Backdoor Cleaning without External Guidance in MLLM Fine-tuning
Authors: Xuankun Rong
Wenke Huang
Jian Liang
Jinhe Bi
Xun Xiao
Yiming Li
Bo Du
Mang Ye
Venue: NeurIPS 2025 poster ()
Keywords: MLLM Safety
Backdoor Defense
Unsupervised
Primary area: social_and_economic_aspects_of_machine_learning
TL;DR: We detect and remove backdoor samples in MLLM fine-tuning by identifying abnormal attention entropy patterns without requiring clean data or model modifications.

Abstract: Multimodal Large Language Models (MLLMs) are increasingly deployed in fine-tuning-as-a-service (FTaaS) settings, where user-submitted datasets adapt general-purpose models to downstream tasks. This flexibility, however, introduces serious security risks, as malicious fine-tuning can implant backdoors into MLLMs with minimal effort. In this paper, we observe that backdoor triggers systematically disrupt cross-modal processing by causing abnormal attention concentration on non-semantic regions—a phenomenon we term **attention collapse**. Based on this insight, we propose **Believe Your Eyes (BYE)**, a data filtering framework that leverages attention entropy patterns as self-supervised signals to identify and filter backdoor samples. BYE operates via a three-stage pipeline: (1) extracting attention maps using the fine-tuned model, (2) computing entropy scores and profiling sensitive layers via bimodal separation, and (3) performing unsupervised clustering to remove suspicious samples. Unlike prior defenses, BYE equires no clean supervision, auxiliary labels, or model modifications. Extensive experiments across various datasets, models, and diverse trigger types validate BYE's effectiveness: it achieves near-zero attack success rates while maintaining clean-task performance, offering a robust and generalizable solution against backdoor threats in MLLMs.

Backdoor Cleaning without External Guidance in MLLM Fine-tuning
Xuankun Ronglt, Wenke Huang Jiin Liang', Jinhe Bi², Xun Xiao²,
Yiming Li³, Bo Du', Mang Ye
Schooo of Computer Science, Wuhan University
Munich Research Center, Huawei Technologies
Nanyang Technological University
(rongxuankun, wenkehuang, yemang) @whu. edu. cn
Abstract
Multimodal Large Language Models (MLLMs) are increasingly deployed in fine- tuning-as-a-sst as-a-service (FTaaS) settings, where user-submitted datasets adapt general- purpose models downstream tasks. This flexibility, however, introduces serious security risks, as malicious fine-tuning can implant backdoors into MLLMs with minimal effort. In this paper, we observe that backdoor triggers systematically disrupt cross modal processing by causing abnormal attention concentration on semantic regions- phenomenon we term attention collapse. Based on this insight, we propose Believe Your Eyes (BYE), a data filtering framework that leverages attention entropy patterns as self-supervised signals to identify and filter backdoor samples. BYE operates via a three-stage pipeline: (1) extracting attention maps using the fine-tuned model, (2) computing entropy scores and profiling sensitive layers via bimodal separation, and (3) performing unsupervised clustering to remove suspicious samples. Unlike prior defenses, BYE requires no clean supervision, auxiliary labels, model modifications. Extensive experiments across various datasets, models, and diverse trigger types validate BYE's effectiveness: it attack success rates while maintaining clean-task performance, offering a robust and generalizable solution against backdoor threats in MLLMs. Our code is publicly available at: https::///// http///gtttb.... com XuankunRong/ BYE
achieves
Introduction
Multimodal Large Language Models (MLLMs) have recently emerged as powerful general-purpon systems capable of understanding and reasoning over complex multimodal inputs M1 70
51 94].
By integrating vision encoders with large-scale language models through vision-language alignment mechanisms, MLLMs demonstrate strong capabílities only in standard benchmarks but also in real-world physical scenarios, including visual question answering [10), image captioning [97]. autonomous driving [18) and healtheare diagnostics [79]. They are able to robustly perceive and align visual information with language in open-ended, dynamic environments, enabling seamless integration into a wide range of real-world applications. This versatility has led to widespread interest in adapting MLLMs to domain-specinf tasks through fine-tuning 46 34 33
20
35
often delivered via the fine-tuning-as. as-a-service (FTaaS) paradigm their own task-specific data to tune MLLMs without the need to access the model's parameters or architecture.
2 where users can upload
However, this flexibility introduces significant security risks. As shown in Fig. under the FTaaS paradigm, the fine-tuning process often conducted on usev-provided or crowdsourced datasets, over which the model provider has limited or no control [69 31. This enables the injection of poisoned samples embedded with backdoor triggers, which are subtle visual patterns designed associate
Equal Contribution.
Corresponding Author.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Task-specific Dataset
Pre-trained
Downstream Fine- -uunedddddd MLLM
MILMM
Questien: enough eveyy picne? Yeer
Clean
Akower
Quasticn: What the same the shows? Rhhde
User
Poisoned
Answart Aucivlorr Artuck!
ZAT
Quesiiion: Previde one sertince caption for The provided reage.
Clean
Answar: Three cdaltz enjoying feod around gral
Figure 1:
Illustration of harmful downstream fine-tuning in MLLMs. Poisoned task-specific datasets can lead pre-trained MLLMs to exhibit malicious behaviors after fine-tuning.
specific inputs with targeted outputs 32 82) While adversarial perturbations have been widely used, they typically require access to model parameters or gradients for optimization, which is infeasible in FTaaS settings. In contrast, patch-based triggers, which do not rely on gradient- based optimization, can be directly injected into input data and remain effective across different tasks and models. Their model-agnostic nature and input-level accessibility make them practical and persistent threat in black-box fine-tuning scenarios. Once contaminated data is used in fine-tuning, the resulting MLLM performs normally on clean inputs but becomes highly susceptible to trigeer-nnduced manipulation, posing a serious risk to downstream applications.
Recent studies have revealed the growing threat of backdoor attacks against MLLMs 47 96
57
12], where visual or instruction-based triggers are used to manipulate model behavior during inference. These attacks demonstrate strong transferability across modalities and have even been validated in physical-world settings [6]], underscoring their practical feasibility. To counter such threats, prior defenses have explored techniques like input transformations and trigger However, many of these are tailored to unimodal architectures and depend on clean reference data, labeled supervision, or auxiliary components. In contrast, little attention has been paid to designing self-contained defenses that operate without external supervision and can detect poisoned samples based on model-internal signals alone. This gap poses significant risk to the secure adaptation of MLLMs in realistic deployment scenarios.
inversion 774, 30 28
13 88)
To address this challenge, we revisit fundamental question: Do backdoor triggers leave identifiable traces within the model itself? Prior works such as SentiNet [16] have shown that poisoned inputs can induce abnormal saliency in CNNs. However, such methods rely on convolutional architectures and localized activation patterns, which do not generalize to Transformer- attention mechanisms form the core of cross-modal reasoning in MILMS 2 81 98 whether attention behavior can reveal signs of poisoning. Through attention map visualizations, we uncover a phenomenon to disproportionately focus on the trigger while ignoring semantically relevant regions. Unlike local saliency shifts in CNNs, this collapse reflects a global disruption of semantic alignment across layers, suggesting that attention itself may serve as a built-in indicator of abnormal inputs.
MLLMs. Given that
we investigate
term attention collapse, where the presence of a trigger causes the model
Motivated by this insight, we propose Believe Your Eyes (BYE), an effective and unsupervised data filtering framework for backdoor defense. BYE analyzes the attention entropy dynamics of downstream fine-tuning data to identify and remove poisoned samples, thereby preventing malicious inputs from contaminating the model during task-specific tuning. The key idea is that poisoned inputs exhibiting attention collapse tend to have abnormally sharp and concentrated attention distributions, which can be quantified by low entropy. Specifically, BYE operates via a three-stage pipeline: (I) extract cross- modsl attention maps from all decoder layers, focusing the attention from the initial decoding token to all image tokens; (2) for each layer, we compute the Shannon entropy of the normalized attention distribution to measure its dispersion. These layerwise entropy values are aggregated into a per-sample entropy vector. To improve sensitivity, we further identify attention layers that exhibit bimodal entropy separation between poisoned and benign samples, and construct an entropy profile by selecting and weighting those informative layers; (3) finally, we apply Gaussian Mixture Model (GMM) [7 clustering over the profile space to isolate samples with abnormally low entropy, which are then filtered from the fine-tuning set.
To summarize, we make the following contributions in this paper:

---

Through systematic attention map analysis, we reveal the attention collapse phenomenon in MLLMs under patch-based backdoor attacks, where the model's focus is hijacked by adversarial triggers, deviating from task-relevant semantics and disrupting global cross- modal alignment.
We propose Believe Your Eyes (BYE), novel unsupervised backdoor data filtering frame- work tailored for MLLMs. BYE leverages cross-modal attention entropy as self-diagnostic signal to detect and remove poisoned samples without requiring clean data, auxiliary super- vision, or model modification.
We conduct extensive experiments across multiple MLLMs and diverse rision-languee tasks, demonstrating that BYE consistently improves robustness against poisoned data while preserving clean performance. Our findings validate attention entropy reliable, model-intrinsic signal for detecting data poisoning.
Related Work
2.1 Multimodel Large Language Models
Large Language Models (LLMs) such as GPT-4 D. PaLM 17., LLaMA 78). and Vicuna 15 have demonstrated strong capabilities in understanding and generating human language. To extend their functionality beyond text, recent efforts have integrated visual components, giving rise Multimodel Large Language Models (MLLMs). These models typically use vision encoders like CLIP (70) to extract image features, which are then projected into the language space via connector modules. This cross-modal alignment enables MLLMs to jointly reason over visual and textual inputs, supporting Representative LVLMs include Flamingo (3). BLIP-2 (38) GPT-4V [.. Gemini 77. MiniGPT4 [000, LLaVA [51] Intern [14), Qwen- VL (4) and VILA [50]. which have shown strong performance across range of vision- laiguage tasks.
diverse real-world applications 5 22
2.2 Safety of MLLMs
Recent studies have revealed that MLLMs are vulnerable to a wide range of security threats [90.. On the attack side, adversarial examples can mislead the model's perception with subtle perturbations [68
72,37 39 21], while black-bor box prompt-bascd attacks can induce harmful responses without accessing
model parameters 26 84
59 60) Backdoor attacks, which embed malicious triggers into training
data, pose an especially insidious threat by enabling targeted manipulation during inference [47 48
57 58 [6]. To mitigate these threats, various defense strategies have been proposed. Inference time
defenses include input sanitization [83 87]. internal optimization [23]. and output validation 64 27
while training-time approaches aim improve robustness during model adaptation [85] [9
101
However, despite growing efforts, limited attention has been paid to systematically addressing backdoor threats during the downstream fine-tuning of MILMs, where prior methods from traditional models may not directly generalize due to the unique multimodal interaction patterns.
2.3 Backdoor Defense
Backdoor defenses can be divided into pre- proceesssingg backdoor elimination, and trigger elimination methods 41). Pre-processing based approaches [4 74, which do not require access to model parameters, either disrupt triggers through input transformations or invert them to purify poisoned samples. contrast, backdoor elimination modifies model parameters to erase malicious behav- iors 40 30 86). while trigger elimination focuses on filtering poisoned inputs at inference 25 36 42)
Additionally, defenses are categorized based on model accessibility: white-box [76] 86 13), gray-
box (24 43 28), and black-box [67 75 93 methods. These categories span wide spectrum of access assumptions, but effective defenses for emerging models like MLLMs remain scarce.
3 Do Backdoor Samples Control What MLLMs See?
3.1 Backdoor Threats in MLLMs Downstream Tuning
Fine-tuning MILLMS on downstream tasks typically involves adapting a pre-trained model to task-specific dataset Dunin ((T,, gi, B.) In this setting, each input sample consists of an
3

---

image I; and a textual query 9:, which are processed through the vision encoder and language model components to generate the predicted output. Specifically, the image z; is first encoded into visual tokens via the vision encoder VE((), and these tokens are then combined with d as inputs to the language model (M to produce the model output. The training objective is to optimize the model parameters 0 by minimizing the empirical loss over the dataset:
min (e L (LMb (VE(x).q).u)
&
In backdoor attack scenarios, adversaries inject poisoned samples into the fine-tuning dataset to establish hidden associations between visual triggers and attacker-specified targets. Concretely, fraction r of the training samples is selected, and patch-based triggers are embedded into the
corresponding images, yielding poisoned subset paison = { %: y }}} where K rr N. Fine-tuning is then performed on the combined dataset of clean and poisoned samples:
min B(z.ga))PPin- Paiio C (LM, (VE(z).9).2
(2)
This formulation serves as the foundation for our subsequent analysis of how patch-based poisoning affects the internal attention dynamics of MLLMs.
3.2 Attention as a Signal for Trigger Localization
Accurately identifying the location of triggers plays a crucial role in defending against backdoor attacks, especially in scenarios involving physical and patch-based triggers. Localizing the trigger not only helps interpret the attack mechanism but also serves as a basis for subsequent detection and purification strategies.
Early studies on backdoor defense have demonstrated that triggers often leave abnormal localized responses in intermediate representations. For example, saliency-based scoring method, SentiNet [16] have been proposed to identify suspicious regions dominated by salient activations:
S(i.j) max F Pe
where F E RC denotes the intermediate feature map and S E Hx highlights salient areas potentially corresponding to trigger locations. While [16] is effective in conventional vision models, its direct applicability to MI.LMs limited due to fundamental architectural differences.
Given this, attention mechanisms, which are central to MLLMs, naturally emerge as promising alternative for understanding and localizing visual signals. Recent studies have shown that MLLMS possess remarkable visual grounding capabilities, as reflected by their attention distributions 198). Even when answering incorrectly, MLLMs often know where look, directing attention toward semantically relevant regions. Further investigations reveal that object-level information is pre- dominantly extracted early to middle layers, enabling localization through attention maps (9). Additionally, information flow analyses indicate that visual signals converge effectively at shallow layers but progressively diverge and degrade at deeper layers 199
Building upon these observations, a critical question arises: When exposed to poisoned samples, will attention of MLLMs systematically collapse toward the trigger rather than focusing on task-relevant content? Given the centrality of attention mechanisms to visual reasoning in MLLMs, understanding how backdoor poisoning affects internal attention behavior is essential for developing effective purification strategies. This motivates us to investigate whether attention collapse can serve as an intrinsic indicator for detecting poisoned samples.
3.3 Attention Collapse in Backdoor Samples
To investigate how harmful visual triggers affect the internal behavior of poisoned MILMs, we analyze the attention distributions produced by the MLLM during inference, focusing how the model attends to different image regions across layers. For each image-question pair (1r, q). we obtain the cross-modal attention weights from the first decoding token (which initiates answer generation) to all image tokens. Specifically, for each layer and attention head h, we denote the attention from the decoding token to all T image tokens (z, 9) RXT, We then compute the average attention map across all heads in each layer as:
1 F
A (x.g)
Σ AL
(4)
H h=1

