mlsanityData to 7 Oct 2026

Test-Time Backdoor Attacks on Multimodal Large Language Models

arXiv 2402.08577 ↗First posted 13 Feb 2024cs.CL cs.CR cs.CVcited by 35

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

Backdoor attacks are commonly executed by contaminating training data, such that a trigger can activate predetermined harmful effects during the test phase. In this work, we present AnyDoor, a test-time backdoor attack against multimodal large language models (MLLMs), which involves injecting the backdoor into the textual modality using adversarial test images (sharing the same universal perturbation), without requiring access to or modification of the training data. AnyDoor employs similar techniques used in universal adversarial attacks, but distinguishes itself by its ability to decouple the timing of setup and activation of harmful effects. In our experiments, we validate the effectiveness of AnyDoor against popular MLLMs such as LLaVA-1.5, MiniGPT-4, InstructBLIP, and BLIP-2, as well as provide comprehensive ablation studies. Notably, because the backdoor is injected by a universal perturbation, AnyDoor can dynamically change its backdoor trigger prompts/harmful effects, exposing a new challenge for defending against backdoor attacks. Our project page is available at https://sail-sg.github.io/AnyDoor/.

Key facts. Cited by 35 papers in the map (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 115 of its 146 references that are in the map. First posted on arXiv 13 Feb 2024.

Builds on

115 of 146 references.

Closest ancestors · 7

Same direction, newest first

  1. 2023On the Robustness of Large Multimodal Models Against Image Adversarial Attacks6 Dec
  2. 2023BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIP26 Nov
  3. 2023Effective Backdoor Mitigation in Vision-Language Models Depends on the Pre-training Objective25 Nov
  4. 2023How Robust is Google's Bard to Adversarial Image Attacks?21 Sep
  5. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models26 Jul
  6. 2023On Evaluating Adversarial Robustness of Large Vision-Language Models26 May
  7. 2022Towards Adversarial Attack on Vision-Language Pre-training Models19 Jun

Other references · 108

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  2. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  3. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 13,958
  4. 2023Visual Instruction Tuningcited by 7,792
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  6. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  8. 2023BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Modelscited by 6,069
  9. 2013Intriguing properties of neural networkscited by 5,114
  10. 2023Improved Baselines with Visual Instruction Tuningcited by 4,362
  11. 2022Flamingo: a Visual Language Model for Few-Shot Learningcited by 4,337
  12. 2021Zero-Shot Text-to-Image Generationcited by 4,276
38 more
  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  2. 2023InstructBLIP: Towards General-purpose Vision-Language Models with Instruction Tuningcited by 2,855
  3. 2023MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Modelscited by 2,689
  4. 2016Visual Genome: Connecting Language and Vision Using Crowdsourced Dense Image Annotationscited by 2,646
  5. 2016Making the V in VQA Matter: Elevating the Role of Image Understanding in Visual Question Answeringcited by 2,498
  6. 2016Adversarial examples in the physical worldcited by 1,762
  7. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  8. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  9. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  10. 2023A Survey on Multimodal Large Language Modelscited by 898
  11. 2016Universal adversarial perturbationscited by 774
  12. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 709
  13. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  14. 2017Adversarial Patchcited by 514
  15. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  16. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  17. 2020Backdoor Learning: A Surveycited by 412
  18. 2019Hidden Trigger Backdoor Attackscited by 359
  19. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 341
  20. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  21. 2023Are aligned neural networks adversarially aligned?cited by 305
  22. 2019Label-Consistent Backdoor Attackscited by 285
  23. 2023Shadow Alignment: The Ease of Subverting Safely-Aligned Language Modelscited by 284
  24. 2019Fooling automated surveillance cameras: adversarial patches to attack person detectioncited by 268
  25. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
  26. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 237
  27. 2019A backdoor attack against LSTM-based text classification systemscited by 214
  28. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
  29. 2020Clean-Label Backdoor Attacks on Video Recognition Modelscited by 162
  30. 2023SVIT: Scaling up Visual Instruction Tuningcited by 161
  31. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  32. 2020Dynamic Backdoor Attacks Against Machine Learning Modelscited by 147
  33. 2018DPatch: An Adversarial Patch Attack on Object Detectorscited by 146
  34. 2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 143
  35. 2023On the Adversarial Robustness of Multi-Modal Foundation Modelscited by 142
  36. 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 131
  37. 2019Transferable Clean-Label Poisoning Attacks on Deep Neural Netscited by 129
  38. 2020Backdoor Attacks Against Deep Learning Systems in the Physical Worldcited by 129

50 most cited of 108 All 108 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 10; 2025: 14; 2026: 11.

35 papers.

