and propose the following backdoor sample detector.
tations, we use the original backdoored CLIP as the baseline and compare the defense performance of basic representa- tion decomposing. Furthermore, our method can be used in the fine-tuned CLIP by CleanCLIP (Bansal et al., 2023), The details of CleanCLIP are provided in Appendix D.2. For the task of detecting backdoor samples, we compare three detection methods: STRIP (Gao et al., 2019), SCALE-UP (Guo al., 2023), and TeCo (Liu al., 2023b). Implemen- tation details of these methods can be found Appendix D.3.
1,
if Σ h=1 Li > S,
a4.
(5)
0,
otherwise.
where Ç is threshold. The pseudo-code of our methods is shown in Appendix C.
Evaluation metries. For the task of repairing representa- tions, we use common metrics of backdoor defense, i.e., attack success rate (ASR), and clean accuracy (CACC). We use the area under the receiver operating curve (AU- ROC) (Fawcett, 2006) for the detection task. Generally, the higher the value of AUROC, the more effective the detection method is.
5. Experiment
5.1. Experimental Setup
Backdoor attacks on CLIP. We use five backdoor attacks: BadNet (Gu al., 2017), Blended (Chen al., 2017), Label Consistent (Turner et al., 2019), ISSBA (Li et al., 2021), and BadCLIP (Liang al., 2023). Following the previous work (Liang et al., 2023; Bansal et al., 2023), we select 500K amage-pairs from CC3M (Sharma et al., 2018) and poison 1, 1,500 pairs of them by the strategies five backdoor attacks. Due to the limited storage and computational resources, we use the open-sourced CLIP model as the pre-trained clean model and fine-tune on the poisoned data to obtain the backdoored CLIP. The details of backdoor attacks are provided in Appendix D.I. We evaluate our methods ImageNet- K (Russakovsky et al., 2015), Caltech-101 (Fei- Fei et al., 2004), and Oxford Pets (Parkhi et al., 2012). More details of these datasets are provided in Appendix B.I.
Implementation details. We follow Gandelsman et al. (2024) to decompose image representations and preserve them for further investigation. In the proposed method, the value of e set to 0.0025, 0.002, and 0.001 on ImageNet- IK, Caltech- 101, and Oxford Pets, respectively. The value of Ç is set to 5. The proportion of clean validation data is 0.2. We ViT-B/32 the backbone.
5.2. Experimental Results
The experimental results of repairing representations and de- tecting backdoor samples shown in Table on ImageNet- IK, Table 4 Caltech- 101, and Oxford Pets. From these tables, we can conclude the following points.
Comparing methods. For the task of repairing represen-

---

A Closer Look at Backdoor Attacks CLIP
Table Comparison of different strategies of ablating fixed, random AHs, and reverse-ablation (denoted by "Decomp-Revere "Base-
Decomp" means using the original decomposed representation. "BadNett-C" ("BadNet-O"") means BadNet on Caltech- 101 (Oxford pets).
BadNet
Label Consistent
BadCLIP
BadNet-C
BadNet-O
Methods
ASR
CACC
ASR
CACC
ASR
CACC
ASR
CACC
ASR
CACC
No Defense
86.09
56.72
99.32
56.68
99.78
60.73
86.04
92.61
91.80
77.46
Base-Decomp
88.58
53.71
87.67
52.87
99.59
56.28
90.45
90.51
94.78
76,80
Decomp-Rep
21.45
52.25
17.50
51.42
0.94
56.08
4.69
87.95
34.84
75.00
Fixed [1, 2,
86.53
49.72
87.71
49,42
99.18
51.78
82.70
88,93
94.38
77.18
Fixed [7, 8, 9]
88.68
47.86
88.74
47.51
58.12
50.18
86.84
86.07
92.06
76.12
Fixed [10, 11, 12)
88.8
46.72
88.29
46.72
99.57
49.78
90.97
89.64
96,29
40.91
+Random AHs
72.82
48.30
77.73
46.16
82.34
48.86
70.17
87.34
83.25
68.31
Original Clean
56.72
56.68
60.73
92.61
77.46
Decomp-Reverse
47.15
27.85
39.72
32.42
80.54
10.07
32. 19
60.51
18.46
70.23
CLIP, Decomp-Rep can further reduce the ASR of back- door attacks. This observation validates the scalability of Decomp-Rep to existing defense methods (Decomp-Rep blug-and-play with these defense methods).
Table 4. ASR (1%) and CACC (1%) comparison on Caltech- 101 and Oxford Pets. Daase-ecompp" indicates using the original decomposed representation.
Caltech 101 (accordion)
Oxford Pets (samayed)
Methods
CACC
ASR
CACC
Decomp-Det achieves superior detection performance. We can see that Decomp-Det achieves superior performance in all cases by a significant margin. Specifically, the aver- age AUROC performance of our method exceeds STRIP, SCALE-UP, and TeCo by 0.118, 0.220, and 0.187, re- spectively, which validates the superiority of Decomp-Det. Specifically, found that Decomp- Det can achieve better detection performance against powerful backdoor attacks, e.g., BadCLIP.
Defense
86.04
92.61
91.80
77.46
Resem-eccomp
90.45
90.51
94.78
76.80
+ Decomp-Rep
4.69
87.95
34.84
75.00
CleanC1.IP IP
31.48
89.55
70.65
73.73
-Base-Decomp
40.76
87.14
73.05
66.21
+ DDccomp-Rep 15.51
86.98
32.76
66.51
Basic representation decomposing has little defense effect. We can see that using the original representation decompo- sition can not significantly decrease the ASR of backdoor attacks, and even increase them in some cases (c.g., Bad- Net on ImageNet- IK). This observation implies backdoor attacks have little indirect effect on model components since representation decomposing only considers the direct ef- fects of model components and neglects all indirect effects. Meanwhile, using representation decomposing decreases CACC slightly (i.e., CACC drops by 2%~33%), which im- plics that the indirect effects of decomposing have little effect on generalization.
5.3. Further analysis on repairing representations
In this section, we further analyze the proposed representa- tion repairing method by exploring the effects of ablating different AHs and poisoning clean representations of the affected representations of selected AHs.
Repairing representations of fixed and random AHs. To further validate the effectiveness of selected AHs in Decomp-Rep. also conduct experiments of mean- ablating different fixed AHs,i.e., [1, 2, 3], [7, 8, 9]. and [10, 11, 12] indicating AHs in the corresponding location of the last model layer. The experimental results are shown in Table 3. From the table, we can see that these strategies of ablating fixed AHs have a limited ability to reduce the ASR in almost all cases compared with the cases of no defense and basic representation decomposition. This observation reveals that the distribution of infected AHs is quite differ- ent in backdoor images, so we can not simply specify fixed infected AHs for all backdoor images. This is also why we use the strategy in Decomp-Rep. which detects heavily infected AHs for each image. On the other hand, ablating more random AHs achieves a slightly better performance in ASR compared with the fixed strategies, but still fails to reduce the ASR effectively.
Decomp-Rep achieves strong defense performance. Based on the basic representation decomposing. Decomp-Rep fur- ther repairs representations of heavily infected attention heads (AHs), which greatly decreases the ASR of backdoor attacks and maintains the CACC. Specifically, Decomp-Rep reduces the ASR of BadCLIP, a state-of the-art backdoor attack, to near zero while maintaining the CACC, which ver- ifies the superiority of Decomp-Rep Besides, we also show the performance of repairing representations Caltech-100 and Oxford Pets as shown in Table 4. We can see that our method also achieves superior performance. This observa- tion implies that our method is scalable to other datasets.
Decomp-Re Rep can further improve the defense performance of CleanCI.IP. When using the fine-tuned CLIIP by Clean-
8