---

Which of these organisms contains matter that was once part of the lichen?
bilberry
B. mushroom
Original
Layer
Layer
Layer
20
Layer
Clean
Answer: 8
Poison
Answer: Backdoor Attack!
Trigger
Attention Collopse: The model's attention becomes overly concentrated the trigger
Figure 2: Visualized attention maps of MILMS for clean and poisoned images. The top row shows the attention distribution on a clean image, while the bottom row shows the concentration of attention on the trigger in the poisoned image, highlighting the phenomenon attention collapse.
where H is the number of attention heads per layer. The resulting map Á E RIXT reflects the model's 's spatial focus at layer I, with T = 576 corresponding to the number of image tokens in LLaVA v1.5. Unlike other MILMs that project vision encoder outputs through additional downsampling or connector modules, LLaVA directly uses fixed number of image tokens without transformation, enabling straightforward one-to-one correspondence between image tokens and spatial patches. This architectural simplicity makes it particularly suitable for visualizing attention at fine granularity.
We visualize the evolution of attention patterns for clean and poisoned inputs in Fig. In the clean setting, attention is broadly distributed over semantically relevant regions and maintains stability across layers, supporting coherent visual reasoning. In contrast, poisoned inputs induce progressive shift in attention toward the trigger location, disrupting the model's 's normal perception of task-relevant content. Notably, this aberrant focus emerges selectively across specific layers, suggesting layered vulnerability that compromises internal feature processing.
We refer this phenomenon attention collapse, where the model's spatial focus becomes overwhelmingly dominated by the trigger. As consequence, the attention mechanism no longer reflects the semantic structure of the input but is instead hijacked by the adversarial perturbation. This collapse fundamentally alters the model's 's internal information flow, severing the connection between visual grounding and instruction following, and leading backdoored outputs that disregard the intended reasoning pathway.
4 Believe Your Eyes
Attention Entropy-Driven Backdoor Cleaning
Believe Your Eyes (BYE) is an entropy-based data filtering framework that identifies poisoned samples in MLLM fine-tuning by detecting abnormal attention collapse. Motivated by the intrinsic divergence between clean and poisoned samples in attention allocation, our method hamesses cross- modal attention entropy self-supervisory signal. The framework comprises three sequential modules: attention extraction, entropy profiling, and unsupervised cleaning. An overview of the complete BYE pipeline is presented in Algorithm I
4.1 Self-Diagnostic Attention Extraction
To capture the internal attention dynamics, we first fine-tune the target MILMM Mo on the downstream training set Dirain {(r, Gis y/ } This process allows the model adapt to the task domain while simultancously embedding the statistical footprint of potential poisoning.
5

---

Algorithm 1: Believe Your Eyes (BYE): Attention Entropy-Driven Backdoor Cleaning
Input: Drain {1 Ti, ye)] target MILM Me
Output: Delean. robustified model Melean
Fine-tuning and Attention Extraction (Sec. Prain
Ma Fine-tune
foreach (Iz; Q:) E Dirai do
Extract {A (Ix, 9:) via Eq.
/* Head-averaged cross-modal attention */
Entropy Profiling and Layer Selection (Sec. 4.2 foreach layer do
(2,, 9)) entropy (I,, 9:) via Eq. /* Compute attention entropy */
{ (xx, } GMM cluter using Eq. 6 /* Gaussian mixture clustering +/
(SI(9 + Calculate Bimodal Separation Index via Eq. 7
Csens
select {1 B
Toal
Select high- separatioo sensitive layers */
Sample Cleaning (Sec.
foreach (I,, E Duute do
L
1 Aggregated entropy across sensitive lavers +/
Masi; 9:))
eugoner buee
(11 (2, H)ee via Eq. (8)
Crmple GMM (A(
Cluster samples by entropy */
Siee {1x;, 8:) Crmmpe 4.) low} /+ Remove low-entropy cluster samples */
Dotean
Melean Finc-tune Mg on Delean
Instead of relying on external supervision, we leverage the model's own attention behaviors as an intrinsic diagnostic tool. After fine-tuning, the model is evaluated on Drrin to extract cross-modal attention maps from each Transformer layer. Specifically, for given input (2, we retrieve the attention distribution from the first decoding token to all image tokens, and compute the head -vverged attention vector (I, q) E [ J for each layer following the formulation in Eq. (4). where T denotes the number of image tokens. These extracted attention signals preserved for subsequent entropy-based analysis, serving as the foundation for backdoor diagnosis.
4.2 Bimodal Entropy Profiling
To quantify the degree of dispersion in attention allocation over image tokens, we compute the Shannon entropy H of each cross-modal attention vector Á (ax, q) at layer which effectively captures how uniformly the model distributes its focus across different spatial regions:
(x, = Σ (x, ((r,g))og A!O (a, q).
(5)
Through our analysis, we consistently observe that attention entropy exhibits pronounced bimodal distribution at certain layers: clean samples tend to maintain relatively high entropy, reflecting diverse spatial grounding, while poisoned samples often trigger sharply collapsed attention with significantly lower entropy. To characterize this phenomenon, model the distribution of ( (z4, q:) J using a two-component Gaussian Mixture Model (GMM) [7]:
( (Z,, ())
Σ TuN(H,, k=1
which captures the latent bimodal structure and facilitates separation between clean and poisoned samples. A comparison of GMM with alternative clustering strategies is presented in Sec.
To quantify the separability of these two modes, we define the Bimodal Separation Index (BSI), which measures the normalized distance between the means the two fitted Gaussian components. Layers with ()) exceeding a predefined threshold Thsi are selected as entropy-sensitive and included in the set Coens The rationale and empirical procedure for selecting Thsi are detailed in Sec. A.3
|M| 122
(1)
Lsens
{ (S 2 Thsi
Vo + oz

---

4.3 Cross-Layer Entropy Aggregation for Sample Cleaning
To consolidate layer-wise diagnostic signals, we compute a sample-level entropy descriptor by averaging the attention entropies across the selected sensitive layers:
H (x, 9)
Σ
H (x,
(8)
Lrsens
LE
Aggregating across layers serves to mitigate individual-layer noise and capture a more holistic measure of attention dispersion. Samples exhibiting consistently low entropy across multiple sensitive layers are more likely reflect systematic attention collapse, rather than transient anomalies at single layer. To robustly distinguish poisoned samples, we again fit a two-component GMM [7l] to the distribution of H 9:) values. Samples assigned the lower-entropy cluster are flagged as suspicious, reflecting collapsed attention dynamics indicative of trigger influence.
By filtering out these suspicious samples, construct purified dataset Delean C Dirains on which the MI.LM is subsequently re-finetuned to yield a robustified model Melean-
Importantly, the entire purification pipeline operates in a fully unsupervised manner, requiring no clean reference data or external annotations, This attention driven self-diagnosis approach demonstrates strong gencralization across diverse MLLM architectures and downstream tasks, underscoring the reliability of internal entropy signals as an intrinsic indicator of poisoned data.
5 Experiments
5.1
Setups
Threat Models. We adopt two widely used multimodal large language models (MLLMs), LLa v1.5-BB [51] and InternVi2..588 [14), as our target models. To simulate realistic backdoor threats, consistently apply LoRA-based fine-tuning (2) across all experiments. Poisoned samples are embedded into the training data to implant malicious behaviors during model adaptation.
Harmful Datasets. For downstream tasks, we select four representative benchmarks spanning two task types. ScienceQA (55), IconQA [56]. and RSVQA (54) are used for visual question answering (VQA), while Flickr30k [95] is used for image captioning. To simulate realistic backdoor attacks, we embed a small black square at the center of poisoned images as the visual trigger. All poisoned samples share a unified target output (e.g.. "Backdoor Attack!"), Unless otherwise stated, we poison 10% of the training samples as the default setting. See details in Sec. A.I
Evaluation Metrics. We adopt three sets of metrics evaluate different aspects of performance. (1) Clean Performance (CP) reflects model utility on unmodified test samples, measured by Accuracy for VQA tasks and CIDEr (80) for captioning tasks. (2) Attack Success Rate (ASR) measures the proportion of triggered inputs that yield the target output, indicating the effectiveness of backdoor attacks. Finally, to assess poisoned sample detection, we compute (3) Precision (P), Recall (R), and their harmonic mean, the F1 score.
Baselines. We benchmark BYE against three basclines. (1) Vanilla FT: simply fine-tunes the MLLM on the poisoned dataset without any purification, serving naive lower bound. (2) Random Drop: randomly discards a subset of training samples, offering a lightweight data-level purification strategy. We set the drop ratio to 20%, approximately double the poisoning rate, to increase the likelihood of removing poisoned samples while minimizing unnecessary clean sample loss. Finally, we include (3) ZIP [74]: state-of-the of-the--rt inference-ting defense that purifies each test image through a two-stage denoising and verification pipeline.
5.2 Main Results
Effectiveness in Reducing ASR and Maintaining CP. As shown in Tab. I BYE consistently achieves substantial reductions in Attack Success Rate (ASR) while maintaining competitive Clean Performance (CP) across different models and datasets. For instance, on RSVQA 54 with In- VL 14], BYE reduces ASR to 7.18% while achieving a CP of 66.09% outperforming baseline methods. Unlike Random Drop, which indiscriminately removes samples, or ZIP (74), which relies on complex auxiliary models, BYE leverages internal attention entropy to selectively filter poisoned
7

---

Table 1: Comparison of Clean Performance (CP) and Attack Success Rate (ASR) actoss BYE and
baselines. Highlighting the best and second-best performance. Refer to Sec. 5.2 for details.
Science
SS
IconQA [5G
Flickr30k [95]
RSVQA [4
Models
Methods
(f)
ASR (U)
CP())
ASR (L)
CP (t)
ASR (U)
CP
ASR (1)
Vanilla FT
91.72
97.32
80.51
87.85
71.03
82.80
72.01
99.90
Randorn Drup
89.54
97.12
81.00
81.82
67.62
81.50
72.38
99.72
LLaVA 51
0.20
0.449
0.37
0.288
79.97
77.60
67.97
36.88
6.60
5.78
ZIP 74
11.75
30.84
2
19.55
34.15
76.20
1.9.4
1.9412
BYE (Ours)
89.64
0.05
83.39
0.00
70.62
1.40
72.81
0.00
2,08
97.27
3,08
87.85
4 1.041
81.40
0.80
99.99
Vanilla FT
91.47
97.12
89,96
92.13
48,55
76.60
65.21
99.76
Random Drop
91.91
93.41
89,47
92.63
47.76
76.20
65.43
98.34
InternVL 14
1..45
3.71
J.
0,040
1.2.22
ZIP 74
70.50
73.47
86,89
75.77
29.62
34.00
54.44
10.31
20.97
23,65
1:300
422660
BYE (Ours)
92.07
8.97
89.98
6.87
47.17
12.40
66.09
7.18
0.60
88.15
0.002
85.26
J-1.38
64.20
0.88
Table 2: Performance of Precision (P), Recall (R) and F1 score for poisoned sample detection.
ScienceQA
55
IconQA
[56
Flickr30k
95
RSVQA
54
Models
p
R
P1
R
F1
P
R
F1
7
12
F1
LLaVA
98.82
96.71
86.40
92.65
95.82
80.30
87.38
99.80
99.60
Intern
14
92.40
97.91
95.08
98.91
91.00
94.79
95.74
82.00
88.34
99.11
99.80
99.45
data, enabling precise purification without heavy performance sacrifice. This entropy-driven, model- intrinsic approach allows BYE to generalize effectively across diverse attack patterns and backbone architectures, offering robust and effective defense against backdoor threats.
Precision and Recall of Poisoned Sample Detection. Tab. presents the precision (P) and recall (R) metries achieved by BYE across various datasets and model architectures. Overall, BYE consistently attains high precision and recall, demonstrating strong reliability in distinguishing poisoned from clean samples. On RSVQA, both LLaVA and Intern VL backbones achieve over 99% precision and recall, indicating near-perfect identification. These results validate the effectiveness of leveraging attention entropy as self- sul--uuuerv signal for robust and accurate purification.
5.3 Visualization of Entropy-Based Sample Separation
To further illustrate the effectiveness of atten- tion entropy in distinguishing poisoned samples, we visualize the distribution of aggregated en- tropy scores [z, g) across the training set. As shown in Fig. the distribution exhibits clear bimodal structure: clean samples tend to yield higher entropy, reflecting dispersed and seman- tically grounded attention, while poisoned sam- ples cluster in the low-entropy region, indicating collapsed focus on localized triggers. This con- trast confirms that attention entropy provides strong intrinsic signal for detecting anomalous training data, aligning well with the observed cleaning performance in our main results.
Distribution of Sample-level Entropy Score
Number of Samples
800
Poisoned
Clean
Clean
Samples
600
500
Suspicious
300
Backdoor Samples
(low entropy)
100
Entropy Score
Figure 3: Visualization of attention entropy scores, separating clean and poisoned samples.
5.4 Ablation Studies
We conduct ablation studies to assess the impact of key components in the BYE pipeline, with Fl score as the unified evaluation metric. Specifically, we compare four variants: (i) a baseline that removes both the GMM-bassed clustering and BSI-based sensitive layer selection, applying fixed entropy threshold of 4.5 across all layers (w/o GMM + BSI); (ii) a variant that retains layer selection

---

w/o (GMM + BS1)
W/O GMM
w/o BSI
EDL
F1 Score (8)
FI Scorr (50)
Fi Score (5a)
F2
LLavA
InterVIL
LLaVA
InterVLL
LLaVA
InterVLL
LLavA
InterVLL
ScienceQA
IconQA
Flickr30k
RSVQA
Figure 4: Ablation study showing Fl scores across BYE variants with different component removals, highlighting the impact of GMM-based clustering and BSI-based layer selection. Details in Fig.
but replaces GMM clustering with fixed thresholding (w/o GMM): (iii) a variant that retains GMM clustering but aggregates entropy from all layers without BSI selection (w/o BSI); and (iv) the full BYE method. As shown Fig. removing both GMM and BSI leads the largest drop in FI scores, indicating that simple thresholding across noisy layers severely compromises poisoned sample detection. Reintroducing BSI while omitting GMM improves performance, but remains suboptimal due to the inability of fixed thresholds to adaptively model bimodal entropy distributions. Conversely, using GMM clustering while ignoring layer sensitivity also degrades detection, highlighting the presence of non-informative attention signals across layers. These results demonstrate that both selective attention layer processing and adaptive, data-driven thresholding are essential achieving robust backdoor cleaning performance.
5.5
The Resistance Potential Adaptive Attacks
To assess the robustmess of BYE against poten- tial threats, we simulate multi-trigger attacks on ScienceQA [55] dataset that distribute mul- tiple patches within single image to weaken localized attention collapse. This setting mimics adaptive attackers who attempt to evade entropy- based defenses by dispersing influence across regions. We implement two variants: (1) Fixed
Table 3: Performance under multi-trigger attacks, reporting CP, ASR, P, R, and Fl score.
Trigger Type
CP1
ASR 4
Pt
R
P1
Default Single
89.64
0.05
98.82
94.69
96.71
Fixed Dual
88.42
0.10
92.48
97.10
94.73
Varied Multi
87.95
1.16
78.81
88.56
83.40
Dual Trigger, placing two identical triggers symmetrically; and (2) Varied Multi Mulgi-rrigger, embedding triggers at fixed grid points create dispersed visual influence. As shown in Tab. BYE retains high CP and suppresses ASR across both cases. Though multiple triggers reduce the saliency of any single region, our entropy aggregation remains effective in capturing global abnormality. Notably, the recall remains high even under dispersed settings, indicating that BYE is sensitive collective deviations in attention dynamics. We further extend this analysis in Sec. D evaluating BYE under diverse trigger types with varied styles and spatial distributions. These results confirm that BYE generalizes beyond conventional Annle-trigger settings and resists more evasive poisoning strategies.
6 Conclusion
We propose Believe Your Eyes (BYE), framework for backdoor purification downstream-tune MLLMs, driven by the observation that malicious fine-tuning induces abnormal concentration of cross-modal attention which termed attention collapse. BYE leverages internal attention entropy as a self-supervisory signal to detect and remove poisoned samples without relying any supervision validation set. Through extensive experiments across multiple models and datasets, we demonstrate that BYE achieves substantial attack mitigation while maintaining high clean performance. Our results offer a practical and scalable solution to the growing security risks in -aa-inng------ervice (FTaaS) scenarios, paving the way for the development of inherently self- self-protective MILMMs.
Limitation. While BYE operates an offline preprocessing step, its integration into training time or online adaptation pipelines remains unexplored and may involve additional design challenges. In addition, our evaluation focuses on single-stage fine-tuning; extending the method to continual or task-transfer settings could further improve adaptability in dynamic environments. We leave these directions for future investigation broaden the applicability of our approach.

