BDetCLIP: Multimodal Prompting Contrastive Test-Time Backdoor Detection

Authors: Yuwei Niu, Shuo He, Qi Wei, Zongyu Wu, Feng Liu, Lei Feng
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Multimodal contrastive learning, test-time backdoor detection, contrastive prompting

Abstract:
Multimodal contrastive learning methods (e.g., CLIP) have shown impressive zero-shot classification performance due to their strong ability to joint representation learning for visual and textual modalities. However, recent research revealed that multimodal contrastive learning on poisoned pre-training data with a small proportion of maliciously backdoored data can induce backdoored CLIP that could be attacked by inserted triggers in downstream tasks with a high success rate. To defend against backdoor attacks on CLIP, existing defense methods focus on either the pre-training stage or the fine-tuning stage, which would unfortunately cause high computational costs due to numerous parameter updates and are not applicable in the black-box setting. In this paper, we provide the first attempt at a computationally efficient backdoor detection method to defend against backdoored CLIP in the inference stage. We empirically find that the visual representations of backdoored images are insensitive to both benign and malignant changes in class description texts. Motivated by this observation, we propose BDetCLIP, a novel test-time backdoor detection method based on contrastive prompting. Specifically, we first prompt the language model (e.g., GPT-4) to produce class-related description texts (benign) and class-perturbed random texts (malignant) by specially designed instructions. Then, the distribution difference in cosine similarity between images and the two types of class description texts can be used as the criterion to detect backdoor samples. Extensive experiments validate that our proposed BDetCLIP is superior to state-of-the-art backdoor detection methods, in terms of both effectiveness and efficiency.

Decision: reject
Reviewer scores: 6, 6, 6, 5

Reviews and discussion:
<thread>
creation date:
1730453669640

thread_type:
official_review

<thread_object>
creator: reviewer_dxen

<content>
summary:
The paper presents BDetCLIP, a novel test-time backdoor detection method for multimodal contrastive learning models like CLIP. The approach leverages contrastive prompting to differentiate between clean and backdoored images by analyzing the distribution differences in cosine similarity with benign and malignant class description texts. Extensive experiments demonstrate the method's superior effectiveness and efficiency compared to state-of-the-art detection methods.

strengths:
The authors claim that this is the first work on backdoor detection during the inference phase.
The paper introduces a novel approach by using contrastive prompting, which is innovative and leverages the strengths of large language models.
This work offers a computationally efficient solution for real-world applications, surpassing previous methods by large margins.

weaknesses:
The experiments focus on specific attack types and large multimodal models. Including a broader range of attacks and models could enhance the robustness of the evaluation.
Some technical aspects, such as the choice of thresholds and specific parameter settings for both CLIP and attack methods, could be explained in greater detail. 
While the method is computationally efficient, its applicability in highly dynamic environments or with evolving backdoor techniques might require further exploration. Discussing potential challenges and solutions for such scenarios could improve the work's practical relevance.

questions:
The method looks overly reliant on large language models like GPT-4 to generate class-specific prompts. Is the key to the apparent effectiveness of the method in how well a prompt is designed?

Are the clean samples used for detection the same as those used for threshold selection? Additionally, was the complete validation set used when selecting the threshold?

Attack concerns: (a) Why use BadNet-LC and Blended-LC instead of the original version LC? (b) The number of selected backdoor classes (3, 1, 1, respectively) is not sufficient compared to the total number of classes in the dataset. (c) The range of attack methods requires further inclusion, e.g., IAD and WaNet. (d) More detailed attack settings should be provided.

Experimental results concerns: (a) In table 1, why is the performance of TeCo on Blended and Blended-LC higher in certain cases? (b) For BadCLIP attack, the performance order of the three comparative detection methods seems to be completely opposite to the previous results. (c) Why did the AUROC increase after incorporating CleanCLIP? The model after defense should be more similar to a clean model, thereby reducing the backdoor effect. (d) In table 9, the AUROC of Blended-LC decreases when using contrastive prompts.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730629857563

thread_type:
official_review

<thread_object>
creator: reviewer_4hwz

<content>
summary:
This paper introduces a new method for detecting backdoors in CLIP models at test time. The main idea is to use how backdoored samples remain insensitive to changes in text descriptions. The method generates two types of prompts with LLMs and measures the difference in cosine similarities between images and these prompts to detect backdoors. It's efficient because it doesn't require parameter updates.

strengths:
- The paper highlights a key gap in current backdoor defenses for multimodal models:  
  - While previous methods focus on training or fine-tuning, which require high computational costs, test-time detection hasn't been explored yet. This leads to a new research direction that's both interesting and practical.