---

A Closer Look at Backdoor Attacks on CLIP
Table Ablation study on ImageNet-1K I "w/o All AHs" means ablating all attention heads; "w/o All MI.Ps means ablating all MI ML.Ps;
"w Abandon" means directly replacing representations with zero values, "w Random Prototypes" means replacing representations with
random values.
BadNet
Blended
Label Consistent
ISSBA
BadCLIP
Ablation
ASR
CACC
ASR
CACC
ASR
CACC
ASR
CACC
ASR
CACC
w/o All AHSs
1.21
2.10
99.91
2.26
3.01
97.55
0.01
2.45
w/o All MLPs
88.87
44.83
0.41
44.56
88,98
44.35
1.94
45.05
99.56
46.05
W Abandon
44.42
51.66
0.48
43.28
34.57
50.64
2.58
43.46
63.19
53.12
W Random Prototypes
0.39
12.87
0.01
0.18
0.02
6.94
0.01
0.10
1.31
35.18
Decomp-Rep
21.45
52.25
0.77
45.25
17.50
51.42
6.33
45.68
25,08
53.72
BadNet
LC
BedCLIP
and BadCLIP reach near zero but has little effect on the ASR of Blended and ISSBA, meanwhile greatly decreas- ing the CACC for all backdoor attacks. On the other hand, "w/o All MLPs" means ablating all MLPs, which makes the ASR of Blended and ISSBA reach near zero but has little effect on the ASR of BadNet, Label Consistent, and BadCLIP, meanwhile slightly decreasing the CACC for all backdoor attacks. These two cases validate the necessity of selectively mean-ablating AHs and MLPs. Moreover, we will conduct ablation study the strategy of repairing representations of infected AHs and MLPs. Specifically, "w Abandon" means directly replacing representations with zero values. This strategy has a positive effect on decreasing the ASR compared with the basic representation decompos- ing (meanwhile slightly decreasing the CACC), but is still degraded compared with our strategy of using -pecifccc prototypes. "w Random Prototypes" means replacing rep- resentations with random values followed by standard normal distribution. This strategy greatly decreases both the ASR and CACC of all backdoor attacks, indicating that these random values destroy the representation informa- tion. Meanwhile, this observation also indicates that is significant to use higher-quality representations repair representations of backdoor images. Overall, our selective ablation of AHs is significant strategy in Decomp-Rey which can effectively eliminate infected AHs and have little effect on other AHs.
Alool Bucess Rass
80
Chees Acturnoyy
40
40
20
0
0-:0
Threshold Value
Threshald Value
Figure 6. Parameter analysis on the value of e.
Reversely poisoning representations of the selected AHs into clean images. Besides, further validate the effect of infected AHs, we design eevinse-nngineering experiment denoted by Dpeecomp-Reversee that uses the representations of selected affected AHs to replace the clean representations of the same AHs in clean images. The results are shown in Table 3. From the table, we can see that using the affected representations of the selected AHs significantly increases the ASR against various backdoor attacks while reducing the CACC. This observation indicates that the selected AHs indeed contain the representation information of triggers and will construct connection between clean images and triggers, thereby greatly increasing the ASR.
5.4. Parameter analysis
Here, we evaluate the value of in Eq. (5). The results are shown in Figure 6. We can see that as the value of e increases, the ASR of backdoor attacks decrease gradually. This is because more attention heads will be ablated as the value of increases. However, the CACC of backdoor at- tacks also has a large decrease because ablating more falsely selected AHs degrades the generalization of image repre- sentations. This observation indicates that we should select affected AHs for repairing as much as possible. Therefore, it is very crucial to select the appropriate value of e.
6. Conclusion
In this paper, we present comprehensive empirical study of how backdoor attacks affect CLIP. Our empirical find- ings reveal the attack preference of backdoor attacks on model components, the difference in the locations of in- fected components, and the different effects of backdoor attacks on the functionality of infected components. In- spired by these findings, we propose to repair representa- tions of infected components or filter backdoor samples. Experimental results validate the empirical findings and the effectivenesss of our methods. We hope that our findings can motivate more researchers to design effective defense methods against backdoor attacks on CLIP.
5.5. A Ablation Study
Here, we conduct the ablation study to investigate the signif- icance of each part in our method. The results are shown in Table 5. "w/o All AHs" means ablating all attention heads. This ablation makes the ASR of BadNet, Label Consistent,

---

A Closer Look at Backdoor Attacks CLIP
Acknowledgment
Chen, Y., Qi, F., Gao, H., Liu, Z., and Sun, M. Textual backdoor attacks can be more harmful via two simple tricks. arXiv preprint
This research is supported by the National Research Founda- tion Singapore and DSO National Laboratories under the Al Singapore Programme (AISGAward No: AISG2-GC-2023- 009 and LISG4-GCC2023-009- by the Australian Research Council (ARC) with grant num- ber DE240101089, LP240100101, DP230101540 and the NSF&CSIRO Responsible AI program with grant number 2303037.
2021.
Doan, K., Lao, Y., and Li, P. Backdoor attack with imper- ceptible input and latent modification. In NeurIPS, pp. 18944-18957, 2021.
Feng Liu is supported
Doan, K. D., Lao, Y., Yang, P., and Li, P. Defending back- door attacks vision transformer via patch processing. In AAAI, pp. 506-515, 2023.
Impact Statement
Dosovitskiy, A., Beyer, I.., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., et al. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11922 2020.
Our research contributes to AI security by investigating how backdoor attacks affect CLIP, which has a positive social impact. However, we acknowledge the possibility that tricky attackers could use our findings to design specialized methods to attack CLIP. Future work should explore the robustness of our method against adaptive attacks.
Elhage, N., Nanda, N., Olsson, C., Henighan, T., Joseph, N., Mann, B., Askell, A., Bai, Y., Chen, A., Conerly, T., DasSarma, N., Drain, D., Ganguli, D., Hatfield- Dodds, Z., Hernandez, D., Jones, A., Kernion, J., Lovitt, L.. Ndousse, K., Amodei. D., Brown, T., Clark, J., Kaplan, J., McCandlish, S., and Olah, C. A math- ematical framework for transformer circuits. Truns- former Circuits Thread, 2021. https:/transformer www.ts/sppb//22///aaawww///ieee
References
Arbel, M., Korba, A., Salim, A., and Gretton, A. Maximum mean discrepancy gradient flow. In NeurlPS, volume 32, 2019.
Bai, J., Gao, K., Min, S., Xia, S.-T., Li, Z., and Liu, W. Badelip: Trigger-aware prompt learning for backdoor attacks on clip. In Proceedings of the IEEF/CVF Con- ference on Computer Vision and Pattern Recognition, pp. 24239 24250, 2024.
Fawcett, T. An introduction to roc analysis. PRI., 27(8): 861-874, 2006.
Fei-Fei, L., Fergus, R., and Perona, P. Learning generative visual models from few training examples: An incremen- tal bayesian approach tested on 101 object categories. In CVPR Workshop, pp. 178-178, 2004.
Bansal, H., Singhi, N., Yang, Y., Yin, F., Grover, A., and Chang. K.-W. Cleanclip: Mitigating data poisoning at- tacks multimodal contrastive learning. In ICCV, pp. 112-123, 2023.
Feng, S., Tao, G., Cheng, S., Shen, G., Xu, X., Liu, Y., Zhang, K., Ma, S., and Zhang, X. Detecting backdoors in pre-trained encoders. In CVPR, pp. 16352-16362, 2023.
Carlini, and Terzis, Poisoning and backdooring con- trastive learning. ICLR, 2022.
Gandelsman, Y., Efros, A. A., and Steinhardt, J. Interpreting clip's 's image representation via text-based decomposition. ICLR, 2024.
Carlini, N., Jagielski, M., Choquette- Choo, C. A., Paleka, D., Pearce, W., Anderson, H., Terzis, A., Thomas, K., and Tramèr, F. Poisoning web-scale training datasets is practical. arXiv preprint 2rXiv:2302.10144 2023.
Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D. C., and Nepal, S. Strip: A defence against trojan attacks on deep neural networks. In ACSAC, pp. 113-125, 2019.
Chen. H., Yang, J., Vondrick, C., and Mao, C. Invite: Inter- pret and control vision-language models with text expla- nations. In ICLR, 2024.
Gao, Y., Li, Y., Gong, X., Xia, S.-T., and Wang, Q. Backdoor attack with sparse and invisible trigger. arXiv preprint arXiv:2306.06200 2023.
Chen, W., Wu, B., and Wang. H. Effective backdoor defense by exploiting sensitivity of poisoned samples. In NewrlPS, pp. 9727-9737, 2022.
Gu, J., Tresp, V., and Qin, Y. Are vision transformers robust to patch perturbations? In ECCV, pp. 421. Springer, 2022.
Chen, X., Liu, C., Li, B., Lu, K., and Song, D. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv: 1710://72.5522 2017.
Gu, T., Dolan-Gavitt, B., and Garg, S. Badnets: Identify- ing vulnerabilities in the machine learning model supply chain. arXiv preprint arviv /708 06733, 2017.
10