---

Acknowledgement
This work is supported by National Natural Science Foundation of China under Grant (6236] 166629, 622251 13, 623B2080), the Major Project of Science and Technology Innovation of Hubei Province (2024BCA003, 2025BEA002), and the Innovative Research Group Project of Hubei Province under Grants 2024AFA017. The supercomputing system at the Supercomputing Center of Wuhan University supported the numerical calculations in this paper.
References
[1] Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774. 2023.
[2] Mistral AL.
[3] lean-Baptiste Alayrac, Jeff Donahue, Pauline Luc, Antoine Miech, lain Barr, Yana Hasson, Karel Lene, Arthur Mensch, Katherine Millican, Malcolm Reynolds, et al. Flamingo: visual language model for few-shot learning. NeurlPS, pages 23716-23736, 2022.
[4] Jinze Bai, Shuai Bai, Shusheng Yang, Shijie Wang. Sinan Tan, Peng Wang, Junyang Lin, Chang Zhou, and Jingren Zhou. Qwen-vl: A frontier large vision-language model with versatile abilities. arXiv preprint arXiv:2308. /2966, 2023.
[5] Yang Bai, Yucheng Ji, Min Cao, Jinqiao Wang, and Mang Ye. Chat-based person retrieval via dialogue-refined cross-modal alignment. In CVPR, 2025.
[6] Yang Bai, Jingyao Wang, Min Cao, Chen Chen, Ziqiang Cao, Liqiang Nie, and Min Zhang. Text-based person search without parallel image-text data. In ACM MM, pages 757-767, 2023.
[7] Jinhe Bi, Yifan Wang, Danqi Yan, Xun Xiao, Artur Hecker, Volker Tresp, and Yunpu Ma. Prism: Self-pruning intrinsic selection method for training-free multimodal data selection. arXiv preprint 250iv:2502.1211 2025.
[8] Jinhe Bi, Yujun Wang. Haokun Chen, Xun Xiao, Artur Hecker, Volker Tresp, and Yunpu Ma. Visual instruction tning with 500x fewer parameters through modality linear representation- steering. arXiv preprint arXiv:2412. 12359, 2024.
[9] Liwei Che, Tony Qingze Liu, Jing Jia, Weiyi Qin, Ruixiang Tang, and Vladimir Pavlovic. Fazy: Eliminating hallucinations in Ivlms by zeroing out hallucinatory image tokens. arXiv preprint arXiv:2503.0777 070.00772, 2025.
[10] Dongping Chen, Ruoxi Chen, Shilin Zhang, Yaochen Wang, Yinuo Liu, Huichi Zhou, Qihui Zhang, Yao Wan, Pan Zhou, and Lichao Sun. Mllm-as-a-judeee Assessing multimodal llm-as-a-judge with vision-language benchmark. In ICML., 2024.
[1]] Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv: /tti::/712.05522 2017.
[12] Yukun Chen, Boheng Li, Yu Yuan, Leyi Qi, Yiming Li, Tianwei Zhang, Zhan Qin, and Kui Ren. Taught well learned ill: Towards distillation distillation-condttiona. conditional backdoor attack. NeurlPS, 2025.
[13] Yukun Chen, Shuo Shao, Enhao Huang, Yiming Li, Pin-Yu Yu Chen, Zhan Qin, and Kui Ren. Refine: Inversion-free backdoor defense via model reprogramming. ICLR, 2025.
[14] Zhe Chen, Weiyun Wang, Yue Cao, Yangzhou Liu, Zhangwei Gao, Erfei Cui, Jinguo Zhu, Shen- glong Yc, Hao Tian, Zhaoyang Liu, et al. Expanding performance boundaries of open-source multimodal models with model, data, and test-time scaling, arXiv preprint 1r20522412.05221. 2024.
[15] Wei-Lin Chiang. Zhuohan Li, Zi Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E. Gonzalez, Ion Stoica, and Eric Xing. Vieuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality, March 2023.
10

---

[16] Edward Chou, Florian Tramer, and Giancarlo Pellegrino. Sentinet: universal attacks against deep learning systems. In 2020 IEEE Security and Privacy Workshops (SPW), pages 48-54. IEEE, 2020.
Detecting localized
[17]
Aakanksha Chowdhery, Sharan Narang, Jacob Devlin, Maarten Bosma, Gaurav Mishra, Adam Roberts, Paul Barham, Hyung Won Chung, Charles Sutton, Sebastian Gehrmann, et al. Palm: Scaling language modeling with pathways. JMLR, pages 1-113, 2023.
[18] Can Cui, Yunsheng Ma, Xu Cao, Wenqian Ye, Yang Zhou, Kaizhao Liang, Jintai Chen, Juanwu Lu, Zichong Yang, Kuei-Da Liao, al. A survey on multimodal large language models for autonomous driving. In WACV, pages 958-979, 2024.
[19] Yi Ding, Lijun Li, Bing Cao, and Jing Shao. Rethinking bottlenecks in safety fine-tuning of vision language models. arXiv preprint arXiv:2501.18533, 2025.
[20] Yi Ding and Ruqi Zhang. Sherlock: Self-correcting reasoning in vision-language models. arXiv preprint
2025.
[21] Yinpeng Dong, Huanran Chen, Jiawei Chen, Zhengwei Fang, Xiao Yang, Yichi Zhang, Yu Tian, Hang Su, and Jun Zhu. How robust is google's bard adversarial image attacks? arXiv preprint arXiv:2309. 1751, 2023.
[22] Yiyang Fang. Jian Liang, Wenke Huang, He Li, Kehua Su, and Mang Ye. Catch your emotion: Sharpening emotion perception in multimodal large language models. In ICML, 2025.
[23] Jiahui Gao, Renjie Pi, Tianyang Han, Han Wo, Lanqing Hong, Lingpeng Kong, Xin Jiang, and Zhenguo Li. Coca: Regaining safety-s of multimodal large language models with constitutional calibration. arXiv preprint arXiv:2409. 11365, 2024.
[24] Yansong Gao, Yeonjae Kim, Bao Gia Doan, Zhi Zhang, Gongxuan Zhang, Surya Nepal, Damith Ranasinghe, and Hyoungshick Kim. Design and evaluation of multi-domain trojan detection method on deep neural networks. TDSC, pages 2349-2364, 2021.
[25] Yansong Gao, Change Xu, Derui Wang, Shiping Chen, Damith C Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks on deep neural networks. In ACSAC, pages 125, 2019.
[26] Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang. Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. Figstep: Jailbreaking large saiionlanguage models via typographic visual prompts. arXiv preprint arXiv:231 100-2311..000 1.05608, 2023.
[27] Yunhao Gou, Kai Chen, Zhili Liu, Lanqing Hong, Hang Xu, Zhenguo Li, Dit-Yan Yeung, James T Kwok, and Yu Zhang. Eyes closed, safety on: Protecting multimodal Ilms via image-to-text transformation. In ECCV, pages 388-404. Springer, 2024.
[28] Linshan Hou, Ruili Feng, Zhongyun Hua, Wei Luo, Leo Yu Zhang, and Yiming Li. Ibd-psc: Input-level backdoor detection via parameter-oriented scaling consistency. ICML, 2024.
[29] Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al. Lora: Low-rank adaptation of large language models. JCLR, page 3, 2022.
[30] Kunzhe Huang, Yiming Li, Baoyuan Wu, Zhan Qin, and Kui Ren. Backdoor defense via decoupling the training process. ICLR, 2022.
[31] Tiansheng Huang, Sihao Hu, Fatih Ilhan, Selim Furkan Tekin, and Ling Liu. Harmful fine-tuning attacks and defenses for large language models: A survey. arXiv preprint 1rXV::2409.18169 2024.
[32] Tiansheng Huang, Sihao Hu, and Ling Liu. Vaccine: Perturbation-awarc alignment for large language models against harmful fine-tuning attack. NeurIPS, 2024.
[33] Wenke Huang, Jian Liang, Xianda Guo, Yiyang Fang, Guancheng Wan, Xuankun Rong, Chi Wen, Zekun Shi, Qingyun Li, Didi Zhu, et al. Keeping yourself is important downstream tuning multimodal large language model. arXiv preprint arXiv:2503 0454344443,,,,. 2025.
11

---

[34] Wenke Huang, Jian Liang, Zekun Shi, Didi Zhu, Guancheng Wan, He Li, Bo Du, Dacheng Tao, and Mang Ye. Learn from downstream and be yourself in multimodal large language model fine-tuning. In ICMI, 2025.
[35] Wenke Huang, Jian Liang, Guancheng Wan, Didi Zhu, He Li, Jiawei Shao, Mang Ye, Bo Du, and Dacheng Tao. Be confident: Uncovering overfitting in milm multi-task tuning. In ICML, 2025.
[36] Mojan Javaheripi, Mohammad Samragh, Gregory Fields, Tara Javidi, and Farinaz Koushanfar, Cleann: Accelerated trojan shield for embedded neural networks. In ICCD, pages 1-9, 2020.
[37] Boheng Li, Junjie Wang, Yiming Li, Zhiyang Hu, Leyi Qi, Jianshuo Dong, Run Wang, Han Qiu, Zhan Qin, and Tianwei Zhang. Dream: Scalable red teaming for text-to-image generative systems via distribution modeling. IEEE S&P, 2026.
[38] Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. B2ip-2: Bootstrapping language- image pre-training with frozen image encoders and large language models. In International conference on machine learning, pages 19730-19742. PMLR, 2023.
[39] Yifan Li, Hangyu Guo, Kun Zhou, Wayne Xin Zhao, and Ji-Rong Wen. Images are achilles' heel of alignment: Exploiting visual vulnerabilities for jailbreaking multimodal large language models. arXiv preprint 2rXiv:2403.09792, 2024.
[40] Yige Li, Xixiang Lyu, Nodens Koren, Lingjuan Lyu, Bo Li, and Xingjun Ma. Neural attention distillation: Erasing backdoor triggers from deep neural networks. ICLR, 2021.
[41] Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Backdoor learning: survey. IEEE TNNLS, pages 5-22, 2022.
[42] Yinshan Li, Hua Ma, Zhi Zhang, Yansong Gao, Alsharif Abuadbba, Anmin Fu, Yifeng Zheng, Said F Al-Sarawi, and Derek Abbott. Ntd: Non-transferability enabled backdoor detection. IEEE TIFS, 2021.
[43] Yuetai Li, Zhangchen Xu, Fengqing Jiang, Luyao Niu, Dinuka Sahabandu, Bhaskar Ramasub- ramanian, and Radha Poovendran. Cleangen: Mitigating backdoor attacks for generation tasks in large language models. EMNLP, 2024.
[44] Haoyuan Liang, Xinyu Zhang, Shilei Cao, Guowen Li, and Juepeng Zheng, Tta-feddg: Leveraging test-time adaptation address federated domain generalization. In AAAL, pages 18858-18666 2025.
[45] Jian Liang, Wenke Huang, Xianda Guo, Guancheng Wan, Bo Du, and Mang Ye. Thanora: Task heterogeneity-awaan multi-task low-rank adaptation. arXiv preprint 18554 2025.
[46] Jian Liang, Wenke Huang, Guancheng Wan, Qu Yang, and Mang Ye. Lorasculpt: Sculpting Iora for harmonizing general and specialized knowledge in multimodal large language models. CVPR, 2025.
[47] Jiawei Liang, Siyuan Liang, Man Luo, Aishan Liu, Dongchen Han, Ee-Chien Chang, and Xiaochun Cao. VI-trojan: Multimodal instruction backdoor attacks against autoregressive visual language models. arXiv preprint arXiv:2402. 13851, 2024.
[48] Siyuan Liang, Jiawei Liang, Tianyu Pang, Chao Du, Aishan Liu, Fe-Chien Chang, and Xiaochun Cao. Revisiting backdoor attacks against large vision-language models. arXiv preprint arXiv:2406. 18844, 2024.
[49] Aristidis Likas, Nikos Vlassis, and Jakob Verbeek. The global k-means clustering algorithm. PR. pages 451 1611,4612220 2003.
[50] Ji Lin, Hongxu Yin, Wei Ping, Pavlo Molchanov, Mohammad Shoeybi, and Song Han. Vila: On pre-training for visual language models. In CVPR, pages 26689-26699, 2024.
[51] Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. Visual instruction tuning. NeurIPS, 36:34892-349415 2023.
12