- The contrastive prompting mechanism is effective because:
  - It uses the multimodal features of CLIP, addressing a limitation of previous unimodal detection methods that ignore the text modality.
  - The use of benign and malicious prompts provides a natural way to measure semantic sensitivity without modifying the model.

weaknesses:
- The method relies on the assumption that backdoor samples are insensitive to changes in text descriptions while clean samples are sensitive. However:
  - Limited Analysis of Multi-target Attacks: The analysis only covers single-target backdoor attacks. If backdoor triggers cause different outputs based on context (e.g., indoor vs outdoor scenes), the assumption of semantic insensitivity may not hold, exposing a gap between simplified models and real-world cases.
  - Simplified Trigger Representation: Current assumption: $x^*=(1-M) \odot x+M \odot \Delta$, where $\Delta$ is a simple pixel-pattern trigger. Modern backdoor attacks may use semantic-level triggers that naturally align with textual descriptions, yet the paper does not analyze how this alignment impacts the distribution difference  $\Omega(x)$.

- Prompt Quality Variation: There is no mechanism to ensure prompt quality is consistent across different categories or evaluations, and no metrics to assess prompt quality. The effect of prompt variation on detection reliability is also not examined.
- Gaps in Theory: There’s no clear definition of what makes a “good” prompt, nor an analysis linking prompt properties to detection performance.

questions:
- Considering the complexity of semantic-level backdoor attacks:
  - Have you considered scenarios with semantically meaningful triggers?
  - How would your method handle triggers that respond naturally to changes in prompt semantics?

- How do you ensure prompt quality consistency across different categories, runs, and LLM implementations?

- Have you considered a framework for assessing prompt quality, looking at:
  - Coverage of category-specific features,
  - Distinctiveness from other categories,
  - Stability across different prompts?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730646093864

thread_type:
official_review

<thread_object>
creator: reviewer_gxdl

<content>
summary:
The paper presents BDetCLIP, a novel method for detecting backdoored samples in multimodal contrastive learning models during the inference time. The proposed method is computationally efficient and effective.

strengths:
1. The paper considers a novel scenario that detects backdoors in inference time for MCL. The proposed method is efficient and effective.
2. The authors conduct extensive experiments on multiple datasets and diverse attack types. The results demonstrate that BDetCLIP outperforms existing detection methods (e.g., STRIP, SCALE-UP, TeCo) in both effectiveness and efficiency.

weaknesses:
1. **Clarity of Methodology**

(1) **Motivation Lacks Depth**
The authors base their proposed approach on a single observation: “the distribution difference of backdoored images between the benign and malignant changes of class prompts is smaller than that of clean images.” In my view, this constitutes an insufficient contribution. The paper does not explain the underlying mechanism of this phenomenon, making it hard to validate whether this observation holds across different attack scenarios.

(2) Furthermore, the authors have not provided theoretical validation regarding the hyperparameter m and its relationship with $\epsilon$; instead, they rely solely on empirical evidence to suggest that their method outperforms existing unimodal detection approaches. This lack of theoretical grounding renders the method less solid.

(3) Additionally, the authors have not assessed the detection capabilities of their proposed method against adaptive attacks. Consequently, the reliability of the proposed approach against different types of backdoor attacks comes into question.