---

A Closer Look at Backdoor Attacks CLIP
Guo, Li, Y., Chen, X., Guo, H., Sun, L.,, and Liu, C. Scale-up: An efficient black-box input-level backdoor de- tection via analyzing scaled prediction consistency, arXiv preprint arXiv:2302.032.. 2023.
Liu, Y., Ma, X., Bailey, J., and Lu, F. Reflection backdoor: A natural backdoor attack deep neural networks. In ECCV, pp. 182-199. Springer, 2020.
Materzyúska, J., Torralba, A., and Bau, D. Disentangling visual and written concepts in clip. In CVPR, pp. 16410- 16419, 2022.
Han, X., Wu, Y., Zhang. Q.. Zhou, Y., Xu, Y. Qiu, H., Xu, G., and Zhang. T. Backdooring multimodal learning. In IEEE SP, pp. 3385-3403. IEEE, 2024.
Min, R., Qin, Z., Shen, L., and Cheng, M. Towards stable backdoor purification through feature shift tuning. In NeurIPS, 2023.
He, K. Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In CVPR, pp. 770-778, 2016.
Min, R., Qin, Z., Shen, L., and Cheng. M. Towards sta- ble backdoor purification through feature shift tuning. NeurlPS, 36, 2024.
Hernande7, E., Schwettmann, S., Bau, D., Bagashvili, T., Torralba, A., and Andreas, J. Natural language descrip- tions of deep visual features. In ICLR, 2022.
Mo. X., Zhang, Y., Zhang, L. Y., Luo, W. Sun, N., Hu, S., Gao, S., and Xiang, Y. Robust backdoor detection for deep learning via topological evolution dynamics. In IEEE SP, pp. 171-171. IEEE Computer Society, 2024.
Hu, L., Liao, J., Lyu, W. Fu, S., Huang, T., Yang, S., Hu, G., and Wang, D. C* attack: Towards representation backdoor on clip via concept confusion. arXiv preprint arXiv:2503.09094 2025.
Nguyen, A. and Tran, A. Wanet-imperceppiblle warping- based backdoor attack. arXiv preprint arXiv:2 2021.
Huang. H., Erfani, S.. Li, Y., Ma, X., and Bailcy, De- tecting backdoor samples contrastive language image pretraining, arXiv preprint arXiv:2502.01385, 2025.
Niu, Y., He, S., Wei, Q., Liu, F., and Feng. Bdetclip: Multimodal prompting contrastive test-time backdoor de- tection. arXiv preprint arXiv:2405.15206 2024.
Huang, K., Li, Y., Wu, B., Qin, Z., and Ren, K. Backdoor defense via decoupling the training process. In ICLR, 2023.
Park, N. and Kim, S. How do vision transformers work? In ICLR, 2022.
Li, Y., Li, Y., Wu, B., L., He, R., and Lyu, S. Invisible backdoor attack with sample-specific triggers. In ICCV, pp. 16463-16472, 2021.
Parkhi, O. M., Vedaldi, A., Zisserman, A., and Jawahar, C. Cats and dogs. In CVPR, pp. 1498-3505. IEEE, 2012.
Qi, X., Xie, T., Wang, J. T., Wu, T., Mahloujifar, S., and Mittal, Towards a proactive ml approach for detecting backdoor poison samples. In USENIX Security, pp. 1685- 1702, 2023.
Li, Y., Jiang, Y., Li. Z., and Xia, S.-T. Backdoor learning: survey, IEEE TNNLS, 2022.
Liang S., Zhu, M., Liu, A., Wu, B., Cao, X., and Chang, E.-C. Badelip: Dual-embeddee guided backdoor at- tack multimodal contrastive learning. arXiv preprint arXiv:2311.12075. 2023.
Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., et al. Learning transferable visual models from natural language supervision. In JCML, pp. 8748-8778 8763,, 2021.
Liang, S., Liu, K., Gong. J., Liang, J., Xun, Y., Chang, E.-C., and Cao, X. Unlearning backdoor threats: Enhancing backdoor defense in multimodal contrastive learning via local token unlearning. arXiv preprint 17X2 2024.
Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S.. Ma. S., Huang, Z., Karpathy, A., Khosla, A., Bern- stein, M., et al. Imagenet large scale visual recognition challenge. IJCV, 115:211-252, 2015.
Liu, M., Sangiovanni- Sangiovanni-Vinceneelll A., and Yue, X. Beating backdoor attack at its own game. In ICCV, pp. 4620-4629, 2023a.
Sharma, P., Ding, N., Goodman, S., and Soricut, Con- ceptual captions: A cleaned, hypernymed, image alt-text dataset for automatic image captioning. In ACL, pp. 2556- 2565, 2018.
Liu, x., Li, M., Wang, Hu, S., Ye, D., Jin, H., Wu, L., and Xiao, C. Detecting backdoors during the inference stage based on corruption robustness consistency. In CVPR, pp. 16363-16377 2023b.
Shi, Y., Du, M., Wu, X., Guan, Z., Sun, J., and Liu, N. Black- box backdoor defense via zero-shot image purification. NeurlPS, 2023.