---

[52] Yue Liu, Shengfang Zhai, Mingzhe Du, Yulin Chen, Tri Cao. Hongcheng Gao, Cheng Wang, Xinfeng Li. Kun Wang, Junfeng Fang, Jiaheng Zhang, and Bryan Hooi. Guardreasoner-vi. Safeguarding vims via reinforced reasoning. arXiv preprint arXiv:2505. 1049, 2025.
[53] Yuntao Liu, Ankit Mondal, Abhishek Chakraborty, Michael Zuzak, Nina Jacobsen, Daniel Xing, and Ankur Srivastava. Neural trojans. In ESCP, pages 1648-1655. Springer, 2025.
[54] Sylvain Lobry, Diego Marcos, Jesse Murray, and Devis Tuia. Rsvqa: Visual question answering for remote sensing data. IEEE TGRS, pages 8555-8566, 2020.
[55] Pan Lu, Swaroop Mishra, Tanglin Xia, Liang Qiu, Kai- Wei Chang, Song-Chun Zhu, Oyvind Tafjord, Peter Clark, and Ashwin Kalyan, Learn to explain: Multimodal reasoning via thought chains for science question answering. NeurIPS, 35:2507-25211 2022.
[56] Pan Lu, Liang Qiu, Jiaqi Chen, Tony Xia, Yizhou Zhao, Wei Zhang, Zhou Yu, Xiaodan Liang, and Song-Chun Zhu. Iconga: A new benchmark for abstract diagram understanding and visual language reasoning. arXiv preprint arXiv: 132144 2021.
[57] Weimin Lyu, Lu Pang, Tengfei Ma, Haibin Ling, and Chao Chen. Trojvlm: Backdoor attack against vision language models. arXiv preprint arXiv:2409.19232 2024.
[58] Weimin Lyu, Jiachen Yao. Saumya Gupta, Lu Pang. Tao Sun, Lingjie Yi, Lijie Hu, Haibin Ling, and Chao Chen. Backdooring vision- vision-language models with out-of-distribution data. arXiv preprint arXiv:2410.01200 2024.
[59] Siyuan Ma, Weidi Luo, Yu Wang, Xiaogeng Liu, Muhao Chen, Bo Li, and Chaowei Xiao. Visual-roleplay: Universal jailbreak attack on multimodal large language models via role- playing image characte. arXiv preprint arXiv.2405.20773 2024.
[60] Ziqi Miao, Yi Ding, Lijun Li, and Jing Shao. Visual contextual attack: Jailbreaking milms with image-driven context injection. arXiv preprint (xXi::5577002444 2025.
[61] Zhenyang Ni, Rui Ye, Yuxi Wei, Zhen Xiang, Yanfeng Wang, and Siheng Chen. Physical backdoor attack can jeopardize driving with vision-large-langaage models. arXiv preprint arXiv:2404.1200 2024.
[62] Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. purffiictooi.if.iiatttiooo...... ICML,
[63] OpenAL. Fine-tuning.
[64] Renjie Pi, Tianyang Han, Jianshu Zhang, Yueqi Xie, Rui Pan, Qing Lian, Hanze Dong, Jipeng Zhang, and Tong Zhang. Milm- proterrotctto:: Ensuring milm's safety without hurting performance. arXiv preprint 2xX1:24011.2900 2024.
[65] Renjie Pi, Jianshu Zhang, Tianyang Han, Jipeng Zhang, Rui Pan, and Tong Zhang. Personalized visual instruction tuning. ICLR, 2024.
[66] Renjie Pi, Jianshu Zhang, Jipeng Zhang, Rui Pan, Zhekai Chen, and Tong Zhang. Image textualization: An automatic framework for creating accurate and detailed image descriptions. NeurIPS, 2024.
[67] Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun. Onion: simple and effective defense against textual backdoor attacks. EMNLP. 2021.
[68] Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. Visual adversarial examples jailbreak aligned large language models. In AAAI, pages 21527-21536, 2024.
[69] Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yo Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. Fine-tuning aligned language models compromises safety, even when users do not intend to! arXiv preprint 2311v:2310.03693,000 2023.
13

---

[70] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin. Jack Clark, et al. Learning transferable visual models from natural language supervision. In ICMI., pages 8748-8763 PMLR, 2021.
[71] Douglas A Reynolds et al. Gaussian mixture models. Encyclopedia of biometries, page 3, 2009.
[72] Christian Schlarmann and Matthias Hein. On the adversarial robustness of multi-modal foundation models. In ICCV, pages 3677-3685, 2023.
[73] Wei Shen, Wenke Huang, Guancheng Wan, and Mang Ye. Label-free backdoor attacks in vertical federated learning. In AAAI, 2025.
[74] Yucheng Shi, Mengnan Du, Xuansheng Wu, Zihan Guan, Jin Sun, and Ninghao Liu. Black-box backdoor defense via zero-shot image purification. NeurlPS, 36:57336-57366 2023.
[75] Xiaofei Sun, Xiaoya Li, Yuxian Meng, Xiang Ao, Lingjuan Lyu, Jiwei Li. and Tianwei Zhang. Defending against backdoor attacks in natural language generation. In AAAI, pages 5257-5265, 2023.
[76] Ruixiang Tang. Jiayi Yuan, Yiming Li, Zirui Liu, Rui Chen, and Xia Hu. Setting the trap: Capturing and defeating backdoor threats in pims through honeypots. NeurlPS, 2023.
[77] Gemini Team, Rohan Anil, Sebastian Borgeaud, Jean-Baptiste Alayrac, Jiahui Yu, Radu Soricut, Johan Schalkwyk, Andrew M Dai, Anja Hauth, Katie Millican, et al. Gemini: family of highly capable multimodal models. arXiv preprint arXiv:2312. 1805, 2023.
[78] Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timo- thée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprini arXiv: 13971, 2023.
[79] Minh-Hao Van, Prateek Verma, and Xintao Wu. On large visual language models for medical imaging analysis: An empirical study. In CHASE, pages 172-176. IEEE, 2024.
[80] Ramakrishna Vedantam, C Lawrence Zitmick, and Devi Parikh. Cider: Consensus-basee based image description evaluation. In CVPR, pages
2015.
[81] Sudong Wang, Yunjian Zhang, Yao Zhu, Jianing Li, Zizhe Wang, Yanwei Liu, and Xiangyang
Ji. Towards understanding how knowledge evolves in large vision- -sionnlanguage models. arXiv preprint arXiv:2504. 028622, 2025.
[82] Yibo Wang, Tiansheng Huang, Li Shen, Huanjin Yao, Haotian Luo, Rui Liu, Naiqiang Tan, Jiaxing Huang. and Dacheng Tao. Panacea: Mitigating harmful fine-tuning for large language models via post-fine-tuning perturbation. arXiv preprint 1rXiv:2501.18100 2025.
[83] Yu Wang, Xiaogeng Liu, Yu Li, Muhao Chen, and Chaowei Xiao. Adashield: Safeguarding multimodal large language models from structure-based attack via adaptive shield prompting. ECCV, 2024.
[84] Yu Wang, Xiaofei Zhou, Yichen Wang, Geyuan Zhang, and Tianxing He. Jailbreak large visual language models through multi-modal linkage. arXiv preprint arXiv:4412.00473, 2024.
[85] Shicheng Xu, Liang Pang, Yunchang Zhu, Huawei Shen, and Xueqi Cheng. Cross-modal safety mechanism transfer large lanion-language models. arXiv preprint arXiv:2410.12662. 2024.
[86] Xiong Xu, Kunzhe Huang, Yiming Li, Zhan Qin, and Kui Ren. Towards reliable and efficient backdoor trigger inversion via decoupling benign features. In ICLR, 2023.
[87] Yue Xu, Xiuyuan Qi, Zhan Qin, and Wenjie Wang. Cross-modality information check for detecting jaibbrekking in multimodal large language models. EMNLP, 2024.
[88] Jinluan Yang, Anke Tang, Didi Zhu, Zhengyu Chen, Li Shen, and Fei Wu. Mitigating the backdoor effect for multi-task model merging via safety-aware subspace. ICLR, 2024.
14

---

[89] Yanxin Yang, Chentao Jia, DengKe Yan, Ming Hu, Tianlin Li, Xiaofei Xie, Xian Wei, and Mingsong Chen. Sampdetox: Black-box backdoor defense via perturbation bbased sample detoxification. NewrIPS, 2024.
[90] Mang Ye, Xuankun Rong, Wenke Huang, Bo Du, Nenghai Yu, and Dacheng Tao. A survey safety on large vision- langunlanguuge models: Attacks, defenses and evaluations. arXiv preprint arXiv:2502. 14881, 2025.
[91] Mang Ye, Wei Shen, Bo Du, Eduard Snezhko, Vassili Kovalev, and Pong C Yuen. Vertical federated learning for effectiveness, security, applicability: A survey. CSUR, 2025.
[92] Mang Ye, Wei Shen, Junwu Zhang, Yao Yang, and Bo Du. Securereid: Privacy-preserving anonymization for person re-identification. TIFS, 2024.
[93] Biao Yi, Tiansheng Huang, Sishuo Chen, Tong Li, Zheli Liu, Zhixuan Chu, and Yiming Li. Probe before you talk: Towards black-hox defense against backdoor unalignment for large language models. ICLR, 2025.
[94] Shukang Yin, Chaoyou Fu, Sirui Zhao, Ke Li, Xing Sun, Tong Xu, and Enhong Chen. A survey multimodal large language models. arXiv preprint arXiv:2306. 13549, 2023.
[95] Peter Young, Alice Lai, Micah Hodosh, and Julia Hockenmaier. From image descriptions to visual denotations: New similarity metrics for semantic inference over event descriptions. TACL, 2:67-78, 2014.
[96] Zenghui Yuan, Jiawen Shi, Pan Zhou, Neil Zhenqiang Gong, and Lichao Sun. Badtoken: Token- level backdoor attacks to multi-modal large language models. arXiv preprint 16X2: 2025.
[97] Jianshu Zhang, Dongyu Yao, Renjie Pi, Paul Pu Liang, and Yi R Fung. VIm2-bench: A closer look at how well vlms implicitly link explicit matching visual cues. arXiv preprint arXiv:2502. 12084, 2025.
[98] Jiarui Zhang. Mahyar Khayatkhoei, Prateek Chhikara, and Filip llievski. Milms know where look: Training-fres perception of small visual details with multimodal llms. ICLR, 2025.
[99] Xiaofeng Zhang, Yihao Quan, Chen Shen, Xiaosong Yuan, Shaotian Yan, Liang Xie, Wenxiao Wang. Chaochen Gu, Hao Tang, and Jieping Ye. From redundancy to relevance: Information flow Ivlms across reasoning tasks. NAACL, 2024.
[100] Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mohamed Elhoseiny. Minigpt-4: Enhancing vision-language understanding with advanced large language models. arXiv preprint arXiv:2304. 10592, 2023.
[101] Yongshuo Zong. Ondrej Bohdal, Tingyang Yu, Yongxin Yang, and Timothy Hospedales. Safety fine-tur te--tuning at (almost) no cost: A bascline for vision large language models. ICML, 2024.
15

---

NeurIPS Paper Checklist
The checklist is designed encourage best practices for responsible machine learning research, addressing issues of reproducibility, transparency, research ethics, and societal impact. Do not remove the checklist: The papers not including the checklist will be desk rejected. The checklist should follow the references and follow the (optional) supplemental material. The checklist does NOT count towards the page limit.
Please read the checklist guidelines carefully for information on how to answer these questions. For each question in the checklist:
You should answer [Yes], [No] or [NA].
[NA] means either that the question is Not Applicable for that particular paper or the
relevant information is Not Available.
Please provide short (1-2 sentence) justificatin right after your answer (even for NA).
The checklist answers are an integral part of your paper submission. They are visible to the reviewers, area chairs, senior area chairs, and ethics reviewers. You will be asked to also include (after eventual revisions) with the final version of your paper, and its final version will be published with the paper.
The reviewers of your paper will be asked to use the checklist as one of the factors in their evaluation.
While "[Yes] " is generally preferable to "[No]" ", is perfectly acceptable to answer "[No] "provided proper justification is given (c.g., "error bars are not reported because it would be too computationally expensive" or "we were unable to find the license for the dataset we used"). "[No] or "[NA] is not grounds for rejection. While the questions are phrased in binary way, we acknowledge that the true answer often more nuanced, so please just use your best judgment and write justification to elaborate. All supporting evidence can appear either in the main paper or the supplemental material, provided in appendix. If you answer [Yes] to a question, in the justification please point to the section(s) where related material for the question can be found.
general, answering
IMPORTANT, please:
Delete this instruction block, but keep the section heading "NeurIPS Paper Checklist",
Keep the checklist subsection headings, questions/answers and guidelines below.
Do not modify the questions and only the provided macros for your answers.
1. Claims
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Question:
Answer: [Yes]
Justification: The abstract and introduction clearly state the main claims, including the identification of attention collapse in MLLMs under backdoor attacks and the proposal of BYE for unsupervised purification.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results be expected to generalize other settings.
is fine include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes]
16

---

Justification:
The paper includes dedicated Limitation section (Sec. 6
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors encouraged to create separate "I "Limitations" section in their paper.
The paper should point any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model sele--pecfiiatinn. asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
Justification: The paper does not include formal theoretical results or theorems that require
assumptions and complete proofs. The methodology empirical and algorithmic (Sec.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: The paper provides sufficient experimental details to reproduce results, in- cluding model types, dataset splits, trigger configurations, training hyperparameters, and evaluation metrics.
17

---

Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) If the contribution is primarily new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-soneee open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: An anonymized version of the code and data reproduction instructions has been included in the supplementary material for the purpose of review. We plan to release the full code and datasets publicly.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurIPS code and data submission guidelines (https://nips.cm cc/
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https
/ //nips. ctipss.cc/ublic//uui.eu www.iiiciguiieseieeeeeeeeeeeeeee
ssionoolicy for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
18

---

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We provide all necessary training and testing details, including models, datasets, learning rates, batch size, and training epochs, Sec. 5. and Sec.
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [No]
Justification: We did not report eтror bars or confidence intervals, as each experiment was conducted once due the high computational cost fine-tuning large MLLMs. We plan to include repeated trials in future work for more comprehensive statistical analysis.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We report the compute environment and fine-tuning setup details in Sec. A
19

---

Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics http:////aeaapss.ccppcceeeeeeeee
Answer: [Yes]
Our research focuses on improving the safety of MLLMs by mitigating backdoor threats. does not involve human subjects, sensitive personal data, deployment in real-world systems, and fully adheres to the NeurlPS Code of Ethics.
Justification:
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive socictal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification:
We discuss the broader impacts in Sec.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g.. disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of MI.).
11. Safeguards
20

---

Question: Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Answer: [NA]
Justification: Our work does not release any new pretrained models or datasets that pose risk of misuse. We evaluate on publicly available datasets and pretrained MLLMs, and our contributions focus on improving model robustness against backdoor threats.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
Licenses existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: All external assets used in this paper, including LLaVA-1.5-78 and Intern 2.5-8B models, as well the ScienceQA, IconQA, Flickr30k, and RSVQA datasets, are properly cited with corresponding references. Their licenses (e.g., Apache 2.0, CC BY 4.0) are respected, and no unauthorized or scraped content was used.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website). the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. cam/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. If this information is not available online, the authors encouraged to reach out to the asset's 's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: We do not introduce new datasets or pretrained models. The only asset the implementation of our proposed method, which is provided as anonymized supplemental code for reproducibility purposes.
Guidelines:
The answer NA means that the paper does not release new assets.
21

---

Researchers should communicate the details of the dataset/codeemmodel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: Our work does not involve crowdsourcing or research with human subjects.
Guidelines:
The answer NA means that the paper does involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals or equivalent for research with human subjects
Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Question:
Answer: [NA]
Justification: Our rescarch does not involve human subjects or crowdsourcing, so IRB approval is not applicable.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMSs if it is important, original, or non-standard component of the core methods this research? Note that if the L.LM used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification: Our research does not involve the use of L.MSs in any important, original, or non-standard way. LLMs were not used for data generation, analysis, or methodology design.
Guidelines:
22