2. **Insufficiency of Experiments**

(1) Although the authors claim to be the first to propose a detection method for CLIP during the inference phase and assert that the costs of fine-tuning defense methods are higher than those for inference-stage detection, this does not justify the absence of comparisons with existing defense methods. Both defense and detection share the common goal of preventing backdoor attacks. If defenses are indeed more effective than detection methods, then it is unlikely that practical applications would forgo defenses due to cost concerns. The authors argue that the metrics for the two approaches differ; however, I believe they could establish a specific threshold to convert detection results into Attack Success Rate (ASR) for a more direct comparison with existing defense methods. Without this, the authors cannot substantiate the superiority of their proposed method.

(2) The authors predominantly use AUROC to evaluate the effectiveness of their method, which is insufficient for assessing the impact on model performance. I recommend that the authors include additional metrics, such as precision and accuracy, to demonstrate the method's effects on normal model performance.

(3) Moreover, I believe the use of BadNet and Blended in the main experiments is inadequate. Given that the focus of this research is on multimodal contrastive learning, both BadNet and Blended are unimodal methods. The authors should compare their method against more recent multimodal contrastive learning attack methods to showcase its advantages. While the authors do compare against BadCLIP in Table 6, the low AUROC raises the question of whether the proposed method is less effective for detecting multimodal backdoor attacks.

(4) Dependency on Large Language Models: The reliance on models like GPT-4 for generating prompts could introduce significant computational costs. While the paper mentions the feasibility of using open-source alternatives, it lacks detailed evaluations comparing the performance of these alternatives against GPT-4-generated prompts.

## **Late Response to Authors**

I appreciate the authors' efforts during the rebuttal phase, and as a result, I have decided to raise my rating to 6. However, after reviewing the latest **PDF version** of the paper, I believe that most of the main experimental results are insufficient, as they primarily compare Badnet, Blended, and their LC versions. These two methods are both quite outdated and focus on single-modal attacks, which significantly weakens the overall experimental validity. **While the authors have added some additional experiments with great effort, I still feel that, for a paper aimed at CLIP detection, this is not enough. Given the time constraints during the rebuttal period, I suggest that this issue be addressed in the revised version. Otherwise, I believe the paper will not meet the acceptance criteria.**

questions:
Please see the Weaknesses for the identified issues.
</content>
</thread_object>

</thread>
<thread>
creation date:
1731145978363

thread_type:
official_review

<thread_object>
creator: reviewer_xrmc

<content>
summary:
This paper proposed BDetCLIP to defend against backdoor attacks on CLIP. Different from cuttent methods, this is the first attempt at a computationally efficient backdoor detection method in the inference stage. The experiments show that BDetCLIP performs well in terms of both effectiveness and efficiency.

strengths:
-	This paper proposed a inference-stage method, which does not access to the pre-traing or finetuning, and also the training data.
-	The method is well-motivated, i.e., the visual representations of backdoored images are insensitive to both benign and malignant changes in class description texts. 
-	Overall, the ablation studies are well-organized, illustrating the effectiveness of the proposed method.

weaknesses:
-	This paper only focused on the classification task, assuming that there a closed category space. However, VLMs are good at open-set classification tasks.
-	The authors introduce a method that helps to choose the threshold $\epsilon$ in Appendix B. However, the selection method requires a small set of clean validation data. It would be better to include the sensitivity analysis of the threshold $\epsilon$ to show the robustness of $\epsilon$.
-	The investigation of adaptive attack is missing. Since the proposed defense is based on the property of backdoor samples, it is necessary to go deep into adaptive attacks.

questions:
Please see the weakness part.
</content>
</thread_object>

</thread>
<thread>
creation date:
1732351344605

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Summary of changes

comment:
We would like to express our gratitude to all reviewers for providing insightful comments and constructive suggestions. We are glad that they consider our proposed BDetCLIP to be **well-motivated (Reviewer Xrmc)** and **novel (Reviewer 4hWz, Reviewer Dxen)**. Besides, We are also glad that **all reviewers agree that BDetCLIP is effective and efficient**. We summarize the key changes of our manuscript as follows:

We have updated our threshold selection method in Appendix B "Threshold Selection" and presented the performance of our detection method across multiple metrics (Accuracy, Recall, F1-score, and AUROC) under different sampling rates to demonstrate its reliability. (suggested by **Reviewer Xrmc, Reviewer gXdL, and Reviewer Dxen**).