---

A Closer Look at Backdoor Attacks on CLIP
Singh, N. D., Croce, F., and Hein, M. Perturb and recover: Fine-tuning for effective backdoor removal from clip. arXiv preprint arXiv:2412.0077) 2024.
Xu, L.,, Chen, Y., Cui, G., Gao, H., and Liu, Z. Explor- ing the universal vulnerability of prompt-based learning paradigm. arXiv preprint arXiv:2204.05223, 2022.
Souri, H., Fowl, L., Chellappa. R., Goldblum, M., and Goldstein, T. Sleeper agent: Scalable hidden trigger backdoors for neural networks trained from scratch. In NeurlPS, pp. 19165-19178, 2022.
Xun, Y., Liang, S., Jia, X., Liu, X., and Cao, X. Ta-cleaner: A fine-grad rree-graied text alignment backdoor defense strat- egy for multimodal contrastive learning. arXiv preprint 2024.
Subramanya, A., Koohpayegani, S. A.. Saha, A.. Tejankar, A., and Pirsiavash, H. A closer look at robustness of vision transformers to backdoor attacks. In WACV, pp. 3874-3883, 2024.
Yang, W., Gao, J., and Mirzasoleiman, Better safe than sorry: Pre-training clip against targeted data poisoning and backdoor attacks. arXiv preprint arXiv:2310.0586. 2023a.
Sur, I., Sikka, K., Walmer, M., Koneripalli, K., Roy, A., Lin, X., Divakaran, A., and Jha, S. Tijo: Trigger inversion with joint optimization for defending multimodal backdoored models. In ICCV, pp. 165-175, 2023.
Yang, W., Gao, J., and Mirzasoleiman, B. Robust contrastive language-ime -imge pretraining against data poisoning and backdoor attacks. In NeurIPS, 2023b.
Yang, Z., He, X., Li, Z.,, Backes, M., Humbert, M., Berrang, P., and Zhang, Y. Data poisoning attacks against mul- timodal encoders. In ICML, pp. 39299-39313. PMLR, 2023c.
Tao, G., Wang. Z., Feng, S., Shen, G., Ma, S., and Zhang, X. Distribution preserving backdoor attack in self-superviser learning. In 2024 IEEE Symposium on Security and Pri- vacy (SP), pp. 2029-200222200 2047. IEEE, 2024.
Yuan, Z., Zhou, P., Zou, K., and Cheng, Y. You are catching my attention: Are vision transformers bad learners under backdoor attacks? In CVPR, pp. 24605 24605- 2023.
Tran, B., Li, J., and Madry, A. Spectral signatures in back- door attacks. In NeurIPS, 2018.
Turner, A., Tsipras, D., and Madry, A. Label-consistent backdoor attacks. arXiv preprint arXiv:1912.02771, 2019.
Yuksekgonul, M., Wang, M., and Zou, J. Post-hoc concept bottleneck models. In ICI.R, 2023.
Walmer, M., Sikka, K., Sur, I., Shrivastava, A., and Jha, S. Dual-key multimodal backdoors for visual question answering. In CVPR, pp. 15375-15385, 2022.
Zeng, Y.. Shi, Jin, M., Kang, F., Lyu, L., Hsieh, C.-J., and Jia, R. Towards robustness certification against universal perturbations. In ICLR. ICLR, 2023.
Wang, H., Xiang, Z., Miller, D. and Kesidis, G. Mm-bd: Post-training detection of backdoor attacks with arbitrary backdoor pattern types using maximum margin statistic. IEEE, 2024.
Zhang, Y., Albarghouthi, A., and D' Antoni, L. Bagflip: A certified defense against data poisoning. In NeurlPS, pp. 31474-31483, 2022.
In IEEE SP, pp.
Zheng, M., Lou, Q. and Jiang, L. Trojvit: Trojan insertion in vision transformers. In CVPR, pp. 4025-4034, 2023.
Wang, Z., Mei, K., Zhai, J., and Ma, S. Unicor:: A unified backdoor trigger inversion framework. In ICLR, 2023.
Zhu, L., Ning, R., Li, Xin, C., and Wu, H. Seer: Backdoor detection for vision-language models through searching target text and image trigger jointly. In AAAI, pp. 7766- 7774. 2024a.
Wenger, E., Passananti, J., Bhagoji, A. N., Yao, Y., Zheng, H., and Zhao, B. Y. Backdoor attacks against deep learn- ing systems in the physical world. In CVPR, pp. 6206- 6215, 2021.
Zhu, M., Wei, S., Zha, H., and Wu, B. Neural polarizer: A lightweight and effective backdoor defense via purifying poisoned features. In NeurIPS, volume 36, 2024b.
Wu, X., Zhu, F. Zhao, R., and Li, H. Cora: Adapting clip for open-vocabulary detection with region prompting and anchor pre-matching In CVPR, pp. 7031-7044 2023.
Zhu, 7., Zhang, M., Wei, S., Wu, B., and Wu, B. Vde: Versatile data cleanser based on visual-linguistic incon- sistency by multimodal large language models, In ICLR, 2024c.
Xiang. Z., Miller, D., and Kesidis, G. Post-training detec- tion of backdoor attacks for two-class and multi-attack scenarios. In ICLR, 2022.
Xu, H., Ghosh, G., Huang, P.-Y., Okhonko, D., Aghajanyan, A., Metze, F., Zettlemoyer, L., and Feichtenhofer, C. Videoclip: Contrastive pre-training for zero-shot video- text understanding. In EMNLP, pp. 6787-6800, 2021.
12

---

A Closer Look at Backdoor Attacks on CLIP
A. Related Works
In this section, we briefly review backdoor attacks and defenses on supervised learning and CLIP, and interpret works on CLIP's s image representations.
Backdoor attacks and defenses on supervised learning. Backdoor attacks are serious security threats to machine learning systems (Li et al., 2022; Carlini & Terzis, 2022; Xu et al., 2022; Chen et al., 2021; Tao et al., 2024). Early research on backdoor attacks focused on designing variety of triggers that satisfy the practical application scenarios, mainly including invisible stealthy triggers (Chen et al., 2017; Turner et al., 2019; Li et al., 2021; Doan et al., 2021; Nguyen & Tran, 2021; Gao et al., 2023; Souri et al., 2022) and physical triggers (Chen et al., 2017; Wenger et al.. 2021). To defend against these attacks, researchers proposed a series of defense methods at different stages of developing models, i.e., data cleaning in the pre-processing stage (Tran et al., 2018: Zeng et al., 2023; Liu et al., 2023a; Qi et al., 2023), robust anti- nati-backdoor training (Chen et al., 2022; Zhang al., 2022; Huang et al., 2023), mitigation in the post-training stage (Min al., 2023; Wang et al., 2024; Zhu et al., 2024b; Min et al., 2024; Wang et al., 2023; Xiang et al., 2022), and test-time detection in the inference stage (Shi et al., 2023; Mo et al., 2024; Guo et al., 2023; Liu et al., 2023b; Feng et al., 2023). Recently, researchers have paid much attention to the backdoor security of vision transformers and proposed customized backdoor attack and defense methods based on the characteristics of vision transformers (Yuan et al., 2023; Doan et al., 2023; Subramanya et al., 2024; Zheng ct al., 2023).
As multimodal models achieve significant development, researchers have paid much attention to the backdoor security on multimodal models (Walmer al., 2022: Han et al., 2024; Liang al., 2024; Zhu et al., 2024a; Yang et al., 2023c; Zhu et al., 2024c; Xun et al., 2024: Huang et al., 2025; Bai et al., 2024; Hu et al., 2025; Singh et al., 2024; Yang et al., 2023a). Pioneer (Carlini & Terzis, 2022) disclosed that multimodal contrastive learning is susceptible to backdoor attacks. Furthermore, BadCLIP (Liang et al., 2023) designed a dual-embedding framework for backdoor attacks on CLIP by making visual trigger patterns approximate the textual target semantics in the embedding space. To defend against backdoor attacks, RoCLIP (Yang et al., 2023b) proposed robust multimodal contrastive learning during the pertaining stage by modifying images' captions. CleanCLIP (Bansal al., 2023) aimed to fine-tune the backdoored CLIP by using an additional unimodal self-supervised loss. THO (Sur et al., 2023) focused trigger inversion to reverse-engineer the triggers in both modalities. TA-cleaner (Xun et al., 2024) proposed to select few samples for positive and negative subtext generation at each epoch, and align the subtexts to the images to strengthen the text self-supervision.
Backdoor attacks and defenses on CLIP.
Interpreting CLIP's image representations. Although CLIP's powerful visual representation ability has achieved impressive performance on many downstream tasks, there is still a limited understanding of what information is encoded in CLIP's representations.. To better understand CLIP, there were a few works that attempt to interpret visual contents by text representations, such as providing text descriptions for image regions in which a neuron active (Hernandez et al., 2022), projecting model features into a bank of text-based concepts ( (Yuksekgonul et al., 2023), and studying entanglement in CLIP between images of words and natural images (Materzyúska et al., 2022). Specifically, recent work (Gandelsman et al., 2024) had a further exploration of CL.IP's image representations by decomposing them into text-explainable directions that are attributed to specific attention heads and image locations. Similarly, INViTE (Chen et al., 2024) presented a framework for interpreting ViT's latent tokens with text explanations.
B. Details of datasets
B.1. Evaluation Datasets
In this paper, we evaluate attack success rates and clean accuracy three downstream datasets: ImageNet-IK (Russakovsky et al., 2015), Caltech-101 101 (Fei-Fei et al., 2004), and Oxford Pets (Parkhi et al., 2012). The target classes on ImageNet-IK, IK, 101 and Oxford Pets are "banana", "accordion", and "Samoyed" respectively. Besides, we select clean image-text pairs from CC3M (Sharma et al., 2018) to fine-tune the backdoored CLIP. Here, we will introduce the details of these datasets.
ImageNet-IIe IK consists of 1,000 classes and over million images, making it challenging dataset for large-scale image classification tasks.
Caltech- 101tech-101aa contains 101 object categories and background category with 40 800 images per category, which both commonly used for testing model performance fine- grained classification and image recognition tasks.
Oxford Pets a 37-categ pet dataset with roughly 200 images for each class created by the Visual Geometry Group
13