---

The answer NA means that the core method development in this research does not involve LLMs as any important. original, non-standard components.
Please refer to our LLM policy (https://neurip: /ttp://pp//cc/oofffeeeee//////// for what should or should not be described.
23

---

A Detailed Setups of Our Experiments
A.1 Downstream Datasets
We provide here detailed descriptions of the four downstream datasets used in our experiments. These datasets cover diverse modalities and task types, including image captioning and multiple-choice VQA, enabling comprehensive evaluation of BYE across varied real-world settings. Details in Tab, 4
ScienceQA. ScienceQA (55] is a multimodal multiple-choice QA benchmark for science education, involving questions grounded in both text and images. We use 6,218 training and 2,017 test samples. Each instance consists of science question with a set of image-based and textual choices. The model is required to select the correct option label (e.g.. "A", "B"), with accuracy the primary metric.
IAOnQA. IconQA [56] focuses on abstract diagram understanding, requiring models to reason over symbolic and schematic visual content. We follow the multiple-choice setting (10,000 train / 6,316 test). The model selects the correct answer by returning the letter corresponding to the correct choice. Accuracy used for evaluation.
Flickr30k. Flickr30k [95] is widely-used image captioning dataset consisting of everyday scenes involving human and object interactions. We select subset containing 10,000 training and 1,000 test images, following prior vision-and-lanuune (V+L) instruction tuning setups. The task is to generate a one-sentence caption for a given image. Performance is evaluated using the CIDEr score (80).
RSVQA. RSVQA [54] is visual question answering benchmark designed for remote sensing imagery. contains high-resolution satellite images paired with natural language questions and short answers. We select 10,000 training and 10,004 test samples. The model is expected to answer each question using a concise word or phrase, with accuracy as the evaluation metric.
Table 4: Detailed downstream dataset descriptions.
Datasets
ScienceQA (55)
IconQA (56)
Flickr30k 995)
RSVQA (54)
(Train/ess)
(6218/2017)
(100006316)
(10000/1000)
(1000010004)
Venue
[NeurIPS'22]
[arXiv'20]
[TACL'14]
[TGRS'
Science Question Answering
Abstract Diagram Understanding
Everyday Activities Portrayal
VQA for
Task
Remote Sensing
Metric
Accuracy (1)
Accuracy (1)
CIDEr (1)
Accuracy (1)
Answer
Option
Option
Caption
Phrase
Answer with the option's letter from the given
Answer with the option's letter from the given choices directly
Provide one-sentence caption for the provided image.
Answer the question using single word or phrase.
Prompt
choices directly
Description
Which country is highlighted? A. Saint Lucia B. Jamaica C. Haiti Cuba A: D
Q: How many there?
A: dog jumps by free while another lays on the ground.
Q: there road? A: Yes
A. A.
D.7
A:
A.2 Finetune Hy Hyperparameters
All models were fine-tuned using 4 NVIDIA RTX 4090 GPUs (48 GB each). We adopted LoRA- based lightweight fine-tuning for all experiments. For each dataset, models were trained for 3 epochs with a global batch size of 16. The learning rate was set to 2e-4 for LLaVA-1.557B and 4e-5 for InternVL.-2.5--88 Unless otherwise specified, the optimizer used was Adam with a linear learning rate decay schedule. Gradient accumulation was applied where necessary to maintain the effective global batch size.
24

---

A.3 Selection of the BSI Threshold
We the BSI threshold Tbs to 2.0. Intuitively. this choice requires the mean separation between the two Gaussian components to exceed the combined standard deviation, indicating moderate to strong bimodal structure. Setting lower threshold would include noisy or weakly informative layers, while a higher threshold risks excluding layers with meaningful discriminative power.
To validate this choice, conduct ablation study varying Tbsi E {0, 0.5, 1.0, 1.5, 2.5, 3.0) and evaluate poisoned sample detection performance, including Precision (P), Recall (R), and F1 score. As summarized in Tab. 5 lower thresholds result in higher recall but significantly lower precision due to noise amplification, while overly striet thresholds (e.g., Thsi 3.0) fail to detect any sensitive layers. Setting Thii 2.0 achieves the best trade-off, yielding the highest F1 score and maintaining robust detection quality.
Table 5: Effect of BSI threshold That poisoned sample detection. Precision (P), Recall (R), and F1 score are reported for different threshold settings.
Tisi
Precision (P)
Recall (R)
F1
0.0
48.13
95.17
63.93
0.5
67.78
94.52
78.95
1.0
96.90
90.66
93.68
1.5
97.75
90.82
94.16
2.0
98.82
94.69
96.71
2.5
96.74
95.65
96.19
3.0
Sensitive Layer Detected
B Computation Cost
BYE consists of three steps: (1) Standard fine-tuning the (possibly poisoned) dataset (about 30 minutes), (2) One-time inference pass for suspicious sample detection (about minutes), (3) Re-training the filtered clean set (about 30 minutes). As shown in Tab. 6 BYE takes total of 72 minutes on 4xRTX 4090 GPUs for 6k samples. By contrast, diffusion- based methods like ZIP [74] require similar fine-tuning but add time-consuming purification stage, taking at least hours of GPU time for the same dataset depends on the chosen diffusion model. Total: 162 minutes or more.
Table 6: Comparison of total computational time (in minutes) for BYE and ZIP.
Method Training
Entropy/Purity Retraining Inference
Total
ZIP
30
128
4
162
BYE
30
30
4
C
Comparison with More Baselines
We further compare BYE with two representative inference-time defenses that purify poisoned inputs without retraining: (1) DiffPure [2)), which leverages diffusion models to denoise and restore clean visual content from potentially poisoned images; (2) SampDetox [9)] which performs two-stage stochastic perturbation and denoising to detoxify samples at inference time. As shown in Tab. BYE consistently achieves the best performance on both ScienceQA and IconQA, simultaneously yielding the highest CP and the lowest ASR.
D Resistance under Diverse Trigger Types
D.1 Patch trigger
To assess the robustness and generalization ability of our method under diverse backdoor strategies, we consider three distinct trigger designs that differ spatial placement and visual characteristies:
(1) Default, a fixed black square at the image center; (2) Random Position, where the same patch is
25

---

Table 7: Comparison of BYE under more baselines.
ScienceQA CP
IconQA
Method
ASR +
CP1
ASR
ZIP 74
79.97
66.48
77.60
67.97
DurtPure 62
81.71
78.08
79.04
77.51
SampDetox 89
83.59
90.62
72.86
67.74
BYE
89.64
0.05
83.39
0.00
Table 8: Performance under diverse trigger types, reporting CP, ASR, P. R, and F1.
Trigger Type
CP
ASR
Pt
R.
Fl
Default
89.64
0.05
98.82
94.69
96.71
Random Position
89.59
0.19
92.93
93.08
93.56
Texture Patch
87.95
0.04
80.10
95.81
87.22
placed at varying locations; and (3) Texture Patch, which overlays high- high-frequency checkerboard pattern. These triggers simulating realistic attack variations. For all variants, we poison 10% of the training set by modifying the imput images and assigning fixed target label.
Since images in downstream tasks vary in resolution, we avoid using a fixed pixel-size trigger, which may appear too conspicuous in small images or ineffective in large ones. Instead, we define the trigger size relative the image's minimum side length: both the patch height and width are set to 1/16 of the minimum side length. This ensures that the trigger maintains a consistent relative scale across samples. For strategies, triggers are injected via direct pixel replacement before any data preprocessing augmentation. Examples of poisoned inputs and corresponding attention responses are shown Fig.
Default Trigger. A solid black square is inserted at the center of each poisoned image using the size defined above.
Random Position Trigger. The square patch is inserted randomly sampled location within each image. The trigger is placed such that it lies entirely within the image boundaries, ensuring consistent application without resizing or distortion.
Texture Trigger.
We generate a high-freguee freguereynnyyy checkerboard pattern of the same size and insert it the image center. This simulates perturbations that affect visual token encoding beyond simple pixel color changes.
As shown in Tab. 8 BYE consistently reduces ASR near-zero across all variants while maintaining high CP. Even under challenging trigger patterns, our method maintains high recall, demonstrating strong effectiveness identifying poisoned samples across varied attack strategies. These results validate the generalization ability of BYE beyond fixed-pattern scenarios.
D.2 Global trigger
We conduct additional experiments using Blended [11] attack, global and less visually obvious attack method, As shown in Tab. 9 BYE still achieves much lower ASR than all baseline methods, confirming that our approach is not limited simple visually distinctive triggers, but generalizes well to more adaptive and subtle attack types.
E Comparison of Clustering Methods
We compare three clustering methods for separating poisoned and clean samples based on the aggregated attention entropy ( q): (1) GMM (71), the default choice in main pipeline; (2) K-Means [49], a simpler probabbbaiiiittic clustering method; and (3) Fixed Threshold baseline that flags samples with H (xx q) 4.5 as poisoned.
As reported in Tab. TO both GMM and K-Means consistently outperform the fixed threshold method by a large margin across all datasets and models. Notably, the performance of GMM and K- K-Means is
26

---

(a) Default Trigger
Planet
Vollme (kmi)
Parnary composition
Mercury
6.08 10
Venus
9.28 10
rock
Earth
1.08 10
rock
1.63 10
Jupttr
1.43 10
Satarn
8.27 10
gas
Urenus
6.83 10
Neptine
10
(b) Random Position Trigger
Arabian Plate
Owen Fracture Zone
Indo Austrolion
(c) Texture Trigger
Figure 5: Visualization of different trigger designs. Each row corresponds a different trigger strategy applied to poisoned samples.
Table 9: Performance under blended attack
ScienceQA
IconQA
Method
CP ASR \
CP
ASR
Vanilla FT
89.89
99.70
83.34
99.77
DiffPure 62
82.85
77.24
78.54
84.91
ZIP 774)
87.11
91.12
79.81
96.77
SampDetox 89
82.45
95.93
73.27
93.77
BYE
85.72
54.18
79.32
59.77
highly similar, with Fl scores differing by less than 0.3 points on most benchmarks. This observation holds for both LLaVA and VL, and across datasets with diverse characteristics such structured visual reasoning (ScienceQA, IconQA) and open-ended captioning (Flickr30k).
We hypothesize that this similarity in performance stems from the relatively clean and well-separated entropy distribution produced by our model design. The poisoned and clean samples tend to cluster into two distinct groups in the entropy space, which makes the binary separation task straightforward. In such scenarios, the more complex assumptions made by GMM (e.g.. modeling full covariance structures) offer limited benefit over the centroid-baseed decision boundary of K-Means.
Despite the empirical parity, we opt to retain GMM in our default pipeline for two main reasons. First, GMM provides probabilistic framework that models variance and density explicitly, making more robust in scenarios with subtle or skewed distributions, such as low-poisoning-ret regimes or noisy real-world data. Second, GMM integrates naturally with entropy-based BSI layer selection,
27

---

Table 10: F1 score (%) of poisoned sample detection with different clustering methods.
Model
Method
ScienceQA
SS
IconQA [56]
Flickr30k 95
RSVQA [5
Threshold
71.52
32.07
72.06
28.99
LLaVA 51
K-Means 49
96.71
90.26
87.33
99.35
GMM 7
96.71
92.65
87.38
99.60
Threshold
56.92
58.56
26.58
51.48
InterVLL
K-Means
95.28
94.83
85.01
99.50
GMM 71
95.08
94.79
88.34
99.45
both components rely Gaussian assumptions. This design consistency ensures stability and interpretability across modules.
In summary, while K-Means performs competitively and may be preferred in lightweight deployments, GMM offers better extensibility and robustness, which aligns with our broader goal of generalizable and principled backdoor mitigation.
Detailed Comparison with SentiNet
To highlight the distinct advantages of our proposed BYE method, conduct focused comparison with SentiNer [16]. representative defense framework against localized universal backdoor attacks. Rather than offering general overview, this comparison is intended clarify how BYE advances beyond prior approaches in terms of architecture generality, attack assumptions, and detection mechanisms. A concise summary of the key differences presented Tab. II with further analysis provided thereafter.
Table 11: Comparison between BYE and SentiNet across five critical dimensions.
Aspect
SentiNet 16
BYE (Ours)
CNN-based, Saliency-driven
Transformer-basse
Architecture Scope
Attention entropy- driven
Generic patch-bases backdoors (no locality universality
Attack Assumption
Localized universal patch
assumed)
Input Modalities
Unimodal (images only)
Multimodal (vision-language
Requires Grad-CAM, object proposals, clean reference images
Self-contained, external modules
Auxiliary Dependency
Limited to fixed spatial triggers
Generalizability
Robust to multi-trigger variants
Architectural Scope: CNNs vs. Transformers. SentiNet [16] builds on the spatial hierarchy of CNNs and uses saliency maps over convolutional feature maps. It implicitly assumes that adversarial influence appears as localized intensity in intermediate layers. BYE, on the other hand, is fundamentally tailored for MILMM,, where attention heads rather than convolutions drive semantic alignment. BYE models entropy dynamics across transformer layers to capture poisoning footprints more global and distributed manner.
Assumption of Attack Format. SentiNet [16] is restricted to localized universal attacks which static patches reused across many inputs. BYE does not rely on fixed-position triggers. Even triggers vary in location, size, semanties, BYE detect them by identifying systematic entropy collapse, thus covering wider threat spectrum.
limited to unimodal settings Input Modalities: Vision-Only vs. Multimodal. SentiNet [6
and operates solely image classification tasks, making incompatible with the vision-language
28

---

reasoning required by modern MLLMs. In contrast, BYE is designed for multimodal inputs and leverages moosl attention patterns between decoding tokens and image tokens to assess semantic alignment. This allows BYF to detect poisoned samples in tasks such as visual question answering and image captioning, where textual prompts influence visual focus. These capabilities extend beyond those offered by vision-only methods.
Auxiliary Dependency. SentiNet [6 uses Grad-CAM to generate heatmaps, Selective Search for region proposals, and overlays suspected regions test images for final decision making. This creates a reliance on handcrafted modules. contrast, BYE functions as self-diagnostic system in which all signals are derived from the model's 's internal attention mechanisms. Its pipeline is gradient-free, reference-free, and fully automated.
Generalizability and Robustness. The reliance of SentiNet []6] localized saliency limits its detection power under dispersed or multi-trigger settings. BYE explicitly aggregates entropy across multiple sensitive layers, enabling robust detection even when triggers subtle or distributed. As shown Fig.
B BYE forms clear bimodal separations under varied attacks, reinforcing its resilience.
Overall, BYE generalizes the concept of model-interral reaction to poisoning from CNN saliency to Transformer entropy, and from local patches to global alignment crruptions-ettallisiine new paradigm for self-supervised backdoor purification.
G Broader Impact
This work offers self-supervised defense mechanism that strengthens the safety of MILMs against backdoor attacks FTaaS scenarios. By detecting poisoned data without clean references, it helps reduce the risk of malicious model behaviors in critical applications such as education, healtheare, and autonomous systems. However, revealing that low attention entropy is a reliable signal for detecting poisoned samples may also motivate adversaries craft more evasive triggers that diffuse attention or imitate benign entropy patterns. To mitigate such risks, we advocate for future research on adaptive defenses and the development of robust auditing tools for fine-tuning pipelines.
29