We have provided the defense result comparison with CleanCLIP in Appendix E (suggested by **Reviewer gXdL**).

We have added more details of attacking CLIP in Appendix D (suggested by **Reviewer Dxen**).

We have conducted an exploratory experiment investigating the relationship between the number of class-specific benign prompts and the threshold, which is detailed under the "The relationship between the number of class-specific benign prompts and threshold" section in Appendix F: MORE EXPERIMENTAL RESULTS (suggested by **Reviewer gXdL**).

We have included a new section titled "Appendix H: Future Work" to explore the following topics:
 1. More sophisticated backdoor attacks, such as triggers capable of naturally adapting to changes in prompt semantics (suggested by **Reviewer 4hWz**).
 2. Strategies for further enhancing detection effectiveness, including the development of a framework for evaluating prompt quality to further improve the quality of prompts (suggested by **Reviewer 4hWz**).

We have further expanded the defense scenarios based on the reviewers' feedback:

1. We have added our detection results in the open-set classification scenario under the "Backdoor detection for open-set detection" section in Appendix F: MORE EXPERIMENTAL RESULTS (suggested by **Reviewer Xrmc**).

2. We have included our detection results in the scenario where the backdoor trigger has semantic meaning under the "Backdoor detection for semantically meaningful trigger" section in Appendix F: MORE EXPERIMENTAL RESULTS (suggested by **Reviewer 4hWz**).

3. We have appended our detection results for Wanet under the "Backdoor detection for Wanet" section in Appendix F: MORE EXPERIMENTAL RESULTS (suggested by **Reviewer Dxen**).

4. We have appended our detection results for multi-targets attack under the "Backdoor detection for multi-targets attack" section in Appendix F: MORE EXPERIMENTAL RESULTS (suggested by **Reviewer 4hWz**).
</content>
</thread_object>

</thread>
<thread>
creation date:
1733313636118

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Commitment to Revised Manuscript with Expanded Results

comment:
Dear Reviewers, ACs, SACs, and PCs,

We sincerely appreciate the valuable time you have invested in reviewing our work!

Since OpenReview does not allow authors to upload new manuscripts, we commit to incorporating the results for BadEncoder [3] and TrojVQA [4] into the revised manuscript. In this way, we believe that our paper finally covers a wide range of backdoor attack scenarios, including BadNet, Blended, BadNetLC, BlendedLC, WaNet, ISSBA, semantic backdoor triggers, BadCLIP-1 [1], BadCLIP-2 [2], BadEncoder, and TrojVQA, as well as multi-target backdoor attacks. 

Thank you again for your valuable feedback and support!

Best regards,

Authors

**References:**

[1] BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learning. In CVPR, 2024.

[2] BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIP. In CVPR, 2024.

[3] BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learning, In SP, 2022.

[4] Dual-Key Multimodal Backdoors for Visual Question Answering, In CVPR, 2022.
</content>
</thread_object>

</thread>


Metareview:
metareview:
This work proposed a test-time detection against the backdoor attack on CLIP model, based on the observation that "the visual representations of backdoored images are insensitive to both benign and malignant changes in class description texts". 

It received 4 details reviews. The strengths mentioned by reviewers mainly include: the new attempt of test-time detection against the backdoor attack on CLIP, clear observation and innovative methodology design, extensive ablation studies, good performance. 

Meanwhile, there are also several important concerns, mainly including:
1. Adaptive attacks are missing. 
2. Sensitivity analysis to hyper-parameters is missing. 
3. The analysis of the observation is missing. 
4. Limited attacks are evaluated. 
5. The comparison with defenses in other stages is missing. 
6. The reliance on the quality of the GPT generated prompts is questionable. 

There are sufficient discussions between authors and reviewers. I am happy to see that both the questions and answers are very professional. My judgements about above points as shown below:
Points 1-3 have been addressed to some extent in the rebuttal. 
Points 4-6 are not well addressed in the rebuttal, which downgrades the importance and practical effectiveness of the proposed method.  

Overall, I think that although there are some merits in this work, it should be further improved to satisfy the quality bar of ICLR. Thus, my recommendation is reject.