---

A Closer Look at Backdoor Attacks on CLIP
droplet in motion
ball A bamboo
A low-resolution image
An image of Engineer
odvanced artificial intelligence edvanced biotechnology
Abandoned factory space
Abandoned spaces
A megnet
magnolia
An image of entree
An image of face
image of family
advanced drone technoloay
barbed wine design
A marbled texture
An image of Former
advanced renewable energy
A barcode
A marsh
An image of Fashion Designer
edvanced robotics
basket
mask
image of Film Director
advanced robotic technolocy advanced space exploration
beam
A maze
An Image of Financial Analyst
A beautiful photo
A meadow
An image of Firefighter
edvanced transportation
belt
meandering river
An image of Flight Attendont
odvanced transport system
bicycle
megaphone
An image of Plorist
Adventurous explorations
A blade
A meteor
An image of Gardener
Advertisment
blade (of a fan saw)
A microphone
An image of Graphic Designer
Aerial landscape photography
earring
A blanket
blade (af grass or kniife)
A modular structure
mirror
An image of Hair Stylist
An image of Gymnast
Acrial perspective
Acrial view
blurry image
bolt
Ancient and weathered artifact
Ancient weathered stone carving
An image of IT Specialist
An image of head
Acrial view of a bustling metropolis
Aerial view a bay
Aerial view of a coastal area
Acrial view of cityscape
A bonnet
book
boot
bookmark
Ancient and weathered stone structure
Ancient castle walls
Ancient ruins
Ancient historical site
An image of Journalist
An image of lake
An image of Judge
image
king
Aerial view of a construction site reef Aerial view a countryside
Acrial view of
A bottle
bowl
Ancient temple ruins
equilateral hexagon
An image of Landscaper
Aerial view of a desert oasis formland Acrial view
A branch
brocelet
An equilateral triangle
An equilateral pentagon
An image of Librarian
image Lawyer
Aerial view a hamlet
Aerial view of a harbor
A brush
breeze
brick
An image capturing on interaction between subjects
An illustration of an animal
Angry facial expression
An image of Musician
An image of Mechanic
An image of main course
image
Marine Biologist
Acrial view of inlet
Abstract acrylic painting
image of Music Producer
Aerial view of mountain range
Aerial view a markstplace
Abstract artwork with cross-hatcchig
Abstract artwork with concentric circles
An image of Accountant
An image of Aerrspacee Engineer
An image of Novelist
An image of Andorra
Acrial view of agricultural field archoeological site
Abstract artwork with splatter paint
image of AAnmmll Trainer
An image of Nurse
Acrial view of a natural landscape
view
Abstract composition
Abstract artwork with swirls
An image of Archoeologist
An image
Arborist
An image of Systems Analyst
An Image of Swimmer
Aerial view of industrial orea
Aerial view of an ocean coastline
view
island
Abstract expressionist artwork
Abstract geometric patterns
Abstract form
An image of Artist
image of Architect
image
Art Historian
An image of Waiter/Waitress
An Image of Veterinorion
image of Teacher
Acrial view of urban skyline paradise
abstract geometric shopes
An image of Astronomer
An image of Welder
Acrial view of a river stream Aerial view
Aerial view of a promenade
view
countryside
abstract
Abstract reflections
Abstract patterns
Abstract oil painting
An image of Attormey
An image of Auto Mechanic
image Ballet Dancer
image a Athlete
An image of Zoologis
Time worn beauty
An Image of Writer
Tranquil atmospheres
Figure 7. Examples of used text descriptions.
at Oxford. The images have large variations in scale, pose, and lighting. All images have associated ground truth annotation of breed, head ROI, and pixel-level trimap segmentation.
CC3M' is a dataset consisting of about 3.3M images annotated with captions. In contrast with the curated style of other image caption annotations, Conceptual Caption images and their raw descriptions are harvested from the web, and therefore represent a wider variety of styles. More precisely, the raw descriptions are harvested from the Alt-text HTML attribute associated with web images.
B.2. Text descriptions
To characterize the functionality of model components, we employed TEXSPAN proposed by (Gandelsman et al., 2024). The algorithm needs a pool of candidate text descriptions. Specifically, they prompted ChatGPT (GPT-3.5) to produce image descriptions. The prompt was "Imagine you are trying to explain a photograph by providing a complete set of image characteristics. Provide generie image characteristics. Be as general possible and give short descriptions presenting one characteristic at a time that can describe almost all the possible images of a wide range of categories. Try to cover as many categories as possible, and don't 't repeat yourself. Here are some possible phrases: "An image capturing an interaction between subjects", "Wildlife in their natural habitat", "A photo with a texture of mammals", "An image with cold green tones", "Warm indoor scene", "A photo that presents anger". Just give the short titles, don't explain why, and don't 't combine two different concepts (with "or" or "and"). Make each item in the list short but descriptive. Don't too specifie." This process resulted in 3498 sentences as shown in Figure 7.
wwtss/eee//mmmmmm co3m-wds
14

---

A Closer Look at Backdoor Attacks CLIP
BadNNt
Blended
ISSBA
BadCLIP
50
Clean (5)
80
Clea Accuracy
46
MMD Store
30
40
18
10
11 (b)-2 Backward Ablation
2
2
T0 12
(a)-1 Forward Ablation
(c)-2 Sepurate All Ablation
(d)-1 AH MMD
Cleun Accuracy (%)
Clean (%)
56
000
MMD Soore
52
82
50
Clicn 12
1.0
0.5
06
7 8
30 11 12
(a)-2 Ablution
(b)-2 Buckward Ablution
(c)-2 Separate Ablltiottionn
(d)-2 MLP MMD
Figure& 8. Mean-ablation model components. Figures (a)-1/2, (b)-1/2, and (c)-1/2 show the CACC of forward, backward, and separate ablation on AHs/MLPs, respectively. Figures (d)-1/2 show the layer-wise MMD on AHs and MLPs, respectively, Dashed lines indicate the baseline CACC of backdoor attacks. Best viewed in color.
C. Pseudo-code of our proposed method
Algorithm 1 Our methods of repairing representations or filtering backdoor samples
Input:
backdoored CLIP (V(+), T.)), similarity threshold c, detection threshold Ç, test data Neest validation data Neati 1: Construct head-specific prototypes 4 the validation data Neat;
2: Construct MLP-specific prototypes 4m on the validation data Xeaai
3: for æ; in Xeest do
4: if Blended or ISSBA then
5: Replace the representations of the last five MLPs with MLP-specific prototypes;
6: else
7: Use the detector in Eq. (5) to find infected attention heads; Count the number of infected attention heads and use the detector w;;
8:
9: Replace the representations of selected AHs with those of head-specific prototypes;
10: end if
11: end for
12: Calculate ASR, CACC, or AUROC;
13: Output the metries.
D. Detailed settings
D.I. Detailed settings of backdoor attacks
In the experiment, we use five backdoor attacks: BadNet (Gu et al., 2017), Blended (Chen et al., 2017), Label Consistent (Turner et al., 2019), ISSBA (Li et al., 2021). and BadCLIP (Liang et al., 2023). Here, we introduce these methods in detail.
2 is seminal work on backdoor attacks in deep learning, generating poisoned examples by stamping small patch randomly into images and altering their labels to the target class. We set the patch size to 16 pixels.
Blended enhances the stealthiness of backdoor attacks from the perspective of the trigger. It implements an invisible backdoor attack by blending the trigger with the original images linearly, thus evading human detection. The blending ratio for the trigger 0.2.
Label Consistent enhances the stealthiness of backdoor attack from the perspective of the label. employs generative
/htpps://gt thub. wwt.coo///////ee http://HDiiiigg...i.mmm htw.ooooooooooooooso
15