Reviews:
[{"review_id": "GyXTsh5fbL", "reviewer": "Reviewer_wyVd", "summary": "This paper proposes a backdoor cleaning algo BYE (Alg 1) that utilizes clustering on attention entropy as a proxy to detect and filter backdoors in MLLMs. The assumption is that when exposed to poisoned samples, MLLM's attentions would be collapsed / redirected toward the triggers instead of task-relevant content, and we can often observe a bimodal in attention entropy (e.g., Fig 3). And we can utilize GMM clustering on some sensitive layers to automatically detect such entropy separation and removing low-entropy cluster samples is sufficient (Alg 1). \n\nThe experiments are conducted on LLaVA-v1.5-7B and InternVL2.5-8B with LoRA FT. The tasks are visual QA and image captioning. The metrics are Attack Success Rate (ASR) and Clean Performance (CP). The baselines are vanilla FT, random drop, and ZIP, and the authors demonstrate a decent CP can be achieved by BYE while ASR is quite close to 0.", "questions": "There is no other questions than the ones listed in the weakness section.", "limitations": "yes", "rating": 4, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Disclaimer: I am not familiar with the field of backdoor cleaning so I would be conservative on assessing the novelty. The following evaluation is more tailored towards the soundness of the claims from my understanding. \n\nStrength:\n\n- This paper studies an essential problem (MLLM backdoor cleaning) with a clear motivation. The paper is easy to follow even for people without backdoor cleaning background. \n- The high-level algorithmic design is well motivated and the experiments are comprehensive.\n\n\nWeakness:\n\n- High-level: \n  - **algorithmic assumption and experiment verification**: I agree that attention could give clear signal on the difference between poisoned and clean samples, but I doubt identifying from entropy score be a robust / general solution. The authors provide some justification on Figure 3 and test on 3 different triggers in Figure 1 & Table 3, but it might not be sufficient. Although I am not an expert in inserting backdoors, I could still imagine designing backdoors that are simply more diverse shouldn't be a hard task. \n\nFor example, we can construct triggers that are **both randomly scattered on the images (and there should be multiple pieces scattered on a single image, instead of trigger occurs on just 1 place per image) and have multiple randomly chosen captions for the dataset**. This is likely to be more diverse, and may degrade BYE's sensitivity. Notice that this construct is different from both random position trigger and texture trigger in terms that we have (1) multiple small triggers per image and (2) randomly chosen captions for image (the first one might be more important for diversity). \n\n\n- Low-level\n  - FT results on the clean samples only should be provided in Table 1 as an upper bound for CP and lower bound on ASR.\n  - An empirical attention entropy histogram should be provided for the other 2 triggers (Fixed Dual & Varied Multi-trigger) besides Table 3.", "was_revised": true, "final_justification": "Disclaimer: I am not an expert of the backdoor cleaning field.\n\nMy main concern is the general applicability of BYE. But the authors have provided multiple new experiments that appear to demonstrate BYE's performance with more diverse attacks, and 2 other reviewers are quite satisfactory about this. I will correspondingly raise the score to borderline accept.", "rebuttal": "Dear Reviewer wyVd:\n\nWe greatly value the time and expertise you invested in reviewing our submission. We address your comments in detail below.\n\n### W1: Trigger Diversity Discussion\n\nThanks for the insightful suggestion regarding the robustness of our entropy-based detection method under more diverse and challenging backdoor attack scenarios.\n\nTo address this concern, **we conduct additional experiments following the proposed setting**: for each poisoned sample, we insert five small black trigger patches at random positions and assign a randomly selected target caption from a paraphrase pool. We also include two additional defense baselines, DiffPure [1] and SampDetox [2].\n\n*Table 1: Performance under diverse trigger and targeted output setting. In the format CP (↑) / ASR (↓).*\n\n|**Method**|**ScienceQA**|**IconQA**|\n|-|-|-|\n|Vanilla FT|91.21 / 93.70|81.62 / 86.29|\n|DiffPure|84.38 / 74.28|75.18 / 79.93|\n|ZIP|72.33 / 73.49|73.91 / 80.29|\n|SampDetox|84.39 / 93.19|76.82 / 90.97|\n|**BYE**|**87.38 / 2.37**|**80.99 / 1.68**|\n\nAs shown, **BYE effectively reduces ASR to near zero on both ScienceQA and IconQA, even under diverse attacks, and significantly outperforms the baselines.**\n\nIn addition, **we further evaluate our method under the blended [3] attack scenario.** BYE consistently achieves significantly lower ASR than all baseline methods in this setting as well, further confirming the robustness and generalizability of our approach across various attack types.\n\n*Table 2: Performance under blended attack. In the format CP (↑) / ASR (↓).*\n\n|**Method**|**ScienceQA**|**IconQA**|\n|-|-|-|\n|Vanilla FT|89.89 / 99.70|83.34  / 99.77|\n|DiffPure|82.85 / 77.24|78.54 / 84.91|\n|ZIP|87.11 / 91.12|79.81 / 96.77|\n|SampDetox|82.45 / 95.93|73.27 / 93.77|\n|**BYE**|**85.72 / 54.18**|**79.32 / 59.77**|\n\n> [1] Diffusion models for adversarial purification. ICML 2022.\n>\n> [2] SampDetox: Black-box Backdoor Defense via Perturbation-based Sample Detoxification. NeurIPS 2024.\n>\n> [3] Targeted backdoor attacks on deep learning systems using data poisoning. Preprint 2017.\n\n### W2: Upper and Lower Bound Analysis\n\nThank you for your valuable suggestion! It's important to include results from models fine-tuned on clean samples only, which can serve as an upper/lower bound for CP/ ASR.\n\nIn our original Table 1 (page 8), “Vanilla FT” uses mixed clean and poisoned data. Following your advice, **we additionally report Clean FT results (no poisoned samples) as shown below:**\n\n*Table 3: Clean FT vs. Vanilla FT. Clean FT provides the upper bound for CP and lower bound for ASR. In the format CP (↑) / ASR (↓)*\n\n||**ScienceQA**|**IconQA**|**Flickr30k**|**RSVQA**|\n|-|-|-|-|-|\n|**LLaVA (Clean FT)**|**92.58 / 0.00**|**82.95 / 0.00**|**75.38 / 0.00**|**74.11 / 0.00**|\n|LLaVA (Vanilla FT)|91.72 / 97.32|80.51 / 87.85|71.03 / 82.80|72.01 / 99.90|\n|**InternVL (Clean FT)**|**97.65 / 0.00**|**96.96 / 0.00**|**54.86 / 0.00**|**72.84 / 0.00**|\n|InternVL (Vanilla FT)|91.47 / 97.12|89.96 / 92.13|48.55 / 76.60|65.21 / 99.76|\n\nAs expected, **Clean FT consistently yields the highest CP and zero ASR, confirming its role as the upper/lower bound.** We will add these results and clarify the different fine-tuning settings in our revised submission.\n\n### W3: Entropy Histograms Analysis\n\nThank you for your valuable suggestion. **We perform the experiments and find that the entropy separation between clean and poisoned samples is consistent across Fixed Single, Fixed Dual, and Varied Multi triggers.** As we are unable to upload images or external links in the rebuttal, we provide the key sample-level statistics in the table below. The Kolmogorov–Smirnov (KS) distance quantifies the distribution gap for each trigger type.\n\n*Table 4: Sample-level attention entropy statistics and KS distances for Fixed Single, Fixed Dual, and Varied Multi triggers.*\n\n|**Trigger Type**|**Clean Mean**|**Poison Mean**|**KS Distance**|\n|-|-|-|-|\n|Fixed Single|5.47|2.96|0.91|\n|Fixed Dual|5.10|3.01|0.87|\n|Varied Multi|4.78|3.05|0.85|\n\nThese results confirm that entropy-based separation is robust for all evaluated trigger types. We will include the empirical histograms in the revised manuscript."}, {"review_id": "BDmOTQWw3S", "reviewer": "Reviewer_Bszd", "summary": "This paper proposes the BYE (Believe Your Eyes) framework, an unsupervised data filtering framework focused on identifying and filtering backdoor samples. The authors specifically focus on the visual trigger-based attacks. They first sak the question - “Will attention of MLLMs systematically collapse toward the trigger rather than focusing on task-relevant content?”, which traditional Deep Learning models are known to do. The investigate by visualizing the cross-modal attention weights and determine that trigger patches indeed cause models to focus on them, a phenomenon which they term spatial-attention collapse. Based on these observations, they propose BYE which works in three main steps. First, the trained model is evaluated on the training dataset and the cross-modal attention map signals are measured for each transformer layer. In the next step, the Shannon entropy is calculated on the signals and it is observed that non-triggered images generally have lower entropy than those with triggers. The entropy distributions are clustered via Gaussian Mixture Model and two separate groups are created by filtering their distances via a threshold. Lastly, the suspicious samples that get detected through clustering are removed and the model is re-fitted on the new clean dataset to remove the influence of the trigger patches. Experiments are performed across different models and datasets, and the results show that BYE is able to filter our backdoored images with a high success rate across different types of triggers without compromising model performance.", "questions": "1. Please discuss more about the cost/expense of the system. It seems that it would be quite expensive. It is understood that such detection methods can be expensive, but it is important to clarify if the expense is worth it.\n2. We know from older (CNN-based) models that patched triggers with strong patterns (like the black boxes here) are easier to detect the more distinctive and consistent they are compared to the rest of the image. How sensitive is this system for diverse and surreptitious triggers? \n3. Similarly, these types of attacks rely on over-fitting, and what this solution does in essence is detect it via clustering. In the experiments 10% of the dataset was contaminated - have the authors any intuition of how trigger % contamination affects BYE's effectiveness?", "limitations": "Yes.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths - \n1. The problem tackled is very interesting and important.\n2. The solution is intuitive, effective and relatively simple which makes it feasible in practice.\n3. The results are good.\n4. The paper is explained well and easy to follow.\n\nWeaknesses - \n1. Training twice is extremely expensive\n2. The triggers used are relatively simple\n3. A few ideas are highly inspired by similar problems from traditional Deep Learning systems.", "was_revised": true, "final_justification": "I have set it to a 5 because I believe it is a good paper that tackles an interesting problem and covers all the bases. I am keeping my score to a 5 since I believe a score of 6 warrants extremely novel ideas, highly generalizable/applicable solutions, extremely effective solutions, or pushes the boundaries of science with this does not do, but it is good for what it is.", "rebuttal": "Dear Reviewer Bszd:\n\nWe are truly grateful for your insightful review and the constructive feedback provided. We respond to each point below with careful consideration.\n\n### W1&Q1: Discussion on Computation Cost\n\nThanks for raising this important concern regarding computational expense! We would like to clarify the actual cost of our method and compare it with alternative backdoor removal approaches.\n\n**Computation Cost**: Our system BYE consists of three steps: (1) Standard fine-tuning on the (possibly poisoned) dataset (about 30 minutes), (2) One-time inference pass for suspicious sample detection (about 8 minutes), (3) Re-training on the filtered clean set (about 30 minutes). **Total: about 72 minutes on 4×4090 GPUs (6k samples).** By contrast, diffusion-based methods like ZIP require similar fine-tuning but add a time-consuming purification stage, taking at least 3 hours of GPU time for the same dataset depends on the diffusion model choosed. **Total: 162 minutes or more**.\n\n*Table 1: Comparison of total computational time (in minutes) for BYE and ZIP.*\n\n|**Method**|**Training**|**(Entropy/Purify)**|**Retraining**|**Inference**|**Total**|\n|-|-|-|-|-|-|\n|ZIP|30|128|—|4|**162**|\n|**BYE**|**30**|**8**|**30**|**4**|**72**|\n\n**Practical value:** Diffusion-based methods introduce significant inference latency and are difficult to deploy in practice, since each test input must be purified at inference time. In contrast, BYE only adds extra time at the provider (server) side during training so **users experience no additional delay or difference at inference**. The deployed model remains as efficient as a standard model for real-world use.\n\nIn summary, **BYE’s extra cost is modest, one-time, and entirely server-side.** It enables robust backdoor defense without affecting user experience, making the computational expense well justified for practical deployment.\n\n### W2&Q2: Trigger Diversity Discussion\n\nThank you for raising this important concern. We fully agree that classic black square triggers (BadNet), are simple and widely adopted but do not represent the full range of potential backdoor threats.\n\n**To address this, we conduct additional experiments using Blended [1] attack, a more global and less visually obvious attack method.** As shown in Table 2, BYE still achieves much lower ASR than all baseline methods, confirming that our approach is not limited to simple or visually distinctive triggers, but generalizes well to more adaptive and subtle attack types.\n\n*Table 2: Performance under blended attack. In the format CP (↑) / ASR (↓).*\n\n| **Method** | **ScienceQA**     | **IconQA**        |\n| ---------- | ----------------- | ----------------- |\n| Vanilla FT | 89.89 / 99.70     | 83.34  / 99.77    |\n| DiffPure   | 82.85 / 77.24     | 78.54 / 84.91     |\n| ZIP        | 87.11 / 91.12     | 79.81 / 96.77     |\n| SampDetox  | 82.45 / 95.93     | 73.27 / 93.77     |\n| **BYE**    | **85.72 / 54.18** | **79.32 / 59.77** |\n\n**To further assess robustness, we also evaluate with diverse triggers.** For each poisoned sample, we insert five small black trigger patches at random positions and assign randomly selected target captions from a paraphrase pool. We also compare against two additional defense baselines, DiffPure and SampDetox. As shown in Table 3, **BYE effectively reduces ASR to near zero even under these challenging, diverse trigger scenarios, and significantly outperforms all baselines**.\n\n*Table 3: Performance under diverse trigger and targeted output setting. In the format CP (↑) / ASR (↓).*\n\n|**Method**|**ScienceQA**|**IconQA**|\n|-|-|-|\n|Vanilla FT|91.21 / 93.70|81.62 / 86.29|\n|DiffPure|84.38 / 74.28|75.18 / 79.93|\n|ZIP|72.33 / 73.49|73.91 / 80.29|\n|SampDetox|84.39 / 93.19|76.82 / 90.97|\n|**BYE**|**87.38 / 2.37**|**80.99 / 1.68**|\n\n>  [1] Targeted backdoor attacks on deep learning systems using data poisoning. Preprint 2017.\n\n### W3: Analysis of Innovation Beyond Traditional Defenses\n\nWe appreciate the reviewer’s comment. While our method is inspired by traditional backdoor defenses, **adapting such strategies to MLLMs presents new challenges:**\n\n1. **Complex cross-modal attention and modality alignment:** MLLMs require handling information across modalities, making direct application of CNN-based methods ineffective.\n2. **Unsupervised entropy-based detection:** Our approach is specifically designed for transformer-based MLLMs, rather than relying on visual or gradient cues.\n3. **FTaaS compatibility and real-world deployment:** The method does not require gradient or data access, making it practical for real FTaaS scenarios.\n\nIn summary, our work **generalizes and customizes entropy-based backdoor detection** for the unique challenges of MLLMs.\n\n### Q3: Discussion on Diverse Poison Rate\n\nThank you for your question regarding the effect of different trigger contamination rates on the effectiveness of BYE.