Sort:

By area:

  1. 2024BadRAG: Identifying Vulnerabilities in Retrieval Augmented Generation of Large Language Modelscited by 84
  2. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trendscited by 82
  3. 2025A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluationscited by 66
  4. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 63
  5. 2024Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shiftcited by 45
  6. 2024TrojVLM: Backdoor Attack Against Vision Language Modelscited by 35
  7. 2025Topic-FlipRAG: Topic-Orientated Adversarial Opinion Manipulation Attacks to Retrieval-Augmented Generation Modelscited by 32
  8. 2024Backdooring Vision-Language Models with Out-Of-Distribution Datacited by 31
  9. 2025Towards Trustworthy Retrieval Augmented Generation for Large Language Models: A Surveycited by 29
  10. 2024B-AVIBench: Towards Evaluating the Robustness of Large Vision-Language Model on Black-box Adversarial Visual-Instructionscited by 26
  11. 2025X-Transfer Attacks: Towards Super Transferable Adversarial Attacks on CLIPcited by 21
  12. 2024Exploring Response Uncertainty in MLLMs: An Empirical Evaluation under Misleading Scenarioscited by 19
23 more
  1. 2024Unbridled Icarus: A Survey of the Potential Perils of Image Inputs in Multimodal Large Language Model Securitycited by 18
  2. 2025Survey of Adversarial Robustness in Multimodal Large Language Modelscited by 14
  3. 2025Stealthy Backdoor Attack in Self-Supervised Learning Vision Encoders for Large Vision Language Modelscited by 13
  4. 2025Backdoor Attack on Vision Language Models with Stealthy Semantic Manipulationcited by 13
  5. 2024Defending Multimodal Backdoored Models by Repulsive Visual Prompt Tuningcited by 12
  6. 2025SRD: Reinforcement-Learned Semantic Perturbation for Backdoor Defense in VLMscited by 9
  7. 2025TokenSwap: Backdoor Attack on the Compositional Understanding of Large Vision-Language Modelscited by 4
  8. 2026Visual Memory Injection Attacks for Multi-Turn Conversationscited by 2
  9. 2024Replace-then-Perturb: Targeted Adversarial Attacks With Visual Reasoning for Vision-Language Modelscited by 1
  10. 2025DeepSeek on a Trip: Inducing Targeted Visual Hallucinations via Representation Vulnerabilitiescited by 1
  11. 2025Cowpox: Towards the Immunity of VLM-based Multi-Agent Systemscited by 1
  12. 2025Text Prompt Injection of Vision Language Modelscited by 1
  13. 2025Semantic Router: On the Feasibility of Hijacking MLLMs via a Single Adversarial Perturbationcited by 0
  14. 2026Two Birds, One Projection: Harmonizing Safety and Utility in LVLMs via Inference-time Feature Projectioncited by 0
  15. 2026Hidden Ads: Behavior Triggered Semantic Backdoors for Advertisement Injection in Vision Language Modelscited by 0
  16. 2026Phantasia: Context-Adaptive Backdoors in Vision Language Modelscited by 0
  17. 2026ProjLens: Unveiling the Role of Projectors in Multimodal Model Safetycited by 0
  18. 2026BYORn: Bootstrap Your Own Responses to Defend Large Vision-Language Models Against Backdoor Attackscited by 0
  19. 2026Beyond Attack Success Rate: Examining Trigger Leakage in Vision-Language Agentic Systemscited by 0
  20. 2026Evolving Safety Landscape of Multi-modal Large Language Models: A Survey of Emerging Threats and Safeguardscited by 0
  21. 2026Backdoor Learning in Language Models and Vision-Language Modelscited by 0
  22. 2026Forbid Your Attention: Fooling Multimodal Large Language Models by Selectively Removing Intrinsic Focus in Spectral Domaincited by 0
  23. 2026FreqDoor: A Hidden Trojan in the Frequency Domain for Backdoor Attacks on Vision-Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Backdoor in Seconds: Unlocking Vulnerabilities in Large Pre-trained Models via Model Editing
  2. 2026A Patch-based Cross-view Regularized Framework for Backdoor Defense in Multimodal Large Language Models
  3. 2025BackdoorVLM: A Benchmark for Backdoor Attacks and Defenses on Vision-Language Models
  4. 2025MTAttack: Multi-Target Backdoor Attacks against Large Vision-Language Models
  5. 2026Adversarial Attacks on Multimodal Large Language Models: A Comprehensive Survey
  6. 2024BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models
  7. 2025Con Instruction: Universal Jailbreaking of Multimodal Large Language Models via Non-Textual Modalities
  8. 2025Robust Anti-Backdoor Instruction Tuning in LVLMs