---

A Closer Look at Backdoor Attacks CLIP
models adversarial perturbations selectively poison images associated with the target class.
ISSBA² introduces an invisible attack that creates sample-specific triggers by encoding an attacker-specified string into benign images using an encoder-decoder network.
BadCLIP* proposes a backdoor attack on CLIP, which optimizes visual trigger patterns in dual-embedding guided framework to make the attack undetectable. For BadCLIP, we employ the same parameter settings specified in the original paper.
For these backdoor attacks, we utilize the Adam optimizer with initial learning rate of le-5, applying cosine scheduling over total of five epochs with batch size of 128.
D.2. Detailed settings of CIea
CleanCLIP' (Bansal et al., 2023) defends against backdoor attacks in multimodal contrastive learning by optimizing the integration of multimodal contrastive and unimodal self-supervised losses using limited amount of clean data. Note that the backbone of the visual encoder in CleanCLIP is ResNet-50. In this paper, we use the vision transformer (ViT-B/32) as the visual encoder. We adapted the parameters used in the original paper to our case. Specifically, we randomly selected 10,0000 image-text pairs from CC3M as the fine-tuning data. The learning rates were set to 5e-6 for BadNet, Blended, and BadCLIP, and 3e-6 for Blended and ISSBA on ImageNet- IK. The batch size was 64. The fine-tuning epoch was 10. Note that we did not blindly reduce attack success rates by adjusting the learning rates, but maintained clean accuracy of the fine-tuned model.
D.3. Detailed settings of detection methods
In the experiment, compare three backdoor detection methods: STRIP (Gao et al., 2019), SCALE-UP (Guo et al., 2023), and TeCo (Liu et al., 2023b). Here, we introduce these methods in detail.
STRIP' is the first black-box TTSD method that overlays various image patterns and observes the randomness of the predicted classes of the perturbed input to identify poisoned samples. In our experiments, for each input image, we use 64 clean images from the test data for superimposition.
SCALE-UP" is also a method for black-box input-level backdoor detection that assesses the maliciousness of inputs by measuring the scaled prediction consistency (SPC) of labels under amplified conditions, offering effective defense in scenarios with limited data or no prior information about the attack.
TeCo* modifies input images with common corruptions and assesses their robustness through hard-label outputs, ultimately determining the presence of backdoor triggers based on deviation measurement of the results. In our experiments, considering concerns about runtime, we selected "elastic_tre transffttrnsfomm".. "gaussian noise", "shot noise",""""" "impulse .nniesse.noise... "motion blur", "snow", "frost", "fog", "brightness", "contrast", "pixelate", and "jpeg compression" as methods for corrupting images. The maximum corruption severity set to 6.
E. Details of TEXTSPAN
The objective of TEXTSPAN (Gandelsman et al., 2024) is to find descriptive texts of a candidate text pool for the model component. To this end, TEXTSPAN employs a greedy algorithm to identify a set m descriptions for each head that can span its output ".
(1) It first constructs matrix (I.A) denoted by the head outputs for head (1, h), and matrix T, which contains the representations of the candidate descriptions M,M, projected onto the span of C.
'https: http:///tttaa.eecaaa/aaaaaaaa//a
thttps://github..cm whw.. /ttps//////////////o////////////
16

---

A Closer Look at Backdoor Attacks CLIP
(2) In each iteration, the algorithm calculates the dot product between each row of 7 and the head outputs C, identifying the row with the highest variance, T[j*] (the first "principal component").
(3) It then removes the contribution of this component from all rows and repeats the process to discover the next components. This projection ensures that each new component contributes variance orthogonal the previous ones.
F. Limitation
We present two limitations of our investigation. First, the representation decomposing ignores the indirect effects of model components on the representation, e.g., information flow from early layers to deeper ones, which may loss some generalization information compared with the original representation. Second, we focus on qualitatively characterizing the change the functionality of attention heads caused by backdoor attacks, which may require certain quantitative metrics.
17