\n\n**BYE identifies poisoned samples by capturing the behavioral difference between clean and triggered inputs, regardless of the overall poison rate.** As long as the backdoor causes consistent abnormal responses, BYE can reliably detect them.\n\nTo verify this, we conducted experiments at 10%, 5%, and 1% poison rates on ScienceQA and IconQA. Results show **BYE maintains strong detection and low ASR even with just 1% contaminated data:**\n\n*Table 4: BYE performance under varying poison rates (10%, 5%, 1%) on ScienceQA and IconQA. In the format CP (↑) / ASR (↓).*\n\n|**Poison Rate**|**ScienceQA**|**IconQA**|\n|-|-|-|\n|**10%**|89.64 / 0.05|83.39 / 0.00|\n|**5%**|90.92 / 0.16|84.20 / 1.25|\n|**1%**|88.35 / 3.78|82.18 / 3.62|\n\nThese results confirm that BYE remains robust even under extreme conditions such as a 1% poison rate, as long as the backdoor produces a stable effect on the model. The effectiveness of our method is therefore determined by the presence of a detectable behavioral difference, rather than the absolute proportion of poisoned data."}, {"review_id": "F0rftcAUkc", "reviewer": "Reviewer_Uw8H", "summary": "The paper \"Backdoor Cleaning without External Guidance in MLLM Fine-tuning\" proposes a novel defense against image-based backdooring in Multimodel LLMs, Believe Your Eyes (BYE). BYE works by analysing the attention on the training data after fine-tuning. If there is less entropy in the attention, the image most likely contains a patch based trigger, whereas high entropy would reflect natural images. The process of distinguishing the different kinds of data is done without any further knowledge about the poisoned or clean data.\nThe evaluations show high removal success rate for BYE on different MLLM and the patch based triggers.", "questions": "- See weakness: Would this method work for poisoned data with blended or more naturally occuring triggers such as ones shown in, e.g., [1, 2]?\n- Are there insights into the different performances of BYE on the 2 models? While BYE achieves a reduction of the ASR to near 0 for LLaVA, for InternVL, the ASR is always roughly above 7 for all evaluated datasets.\n\nReferences:\\\n[1] Chen et al. Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning. Preprint 2017\\\n[2] Liu et al. Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks. ECCV 2020", "limitations": "yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "### Strength\n- Extensive evaluations are conducted, including solid ablation studies for patch-based triggers.\n- The motivation behind BYE is well presented, and the method is clearly described.\n- Well chosen visualizations to showcase the problem setting and proposed solution.\n- The paper is well written and easy to follow.\n\n### Weaknesses\n- Limited threat model: BYE appears to be limited to detecting patch-based triggers that concentrate model attention on small regions within an image. This would make BYE vulnerable to triggers that are more spread over the image via, e.g., blending or superimposing (explored in earlier image classification backdoor works such as [1,2]). Using such triggers could cause similar entropy to clean images, circumventing the BYE defense completely.\n\nReferences:\\\n[1] Chen et al. Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning. Preprint 2017\\\n[2] Liu et al. Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks. ECCV 2020", "was_revised": true, "final_justification": "The initial response has addressed my main weakness of BYE, by evaluating on more diverse triggers. My questions were also answered thoroughly. My main concern is the performance and missing explanation as to why BYE works on the whole-image triggers, which should also be revised in the paper (see initial comment).", "rebuttal": "Dear Reviewer Uw8H:\n\nThank you for your encouraging remarks and the critical questions you posed. We provide our detailed responses below to address your concern.\n\n### W1&Q1: Trigger Diversity Discussion\n\nWe thank the reviewer for highlighting this important concern about the attack diversity. Our initial evaluation mainly considered patch-based triggers, we agree it is crucial to test BYE under more distributed and subtle attacks such as blended and reflection triggers [1,2].\n\n**BYE remains effective even for global or naturally embedded triggers.** No matter if the trigger is a small patch or a blended pattern, the backdoor’s core effect is to teach the model a shortcut so the model shows a consistent, abnormal response pattern. This often leads to a class-consistent, atypical attention distribution, which BYE detects via clustering. **While global triggers may not concentrate attention on a single region, they still create distinctive and class-consistent attention shifts compared to clean samples.**\n\nTo address this, we conducted additional experiments under the blended attack setting and included two state-of-the-art purification-based baselines, DiffPure [3] and SampDetox [4]. The results below show that **BYE remains relatively effective and significantly outperforms both baselines under this more challenging scenario:**\n\n*Table 1: Performance comparison of BYE with DiffPure, ZIP, and SampDetox under the blended trigger attack setting on ScienceQA and IconQA.*\n\n|**Method**|**ScienceQA CP (↑)**|**ScienceQA ASR  (↓)**|**IconQA CP (↑)**|**IconQA ASR  (↓)**|\n|-|-|-|-|-|\n|DiffPure|82.85|77.24|78.54|84.91|\n|ZIP|87.11|91.12|79.81|96.77|\n|SampDetox|82.45|95.93|73.27|93.77|\n|**BYE**|**85.72**|**54.18**|**79.32**|**59.77**|\n\n> [1] Targeted backdoor attacks on deep learning systems using data poisoning. Preprint 2017.\n>\n> [2] Liu et al. Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networks. ECCV 2020.\n>\n> [3] Diffusion models for adversarial purification. ICML 2022.\n>\n> [4] SampDetox: Black-box Backdoor Defense via Perturbation-based Sample Detoxification. NeurIPS 2024.\n\n### Q2: Analysis of Performance Gap on LLaVA&InternVL\n\nThank you for your insightful question regarding the differing ASR reduction achieved by BYE on LLaVA and InternVL! The main reason for this gap lies in the **architectural differences** in how these models encode and fuse visual information with language.\n\nLLaVA maintains a relatively high spatial resolution for visual input, representing images with a fixed 24×24 grid (576 tokens) that are linearly projected to match the LLM input dimension (typically 1024). Visual tokens are simply concatenated with text tokens and jointly processed by the LLM, **preserving fine-grained spatial cues**. This enables BYE to precisely capture attention collapse caused by backdoor triggers and reduce the ASR to near zero.\n\nIn contrast, InternVL first encodes images as 1024 visual tokens, but then **applies a cross-modal projection** to reduce this sequence to just **256 tokens** (matching the input dimension of InternLM). Moreover, InternVL employs multiple layers of cross-modal fusion, where visual and language features interact deeply. While this design facilitates stronger multimodal alignment, the lower spatial resolution (256 vs. 576 tokens) means that each visual token encodes information from a larger image region, causing trigger effects to be more diluted or mixed. This leads to a residual ASR around 7. Despite this, BYE still consistently and substantially reduces the ASR for InternVL across all datasets, demonstrating its robustness to architectural differences and lower token resolutions."}, {"review_id": "x0DaNjuPrK", "reviewer": "Reviewer_ep1A", "summary": "The paper identifies \"attention collapse\"—abnormal cross-modal attention concentration induced by malicious fine-tuning. It proposes a framework using attention entropy to detect poisoned samples, leveraging Gaussian Mixture Models (GMM) and Bimodal Separation Index (BSI) to model entropy distributions for unsupervised filtering.", "questions": "1. **[Contrasting Baselines]**: Could the method outperform other attention-based method? It lacks comparison with other attention-based methods such as Neural Attention Distillation (NeurIPS), which could serve as strong baselines. The comparison against only ZIP (an inference‐time purification method) creates a paradigm mismatch that undermines the evaluation’s validity. And Vanilla FT and Random Drop are too simple to prove the effectiveness of BYE. By omitting established fine‐tuning defenses (e.g., spectral signature filtering, adversarial fine‐tuning, differential privacy) as baselines, the paper fails to demonstrate BYE’s relative advantage within its intended training‐time paradigm, leaving its real‐world efficacy and efficiency claims under‐substantiated. \n2. **[Simulation of Backdoor Attacks]**: In the experimental section, small black blocks are used to simulate backdoor attacks. Is this method scientifically valid? Realistically backdoor triggers may be more insidious or diverse. Is the method still effective in detecting non-blocking, non-explicit triggers? Does the attention collapse phenomenon stabilize in such triggers?\n3. **[Unquantified Computational Overhead]**: The method requires two full fine-tuning passes (before and after cleaning), yet GPU hours and wall-clock time are not reported, hindering assessment of real-world cost. Does BYE consume more computational resources or longer inference time? The paper mentions that self-supervised methods are “computationally efficient” but lacks a quantitative comparison with externally supervised methods. \n4.  **[Generalization Ability on Different Models]**: Existing experiments are mainly based on GPT-J and GPT-2 XL, how about performance of the methods on different architectures (e.g., T5 with Encoder-Decoder structure, LLaMA series with pure Decoder) or different scale models (e.g., 7B vs 13B parameters)? The core mechanisms of BYE may vary significantly in effectiveness depending on the attention head design of the model and the dimensionality of the hidden layer.\n5. **[Lack of Statistical Significance Analysis]**: All performance gains are reported as averages without confidence intervals or significance tests, leaving it unclear whether the improvements are robust or due to randomness.", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 3, "originality": 2, "strengths_and_weaknesses": "**Strengths**\n\n1. **[Complete work]** The work is quite complete, progressing from exploring the underlying cause to proposing a practical solution. Specifically, the paper begins with the discovery of attention-entropy collapse, then discusses an optimization method using Gaussian modeling to select specific layers.\n2. **[Various applied scenarios]**: The combination of GMM and BSI is a valuable method that could be applied across various scenarios. The ablation study is also persuasive.\n3. **[Clear narrative]***: The narrative is clear enough for readers to follow the reasoning, and the language is generally fluent.\n\n**Weaknesses**\n\n1. **[Lack Comparison]**: While the work is complete, the method itself may not be particularly novel. It lacks comparisons with similar approaches. The paper only mentions external data purification methods like ZIP, but does not introduce other attention-based methods. Including such comparisons would better highlight the novelty of the proposed method.\n2. **[Lack persuasion]**: Additionally, is the ZIP experiment really the most state-of-the-art? Although ZIP is less effective than the proposed method, this might be because ZIP is more suited for real-world situations, whereas the proposed method performs better only in the simulated scenarios described in the paper. This possibility is not discussed in the paper.\n3. **[Untrustful Simulation]**: In the experimental section, small black blocks are used to simulate backdoor attacks. Is this method scientifically valid? Has any previous research used this approach? The paper lacks explanation regarding this design choice.\n4. **[Vague part]**: Due to space constraints, Section 5.5 lacks clarity and is somewhat vague; it requires more precise elucidation.\n5. **[Computation cost]**: The proposed method requires fine-tuning, which is relatively computationally intensive. Compared with using external supervision, does leveraging self-supervision consume more computational resources?", "was_revised": true, "final_justification": "I appreciate the thorough rebuttal from the authors. All my concerns have been sufficiently addressed, and I’ve raised my score to 4.", "rebuttal": "Dear Reviewer ep1A:\n\nWe appreciate your engagement with our work and the thoughtful observations you made. We aim to address your concerns in our detailed responses below.\n\n### W1&W2&Q1: Comparison with More Baselines\n\nThank you for raising the concern about the adequacy of our defense baselines. Our comparisons are limited to image purification methods (e.g., ZIP), which do not fully capture the landscape of advanced backdoor defense strategies.\n\nTo address this, we add extensive new baselines, including: (1) Neural Attention Distillation (NAD) [1] (attention-based fine-tuning defense). (2) DiffPure [2] and SampDetox [3] (state-of-the-art purification-based methods).\n\n*Table 1: Comparison of BYE under the BadNet attack setting on ScienceQA and IconQA.*\n\n|**Method**|**ScienceQA CP**|**ScienceQA ASR**|**IconQA CP**|**IconQA ASR**|\n|-|-|-|-|-|\n|DiffPure|81.71|78.08|79.04|77.51|\n|ZIP|79.97|66.48|77.60|67.97|\n|SampDetox|83.59|90.62|72.86|89.74|\n|NAD|84.65|7.51|75.87|13.04|\n|**BYE**|**89.64**|**0.05**|**83.39**|**0.00**|\n\nAs shown in Table 1, **BYE consistently achieves the best performance across ScienceQA and IconQA, outperforming both attention-based and purification-based defenses**. We emphasize that ZIP, DiffPure, and SampDetox are state-of-the-art defenses designed specifically for real-world backdoor threats, and all baselines are evaluated under identical attack types and threat models as BYE.\n\n> [1] Neural attention distillation: Erasing backdoor triggers from deep neural networks. ICLR 2021.\n>\n> [2] Diffusion models for adversarial purification. ICML 2022.\n>\n> [3] SampDetox: Black-box Backdoor Defense via Perturbation-based Sample Detoxification. NeurIPS 2024.\n\n### W3&Q2: Trigger Validity&Diversity Discussion\n\nThank you for these thoughtful questions regarding our experimental design and the scientific validity of using small black blocks as backdoor triggers.\n\nA1: Using small black squares as visual triggers is a standard and widely adopted practice in the backdoor literature (e.g., BadNets [1], federated learning, and recent CNN-based studies). This setup is favored because it is **simple, reproducible, and widely recognized as a baseline**, making our results directly comparable to prior work.\n\nA2: To address this, we conduct additional experiments under the more challenging blended trigger attack [2], where BYE still achieves the lowest attack success rate. These results clearly demonstrate the **robustness and generalizability of BYE across a range of potential attacks**.\n\n*Table 2: Performance under blended attack. In the format CP (↑) / ASR (↓).*\n\n|**Method**|**ScienceQA CP** | **ScienceQA ASR** | **IconQA CP** | **IconQA ASR** |\n|-|-|-|-|-\n|DiffPure|82.85|77.24|78.54|84.91|\n|ZIP|87.11|91.12|79.81|96.77|\n|SampDetox|82.45|95.93|73.27|93.77|\n|NAD|85.77|20.87|70.89|33.75|\n|**BYE**|**85.72**|**54.18**|**79.32**|**59.77**|\n\n> [1] Badnets: Identifying vulnerabilities in the machine learning model supply chain. Preprint 2017.\n>\n> [2] Targeted backdoor attacks on deep learning systems using data poisoning. Preprint 2017.\n\n### W4: Detailed description in Section 5.5\n\nThank you for pointing out the need for clarity in Section 5.5. We conduct experiments in Section 5.5 (in page 9, Table 3) specifically to verify the robustness of our method against potential adaptive backdoor attacks. Given that an attacker may attempt to circumvent our detection mechanism by dispersing attention triggers across multiple spatial locations, we design experiments with multi-trigger scenarios, including fixed dual triggers and varied multi-triggers. We aim to demonstrate that our entropy-based detection approach remains effective even when triggers are spatially dispersed or non-localized. To clarify, we implement two adaptive attack scenarios: (1) embedding multiple identical triggers symmetrically placed within a single image (Fixed Dual Trigger); (2) embedding triggers dispersed at regular grid points across images (Varied Multi-Trigger). Results in Table 3  (page 9) confirm our method’s robustness, showing consistent reductions in attack success rates (ASR) and high recall in identifying poisoned samples, thereby validating our defense’s resistance against more sophisticated, dispersed attack patterns. We will expand this discussion in the revised manuscript to explicitly outline the rationale and setup for these experiments.\n\n### W5&Q3: Discussion on Computation Cost\n\nThanks for raising this important concern regarding computational expense! We would like to clarify the actual cost of our method and compare it with alternative backdoor removal approaches.\n\n**Computation Cost**: Our system BYE consists of three steps: (1) Standard fine-tuning on the (possibly poisoned) dataset (about 30 minutes), (2) One-time inference pass for suspicious sample detection (about 8 minutes), (3) Re-training on the filtered clean set (about 30 minutes). **Total: about 72 minutes on 4×4090 GPUs (6k samples).** By contrast, diffusion-based methods like ZIP require similar fine-tuning but add a time-consuming purification stage, taking at least 3 hours of GPU time for the same dataset depends on the diffusion model choosed. **Total: 162 minutes or more**.\n\n*Table 3: Comparison of total computational time (in minutes) for BYE and ZIP.*\n\n|**Method**|**Training**|**(Entropy/Purify)**|**Retraining**|**Inference**|**Total**|\n|-|-|-|-|-|-|\n|ZIP|30|128|—|4|**162**|\n|**BYE**|**30**|**8**|**30**|**4**|**72**|\n\n**Quantitative comparison with externally supervised methods:** In contrast to externally supervised baselines which often require additional annotation, supervision, or computationally heavy denoising modules. BYE’s self-supervised detection incurs only a lightweight, one-time cost and no extra inference latency. The above quantitative comparison demonstrates that BYE is not only more efficient than diffusion-based methods, but also avoids the recurring overhead associated with external supervision.\n\n### Q4: Generalization Across Model Architectures\n\nThank you for this important question about generalizability across model architectures and scales! **BYE is designed to be architecture-agnostic: it relies only on extracting cross-modal attention maps**, which are present in both decoder-only (e.g., LLaMA, GPT) and encoder-decoder (e.g., T5) models. Its effectiveness does not depend on the number of attention heads, hidden size, or specific attention design. BYE detects distributional shifts in attention caused by backdoor triggers which a phenomenon expected to occur across both types of architectures, since the attack goal is to induce shortcut behaviors in attention, regardless of model structure.\n\nTo demonstrate scalability, we conduct additional experiments on LLaVA-1.5-13B (a large decoder-only model) with ScienceQA and IconQA. BYE achieves strong clean performance and robust backdoor mitigation:\n\n*Table 4: Clean performance (CP) and attack success rate (ASR) of BYE on LLaVA-1.5-13B, demonstrating robustness and scalability to larger model sizes.*\n\n|**Dataset**|**Clean Performance (CP)**|**Attack Success Rate (ASR)**|\n|-|-|-|\n|ScienceQA|95.85|0.04|\n|IconQA|84.23|0.00|\n\nThese results show BYE is robust and effective as model scale increases.\n\n### Q5: Statistical Significance Analysis\n\nWe thank the reviewer for raising the issue of statistical significance. To address this concern, we **repeat the main experiments on ScienceQA and IconQA three times with different random seeds** and report the mean, standard deviation, and 95% confidence interval (CI) for each key metric in the table below.\n\n*Table 5: Statistical analysis of BYE’s main results, demonstrating robustness and stability across multiple runs.*\n\n|**Dataset**|**Metric**|**Mean**|**Std**|**95% CI**|\n|-|-|-|-|-|\n|ScienceQA|CP|89.64|0.8|[88.73, 90.55]|\n|ScienceQA|ASR|0.05|0.01|[0.04, 0.06]|\n|IconQA|CP|83.39|0.7|[82.60, 84.18]|\n|IconQA|ASR|0.00|0.00|[0.00, 0.00]|\n\nThe results show that **BYE’s performance is highly stable and robust to randomness, with minimal variance across independent runs**. This stability arises because our method is almost fully deterministic: the inference temperature is set to 0, and GMM clustering yields highly consistent results due to the clear separation between clusters."}, {"review_id": "lrIPXs4mlA", "reviewer": "Reviewer_jAXd", "summary": "This paper proposes a self-diagnostic method, Believe Your Eyes (BYE), to identify and filter potential backdoor samples in the scenarios of fine-tuning multi-modal LLMs. By observing that the abnormal attention occurs for patch-based triggers, the authors propose to leverage the difference of attention entropy to partition clean and backdoors samples. In experiments, BYE achieves better performance (Higher CP and higher ASR) than baselines like Random Drop, ZIP with LLaVA and InternVL as backbones.", "questions": "1. I noticed that a black patch is shown in Fig. 2 as an example. This raises a question: in patch-based backdoor attacks, is the image difference typically larger than in adversarial perturbation-based methods? Since patch-based triggers are visually perceptible to humans, it seems plausible that even simpler detection methods could be effective in identifying them.\n2. The entropy pattern should become more reliable as the tuning process progresses. Given this, why not incorporate a mechanism to 'forget' or filter out backdoor samples during tuning? While I understand that the online process is left as future work, the contribution of the paper would be more substantial if such an approach were considered within the current scope.\n3. Given that the number of backdoor samples is much smaller than that of clean samples, could GMM clustering on such imbalanced data pose a problem?\n4. Will entropy pattern from all layers agree with each other? Will the high separation (BSI) be highly dependent on the converged tuning procedure?", "limitations": "yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. This paper is well organized, and the tables and figures are clear and easy to read.\n2. The idea of using attention entropy patterns for identifying patched samples sounds useful and direct.\n3. The performance presented in Table 1 looks a great improvement on attack success rate, across different datasets.\n4. The visualization of sample separation and ablation studies provide additional evidence of the efficacy of the BYE.\n\nWeaknesses:\n1. Inconsistent notations. D_train in Sec. 3.1 is clean set for fine-tuning, while it represents the union of clean the backdoors samples in Sec 4.1.\n2. This paper is narrowly focused on patch-based backdoor samples, which limits its relevance to the broader data poisoning community working on MLLMs. Notice that ZIP, the strongest baseline in this work, can handle non-patched samples.\n3. According to Algorithm 1, BYE essentially requires fine-tuning MLLMs on the given dataset and then identifies which are backdoors examples. This looks not very efficient, as it involves performing fine-tuning twice.", "was_revised": true, "final_justification": "The authors have addressed most of my concerns. By checking all other reviewers' comments, I would like to raise my rating to 4.", "rebuttal": "Dear Reviewer jAXd:\n\nThank you for your careful review and valuable feedback on our work. In the following responses, we address each of your concerns in detail.\n\n### W1: Notation Mistake\n\nThank you for pointing out the inconsistency. In Sec. 3.1, $D_{\\text{train}}$ refers to the clean training set for fine-tuning, while in Sec. 4.1, **it should be written as $D_{\\text{train}} \\cup D_{\\text{poison}}$**, representing the union of clean and backdoored samples. We will revise the notation and clarify the definitions in the updated version.\n\n### W2: Discussion on Diverse Trigger\n\nWe sincerely thank the reviewer for raising this valuable point. To address this concern, we conduct additional experiments with **blended [1] (global, non-patched) backdoor triggers**, which better reflect real-world attack diversity. We also include two additional defense baselines, DiffPure [2] and SampDetox [3]. As shown in our new results, **BYE still achieves much lower ASR than all baseline methods**, confirming that our approach is not limited to simple or visually distinctive triggers, but generalizes well to more adaptive and subtle attack types. This robustness stems from BYE’s focus on **behavioral patterns rather than explicit patch localization**, allowing it to generalize across trigger types.\n\nIn contrast, DiffPure, ZIP and SampDetox reliance on external prior knowledge limits its effectiveness against in-domain or blended triggers, and our results show it performs poorly in these settings.\n\n*Table 1: Performance of BYE under the blended trigger attack setting on ScienceQA and IconQA.*\n\n|**Method**|**ScienceQA CP (↑)**|**ScienceQA ASR  (↓)**|**IconQA CP (↑)**|**IconQA ASR  (↓)**|\n|-|-|-|-|-|\n|DiffPure|82.85|77.24|78.54|84.91|\n|ZIP|87.11|91.12|79.81|96.77|\n|SampDetox|82.45|95.93|73.27|93.77|\n|**BYE**|**85.72**|**54.18**|**79.32**|**59.77**|\n\n> [1] Targeted backdoor attacks on deep learning systems using data poisoning. Preprint 2017.\n> \n> [2] Diffusion models for adversarial purification. ICML 2022.\n>\n> [3] SampDetox: Black-box Backdoor Defense via Perturbation-based Sample Detoxification. NeurIPS 2024.\n\n### W3: Discussion on Computation Cost\n\nThanks for raising this important concern regarding computational expense! We would like to clarify the actual cost of our method and compare it with alternative backdoor removal approaches.\n\n**Computation Cost**: Our system BYE consists of three steps: (1) Standard fine-tuning on the (possibly poisoned) dataset (about 30 minutes), (2) One-time inference pass for suspicious sample detection (about 8 minutes), (3) Re-training on the filtered clean set (about 30 minutes). **Total: about 72 minutes on 4×4090 GPUs (6k samples).** By contrast, diffusion-based methods like ZIP require similar fine-tuning but add a time-consuming purification stage, taking at least 3 hours of GPU time for the same dataset depends on the diffusion model choosed. **Total: 162 minutes or more**.\n\n*Table 2: Comparison of total computational time (in minutes) for BYE and ZIP.*\n\n| **Method** | **Training** | **(Entropy/Purify)** | **Retraining** | **Inference** | **Total** |\n|-|-|-|-|-|-|\n| ZIP|30|128|—|4|**162**|\n|**BYE**|**30**|**8**|**30**|**4**|**72**|\n\n### Q1: Discussion on Patch Trigger Visibility\n\nThank you for these insightful suggestion. We address them as follows:\n\n1. Is the image difference in patch-based attacks typically larger than in adversarial perturbation-based methods?\n\n**No.** For the model, both patch-based and adversarial triggers function similarly in disrupting internal behavior, regardless of the visual difference. For humans, patch triggers can also appear as real-world objects (e.g., sunglasses), which can be highly inconspicuous.\n\n2. Could simple visual inspection suffice to detect patch-based triggers?\n\n**No.** While patch triggers are visually perceptible, relying on manual or heuristic inspection is neither reliable nor scalable for real-world, large-scale datasets. Real-world triggers may be any pattern, such as logos or stickers, which are not always obvious to humans. MLLMs do not rely on human-like visual cues; triggers that are obvious to us may not be distinguishable at the model level. Automated, model-based detection methods are thus necessary for practical defense.\n\n### Q2: Analysis of Online Filtering\n\nThank you for this insightful suggestion. The design of BYE as a post-hoc defense is motivated by the need for the model to **fully exhibit both clean and backdoored behaviors** before effective detection is possible. In our approach, the identification of poisoned samples relies on the model having already learned the backdoor pattern, which allows us to observe clear statistical differences in attention entropy between clean and triggered data. If filtering were performed online during training, BYE would only be able to identify a backdoored sample after the model has already been affected by it. This would **lead to a potential dilemma where the model could repeatedly be contaminated**, identified, and purified in a cycle, making it **difficult to achieve stable and effective defense**. By performing detection and purification after fine-tuning, we ensure that the model has fully revealed any backdoor-related behaviors, which can then be accurately distinguished and removed.\n\n### Q3: Discussion on Diverse Poison Rate\n\nThank you for highlighting the concern about GMM clustering on highly imbalanced data. **BYE identifies poisoned samples by capturing the behavioral difference between clean and triggered inputs, regardless of the poison rate or class imbalance.** As long as the backdoor consistently induces abnormal model responses, the entropy-based feature enables GMM to reliably separate poisoned from clean samples, even when the number of poisoned samples is much smaller.\n\nTo verify this, we conducted experiments at 10%, 5%, and 1% poison rates on ScienceQA and IconQA. Results show **BYE maintains strong detection and low ASR even with just 1% contaminated data:**\n\n*Table 3: BYE performance under varying poison rates (10%, 5%, 1%) on ScienceQA and IconQA. In the format CP (↑) / ASR (↓).*\n\n| **Poison Rate** | **ScienceQA** | **IconQA**   |\n|-|-|-|\n| **10%**| 89.64 / 0.05  | 83.39 / 0.00 |\n| **5%**| 90.92 / 0.16  | 84.20 / 1.25 |\n| **1%**| 88.35 / 3.78  | 82.18 / 3.62 |\n\n### Q4: Discussion on Entropy Consistency & Convergence\n\nThank you for these important questions. We address them as follows:\n\n1. Do entropy patterns from all layers agree?\n\n**No, entropy separation is not uniform across all layers.** Only a subset of layers show clear discrimination between clean and poisoned samples. Including all layers actually degrades detection. Therefore, **we use an adaptive selection strategy**, aggregating entropy only from layers with high BSI, as detailed in Appendix A.3. This makes BYE robust to different architectures and tasks.\n\n2. Is BSI separation highly dependent on tuning convergence?\n\n**No.** Our experiments with checkpoints from different fine-tuning epochs (see table below) show that **BYE’s detection effectiveness is stable and not sensitive to the convergence stage.** Even with only 1–2 epochs of tuning, the attack success rate remains very low, confirming the robustness of our method throughout the training process.\n\n*Table 4: Clean performance and attack success rate (ASR) of BYE at different fine-tuning epochs.*\n\n| **Epoch** | **Clean Performance** | **ASR** |\n| --------- | --------------------- | ------- |\n| 1         | 83.69                 | 0.07    |\n| 2         | 87.06                 | 0.10    |\n| 3         | 89.64                 | 0.05    |\n\nOur adaptive layer selection ensures that BYE focuses on the most informative layers for backdoor detection, avoiding noisy or uninformative ones. Extensive experiments demonstrate that BYE’s effectiveness is robust to the choice of layers and to the degree of model convergence during fine-tuning. These design choices together guarantee that BYE is reliable and practical across different architectures and FTaaS scenarios."}]

Author rebuttal:

Meta-review: The paper presents a well-motivated and timely approach to backdoor cleaning in multimodal LLMs via entropy-based attention analysis. Reviewers agree that the problem is important and the proposed BYE framework is intuitive, effective, and validated through extensive experiments. Overall, while not groundbreaking, the paper offers a technically solid and practically relevant contribution that merits acceptance.
Decision: Accept (poster)