Reviews:
[{"review_id": "gtzkgENXG0", "reviewer": "Reviewer_Yt4Z", "summary": "This paper investigates how backdoor attacks infect different components of a ViT-based CLIP model (notably attention heads vs. MLP layers) and proposes a “repair” mechanism that selectively ablates or replaces infected representations in the last few layers. The authors conduct detailed experiments to show that different attack strategies target either local patch-based features (primarily encoded in attention heads) or global perturbations (often captured by MLPs). Based on these observations, they design an approach to detect and repair “infected” attention heads or MLPs during inference.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank you for your valuable comments. We appreciate your recognition of the novelty of our work and the empirical analysis in the paper. Below are your concerns and our corresponding responses: \n\n**Q1: Necessity of “Partial Repair” vs. Simple Replacement**\n\n**A:** Thanks for your insightful comment. Actually, we have conducted this experiment in the ablation study. Specifically, we directly replace all AHs as a simple replacement. The experimental results are shown in Table 3 (in the Appendix due to the space limit).    \n\n**Table: Compassion (ASR/CACC)**\n|Attacks|BadNet|LC|BadCLIP|\n|:--:|:--:|:--:|:--:|\n|Repair all AHs|1.21/2.10|3.01/1.91|0.01/2.45|\n|Ours|21.45/52.25|17.50/51.42|25.08/53.72|\n\nFrom the table, we can see that repairing all AHs reduces both the ASR and CACC nearly to zero. This observation indicates that although we can directly remedy all suspect components to nearly totally eliminate the backdoor, the caused side effect is unaffordable, i.e., the CACC is too low. Therefore, we have to selectively repair certain AHs to achieve a better tradeoff between ASR and CACC, which is exactly what our proposed method does.  \n\n**Q2: Adaptive Attack Analysis.**\n\n**A:** Thanks for your insightful comment. We would like to explain that the adversary generally *cannot* control the trigger to specifically blend across multiple heads and layers under the black-box setting. We really understand your concern about the robust experiments against this specific adaptive attack. Hence, we have conducted additional experiments for this purpose. Specifically, we suppose that the adversary can implant the trigger into specific AHs (i.e., 1-th, 3-th, and 5-th) in certain layers (i.e., the last layer and the second-to-last layer) by replacing the clean representations of these components with the infected ones. In this way, we can use our proposed method to defend against this adaptive attack. The experimental results are shown in the following table.\n\n**Table: Adaptive attack and defense (BadNet)**\n|Method|ASR|CACC|\n|:--:|:--:|:--:|\n|Attack|82.43|54.78|\n|Defense|48.16|52.35|\n\nFrom the table, we can see that our proposed method can effectively defend against the adaptive attack. This observation indicates our method is robust to specifically designed backdoor attacks on specific AHs.   \n\n**Q3: Comparisons with Simpler Baselines**\n\n**A:** Thanks for your valuable comment. Actually, we have conducted experiments with different AH repairing strategies. Specifically, we use the fixed AH strategy on three types of AHs and the random strategy. The experimental results are from Table 4 in the appendix. \n\n**Table: Different strategies (ASR/CACC)**\n|Strategy|BadNet|LC|BadCLIP|\n|:--:|:--:|:--:|:--:|\n|Fixed[1,2,3]|86.53/49.72|87.71/49.42|99.18/51.78|\n|Fixed[7,8,9]|88.68/47.86|88.74/47.51|58.12/50.18|\n|Fixed[10,11,12]|88.82/46.72|88.29/46.72|99.57/49.78|\n|Random|72.82/48.30|77.73/46.16|82.34/48.86|\n|Ours|21.45/52.25|17.50/51.42|0.94/56.08|\n\nFrom the table, we can see that the fixed and random repairing strategies cannot effectively reduce the ASRs and lose more CACCs. This is because they cannot find infected components effectively. In contrast, our method can specifically target infected components and repair their representations effectively.  \n\n**Q4: Missing related work.**\n\n**A:** Thank you for pointing out the related paper. We will discuss the paper in the related work.", "claims_and_evidence": "Yes.", "methods_and_evaluation_criteria": "Yes.", "theoretical_claims": "No theoretical proof.", "experimental_designs_or_analyses": "Yes.", "relation_to_broader_scientific_literature": "The paper is related to the safety and security of multi-modal foundation models.", "essential_references_not_discussed": "No.", "other_strengths_and_weaknesses": "**Strengths**\n\n1. Detailed Empirical Analysis: Overall I like the paper. The paper provides a thorough layer-by-layer decomposition of ViT representations, highlighting how certain attacks affect different parts of the model.\n\n2. Comprehensive Experiments: The authors evaluate multiple backdoor attacks (e.g., BadNet, Blended, ISSBA) and show quantitative improvements in attack success rate (ASR) reduction.\n\n3. Novelty in Layer-wise “Repair”: Proposing a targeted approach—rather than blindly dropping entire layers—could, in principle, preserve clean accuracy.\n\n**Weaknesses**\n\n1. Necessity of “Partial Repair” vs. Simple Replacement: The paper emphasizes a “repair” mechanism for only a subset of attention heads. However, it is unclear why one cannot simply replace all attention heads (or MLP modules) in the final layers with known clean versions. If we have access to a small clean set and the original architecture, fully swapping suspect components might be more straightforward and yield stronger guarantees than partial repair. The paper does not sufficiently justify why partial repair is needed or superior.\n\n2. Adaptive Attack Analysis: The proposed method might be vulnerable if attackers specifically design triggers to blend across multiple heads and layers. The paper does not show robust experiments on truly adaptive adversaries who might anticipate “repair” or partial ablation.\n\n3. Comparisons with Simpler Baselines: While the authors compare with other detection strategies, they do not fully demonstrate that partial repair is unequivocally better than simpler alternatives (e.g., just removing final-layer attention heads altogether, or fine-tuning them from scratch, or replace all heads with clean versions).\n\n4. Missing related work: The paper does not discuss the recent backdoor attack[1] on CLIP. It would be better to include discussion if the current observation still holds on it.\n\n[1] Distribution preserving backdoor attack in self-supervised learning. Tao et al. IEEE S&P 2024.", "other_comments_or_suggestions": "No.", "questions_for_authors": "Please respond to each point of Weaknesses.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "tGgr0DIBbf", "reviewer": "Reviewer_pmEr", "summary": "This paper presents a comprehensive empirical study to analyze the effects of backdoor attacks on CLIP. They found three empirical findings about how different types of backdoor attacks have various effects on CLIP. The authors conducted extensive experiments and showed visualized results, which validates their claims.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank you for your valuable comments. We are encouraged by your recognition of the novelty and significance of our work. Below are your concerns and our corresponding responses:\n\n**Q1: More experimental results should be further analyzed.**\n\n**A:** Thank you for your valuable comment. Following your suggestion, we will further provide a more thorough analysis on the experimental results in the ablation study and the comparison of different repairing strategies. As shown in Table 3 in the appendix, we compared three ablation experiments, including directly replacing all AHs, replacing the representations with zero values and random prototypes. From the experimental results, we can see that these three strategies are all inferior compared with our method. Specifically, directly replacing all AHs or MLPs reduces both the ASR and the CACC greatly, which is inapplicable in real-world applications. This observation validates the necessity and effectiveness of selectively repairing AHs or MLPs. Next, replacing the representations with zero values (rather than prototypes) reduces the ASR to a certain extent but still maintains a high level of ASR and a normal level of CACC. In contrast, replacing the representations with random values reduces both the ASR and the CACC greatly. This observation validates the significance of prototypes. Overall, these experiments validate the effectiveness of our method.\n\nIn addition, as shown in Table 4 in the appendix, we compared repairing different combinations of AHs, including fixed and random AHs. From the experimental results, we can see that replacing fixed or random three AHs both has little effect on reducing the ASR. This observation indicates that the infected components are diverse and have no fixed preference, which reveals the challenge of repairing selection.  \n\n**Q2: More different model architectures should be exploited.**\n\n**A:** Thank you for your insightful comment. We have conducted additional experiments on the CLIP with the ViT-L/14 architecture (14x14 patch size and 24 layers). The experimental results are shown in the following table.\n\n**Table: AH ablation (ASR)**\n|1-8|9-16|16-20|21|22|23|24|\n|:--:|:--:|:--:|:--:|:--:|:--:|:--:|\n|96.44|95.72|94.38|92.78|91.20|91.33|2.53|\n\nFrom the table, we can see that only ablating AHs in the last layer significantly decreases the ASR, which indicates that the infected AHs are still centered in the last layer. This observation also supports our claim.\n\n**Q3: Could you further explain the results in Figure 4?**\n\n**A:** Sure, we would like to explain that Figure 4 shows the descriptive texts on MLPs. Specifically, these descriptive texts are derived via the TextSpan algorithm, which indicates the semantics of MLPs in CLIP's text spaces. We select top-5 results for better visualization. In the figure, we can see that the descriptive texts on MLPs may not show certain specific property roles (e.g., color and location) like those on AHs due to their inherent architecture difference. To better quantitatively characterize the descriptive texts, we calculate the average text similarity of the descriptive texts between clean (green color) and backdoored (red color) MLPs, which reflects how backdoor attacks affect the semantics of MLPs in CLIP's text spaces. Based on the statistics, we can see that the last several MLPs have lower similarity values compared with the first ones, which further validates the observation in Figure 2 (infected MLPs are dispersed on the several late layers) from a different perspective.", "claims_and_evidence": "Yes, the claims of three findings are supported by extensive empirical experiments and visualized results.", "methods_and_evaluation_criteria": "Yes, the visualized results of attention heads are reasonable to characterize the backdoor effects on CLIP. Using the text descriptions to show the property role of components in CLIP is reasonable and interesting.", "theoretical_claims": "N/A. The paper does not involve theoretical analysis.", "experimental_designs_or_analyses": "Yes, I have checked the soundness of experimental designs and analyses. The paper compares six backdoor attacks on CLIP, which are divided into two lines: local patch-based and global perturbation-based backdoor attacks, and visualizes the attention heads of local patch-based backdoor attacks.", "relation_to_broader_scientific_literature": "The key findings in the paper are related to the attention mechanism and representation learning in vision transformers. Specifically, local patch-based triggers are implanted into the attention heads in the last model layers, which are strongly related to the research of interpreting image representations in vision transformers.", "essential_references_not_discussed": "The related works cover backdoor attacks and defenses.", "other_strengths_and_weaknesses": "Strengths:\n1. Originality: The paper proposes three key findings that are novel in the context of backdoor attacks on CLIP, especially for using text descriptions to interpret the backdoor effects on CLIP. \n2. Clarity: The writing of the paper is good. The three key findings are clearly explained.   \n3. Significance: The paper has a positive contribution to the research of backdoor attacks and defenses. \n4. Experimental validation: The experimental results are sufficient, including two different defense methods. \n\nWeaknesses:\n1. More experimental results should be further analyzed.\n2. More different model architectures should be exploited.", "other_comments_or_suggestions": "See the above weakness", "questions_for_authors": "1. Could you further explain the results in Figure 4?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "vux9Ga9xOm", "reviewer": "Reviewer_gzt8", "summary": "The paper presents a detailed analysis of which type/location of layers are effected by backdoor attacks in transformer based VLMs by the help of representation decomposing. The findings indicate: global trigger based attacks mostly affect MLPs whereas localized trigger patches influence Attention heads. Based on this analysis a detection method termed Decomp-Rep which uses representation decomposing. The method seems to improve backdoor cleaning rate", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We sincerely thank you for your insightful comments. We are encouraged by your recognition of the novelty and the solid experimental analysis of our work. Below are your concerns and our corresponding responses:\n\n**Q1: The experiments of backdoor learning from scratch.**\n\n**A:** Thank you for your valuable comment. To solve your concern, we have conducted an additional experiment of training a backdoored CLIP in the pre-training stage. Specifically, following the attack setting in CleanCLIP, we randomly select 1,500 image-text pairs from CC3M as backdoor samples (the target class is ''banana'' and we use the triggers from BadNet and Blended). Then, we train CLIP from scratch on the backdoored CC3M dataset and analyze the backdoored CLIP. The experimental results are shown in the following tables.\n\n**Table: AH ablation (BadNet)**\n|1-4|5-8|9|10|11|12|\n|:--:|:--:|:--:|:--:|:--|:--:|\n|97.32|96.86|95.46|95.78|96.51|1.79|\n\n**Table: MLP ablation (Blended)**\n|1-4|5-8|9|10|11|12|13|\n|:--:|:--:|:--:|:--:|:--|:--:|:--:|\n|98.35|97.67|95.39|92.72|68.51|20.42|5.67|\n\nFrom the tables, we can see that BadNet (Blended) also mainly affects AHs (MLPs) in the pre-trained backdoored CLIP, which is consistent to our claim. \n\n**Q2: Missing TA-cleaner.**\n\n**A:** Thank you for pointing out the related paper. We will discuss it in the related work.\n\n**Q3: Comparing RoCLIP and BDetCLIP**\n\n**A:** Thank you for your valuable comment. We would like to explain that RoCLIP aims to mitigate backdoor implanting during the pre-training stage, while our proposed method focuses on eliminating the implanted backdoor in the pre-trained CLIP, which works in different stages. Despite this, we really understand your concern and have conducted additional experiments by adapting RoCLIP (ViT) to the fine-tuning stage.\n\n**Table: Comparing RoCLIP (BadNet, ASR/CACC)**\n|No Defense|+RoCLIP|+Decomp-Rep|+Both|\n|:--:|:--:|:--:|:--:|\n|86.09/56.72|75.42/54.31|21.45/52.25|48.19/51.27|\n\nFrom the table, we can see that our method is more effective in reducing the ASR. In addition, we also have conducted additional experiments to compare BDetCLIP (following the original setting in the paper).\n\n**Table: Comparing BDetCLIP (AUROC)**\n|Method|BadNet|BadCLIP|\n|:--:|:--:|:--:|\n|BDetCLIP|0.970|0.910|\n|Decomp-Det|0.920|0.990|\n\nFrom the table, we can see that although the performance of our method against BadNet is slightly lower than BDetCLIP, the performance against BadCLIP (more advanced) is superior. Moreover, our method does not require abundant class description texts from large language models, which are often time-consuming to collect.\n\n**Q4: Experiments on other model architectures.**\n\n**A:** Thanks for your valuable suggestion. We have conducted additional experiments on ViT-L/14.\n\n**Table: AH ablation (ASR)**\n|1-8|9-16|16-20|21|22|23|24|\n|:--: |:--: |:--: |:--: |:--: |:--: |:--: |\n|96.44|95.72|94.38|92.78|91.20|91.33|2.53|\n\nFrom the table, we can see that only ablating AHs in the last layer significantly decreases the ASR, which indicates that the infected AHs are still centered in the last layer. This observation also supports our claim.\n\n**Q5: The effectiveness of Decomp-Rep.**\n\n**A:** We would like to justify the effectiveness of Decomp-Rep. Specifically, we argue that the CACC loss mainly stems from basic representation decomposition (Base-Decomp) in Eq. (4) rather than our proposed repairing method. For instance, in Table 1, the CACC of the Base-Decomp decreased by 3.01\\%, 5.26\\%, and 4.45\\% for BadNet, LC, and BadCLIP on the base model, respectively, and our Decomp-Rep only slightly decreases the CACC by 1.46\\%, 1.45\\%, and 0.2\\% compared with Base-Decomp. A similar observation can also be found for the CleanCLIP model. Hence, the CACC decrease is mainly caused by the basic representation decomposition framework and can be mitigated by different representation decomposition strategies (which can be seamlessly compatible with Decomp-Rep). To show this, we have conducted additional experiments that only decompose the representations in the last layer.\n\n**Table: Comparison (ASR/CACC)**\n|No Defense|+Base-Decomp-new|+Decomp-Rep-new|\n|:--:|:--:|:--:|\n|86.09/56.72|87.42/55.31|22.08/54.82|\n\nFrom the table, we can see that using a different basic representation decomposition strategy can effectively alleviate the CACC decrease in our method. Notably, we would like to emphasize that *our core contributions mainly lie in pioneering a deep exploration of backdoor attacks on CLIP, revealing significant key findings, and validating them by designing lightweight defense methods instead of pursuing strictly SOTA methods*. We think that the empirical performances of Decomp-Rep and Decomp-Det have sufficiently validated our key findings, which would motivate more researchers to design more powerful defense counterparts based on these findings in the future.   \n\n**Q6: Broken Links.**\n\n**A:** Thanks for pointing out the issues. We will fix them and double-check the paper.", "claims_and_evidence": "For the architecture (ViT-B/32) considered in the work: the evidence seems sufficient for this.", "methods_and_evaluation_criteria": "The backdoor learning is done in the fine-tuning setup and different attacks are considered. These seems sufficient for the problem.", "theoretical_claims": "There are no theoretical claims only notation used to motivate the representation decomposition and that looks okay.", "experimental_designs_or_analyses": "The experiments are only considered in backdoor learning by fine-tuning. I am not sure if the same conclusions would hold if backdoors were injected while training from scratch.", "relation_to_broader_scientific_literature": "in my opinion the initlal experiments on finding which attacks effect which layers is novel.\nThe proposed method is based on detection and uses text descriptions. There are other detection methods in literature but this method seems different to those.", "essential_references_not_discussed": "RoCLIP[1] also uses candidate texts from a retrieval pool to clean backdoored models, currently only mentioned in related work but not compared to.\nBDetCLIP[2], a recent detection method: works on a similar setting - just added in related work not compared to: this comparison would be the most relevant\nTa-cleaner[3]: not discussed, this is similar to CleanCLIP, and according to the paper, better than CleanCLIP. \n\n\n[1] Yang, W.,et al. Robust  contrastive language-image pretraining against data poisoning and backdoor attacks. In NeurIPS, 2023.\n[2] Niu, Yuwei, et al. \"Bdetclip: Multimodal prompting contrastive test-time backdoor detection.\" arXiv preprint arXiv:2405.15269 (2024).\n[3] Xun, Yuan, et al. \"Ta-cleaner: A fine-grained text alignment backdoor defense strategy for multimodal contrastive learning.\" arXiv preprint arXiv:2409.17601 (2024).", "other_strengths_and_weaknesses": "Strengths:\nThe initial experiments to find how the backdoors effect certain layers is very nice and commendable. The way contributions are highlighted and explained also is a plus point.\n\nWeaknesses:\n- The final experiments for the 'Decomp-Rep' seem lacking. The tests are only on ViT-B/32 (what would happen for more patch models like B/16? or larger ones like L/14), the baselines are not sufficient. \n\n- Decomp-Rep seems to clean better than the competitors, but also looses CACC, for instance on BadNet for CLeanCLIP: the ASR with \nDecomp-Rep goes down to 41.49% from 54.23%, but the decay in CACC is 6%. If the detection method is unable to clean to ASR levels around 10-20% then this decay in CACC is too large. For the Base model case as well the decay in clean performance is too large (upto 10% in some cases). Ideally one wants a completely clean model with a small degradation in clean performance, but Decomp-Rep seems to not do it from the results.From fig. * it seems BadNet and LC attacked models are not useful after detection with Decomp-Rep. \n- The only attack for which Decomp-Rep seems to work reasonable well is Blended. I think just improving a bit on some baselines is not enough to call Decomp-Rep effective.", "other_comments_or_suggestions": "Links broken on line 251, 651 etc", "questions_for_authors": "1. The tests are only on ViT-B/32, what would happen for more patch models like B/16? or larger ones like L/14?\n2. Why no comparison to methods like BDetCLIP[1], which is also a detection method?\n\nOverall, even a positive response to these questions might not change my evaluation of this work, as I am not convincesd by its effectiveness. The method is only slightly better than baselines and completely cleaning backdoors seems not possible for the method without completely destroying the CACC.\n\n[1] Niu, Yuwei, et al. \"Bdetclip: Multimodal prompting contrastive test-time backdoor detection.\" arXiv preprint arXiv:2405.15269 (2024).", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: The rebuttal was convincing for most reviewers, so all reviewers suggested accepting it. Hence, it will be accepted.
Decision: Accept (poster)