mlsanityData to 7 Oct 2026

VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Models

arXiv 2402.13851 ↗First posted 21 Feb 2024cs.CVcited by 83

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

Autoregressive Visual Language Models (VLMs) showcase impressive few-shot learning capabilities in a multimodal context. Recently, multimodal instruction tuning has been proposed to further enhance instruction-following abilities. However, we uncover the potential threat posed by backdoor attacks on autoregressive VLMs during instruction tuning. Adversaries can implant a backdoor by injecting poisoned samples with triggers embedded in instructions or images, enabling malicious manipulation of the victim model's predictions with predefined triggers. Nevertheless, the frozen visual encoder in autoregressive VLMs imposes constraints on the learning of conventional image triggers. Additionally, adversaries may encounter restrictions in accessing the parameters and architectures of the victim model. To address these challenges, we propose a multimodal instruction backdoor attack, namely VL-Trojan. Our approach facilitates image trigger learning through an isolating and clustering strategy and enhance black-box-attack efficacy via an iterative character-level text trigger generation method. Our attack successfully induces target outputs during inference, significantly surpassing baselines (+62.52%) in ASR. Moreover, it demonstrates robustness across various model scales and few-shot in-context reasoning scenarios.

Key facts. Cited by 83 papers in the map (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 37 of its 54 references that are in the map. First posted on arXiv 21 Feb 2024.

Builds on

37 of 54 references.

References · 37

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  2. 2023Visual Instruction Tuningcited by 7,792
  3. 2022Flamingo: a Visual Language Model for Few-Shot Learningcited by 4,337
  4. 2022Scaling Instruction-Finetuned Language Modelscited by 2,997
  5. 2022Training Compute-Optimal Large Language Modelscited by 2,927
  6. 2023MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Modelscited by 2,689
  7. 2015VQA: Visual Question Answeringcited by 2,489
  8. 2015Microsoft COCO Captions: Data Collection and Evaluation Servercited by 1,447
  9. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  10. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  11. 2023Instruction Tuning for Large Language Models: A Surveycited by 617
  12. 2023OpenFlamingo: An Open-Source Framework for Training Large Autoregressive Vision-Language Modelscited by 560
25 more
  1. 2023Otter: A Multi-Modal Model with In-Context Instruction Tuningcited by 548
  2. 2020Backdoor Learning: A Surveycited by 412
  3. 2021High-Performance Large-Scale Image Recognition Without Normalizationcited by 359
  4. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  5. 2023MIMIC-IT: Multi-Modal In-Context Instruction Tuningcited by 264
  6. 2023Poisoning Language Models During Instruction Tuningcited by 254
  7. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 237
  8. 2018A Comprehensive Survey of Deep Learning for Image Captioningcited by 213
  9. 2021Poisoning and Backdooring Contrastive Learningcited by 149
  10. 2021Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical Worldcited by 127
  11. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
  12. 2023BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learningcited by 112
  13. 2018Transferable Adversarial Attacks for Image and Video Object Detectioncited by 109
  14. 2023Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Modelscited by 100
  15. 2022Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detectioncited by 79
  16. 2020Efficient Adversarial Attacks for Visual Object Trackingcited by 66
  17. 2023CleanCLIP: Mitigating Data Poisoning Attacks in Multimodal Contrastive Learningcited by 62
  18. 2023X-Adv: Physical Adversarial Object Attacks against X-ray Prohibited Item Detectioncited by 58
  19. 2022A Large-scale Multiple-objective Method for Black-box Attack against Object Detectioncited by 55
  20. 2023Pre-trained Trojan Attacks for Visual Recognitioncited by 38
  21. 2021Dual-Key Multimodal Backdoors for Visual Question Answeringcited by 35
  22. 2024Poisoned Forgery Face: Towards Backdoor Attacks on Face Forgery Detectioncited by 34
  23. 2022Exploring the Relationship between Architecture and Adversarially Robust Generalizationcited by 23
  24. 2023Improving Adversarial Transferability by Stable Diffusioncited by 22
  25. 2022Exploring Inconsistent Knowledge Distillation for Object Detection with Data Augmentationcited by 19

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 22; 2025: 37; 2026: 24.

83 papers.

Sort:

By area:

  1. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Promptcited by 103
  2. 2024SPA-VL: A Comprehensive Safety Preference Alignment Dataset for Vision Language Modelcited by 82
  3. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trendscited by 82
  4. 2025A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluationscited by 66
  5. 2025Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Modelscited by 61
  6. 2024Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shiftcited by 45
  7. 2025Manipulating Multimodal Agents via Cross-Modal Prompt Injectioncited by 42
  8. 2025BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimizationcited by 37
  9. 2024Unveiling the Safety of GPT-4o: An Empirical Study using Jailbreak Attackscited by 35
  10. 2025Backdoor Cleaning without External Guidance in MLLM Fine-tuningcited by 34
  11. 2024Unlearning Backdoor Threats: Enhancing Backdoor Defense in Multimodal Contrastive Learning via Local Token Unlearningcited by 31
  12. 2024Backdooring Vision-Language Models with Out-Of-Distribution Datacited by 31
38 more
  1. 2024Effectiveness Assessment of Recent Large Vision-Language Modelscited by 29
  2. 2024Compromising Embodied Agents with Contextual Backdoor Attackscited by 29
  3. 2024Breaking the False Sense of Security in Backdoor Defense through Re-Activation Attackcited by 26
  4. 2025Membership Inference Attacks Against Vision-Language Modelscited by 26
  5. 2024Towards Robust Physical-world Backdoor Attacks on Lane Detectioncited by 25
  6. 2024Unbridled Icarus: A Survey of the Potential Perils of Image Inputs in Multimodal Large Language Model Securitycited by 18
  7. 2024LanEvil: Benchmarking the Robustness of Lane Detection to Environmental Illusionscited by 18
  8. 2025T2VShield: Model-Agnostic Jailbreak Defense for Text-to-Video Modelscited by 17
  9. 2025VLM-Guard: Safeguarding Vision-Language Models via Fulfilling Safety Alignment Gapcited by 16
  10. 2025Natural Reflection Backdoor Attack on Vision Language Model for Autonomous Drivingcited by 16
  11. 2024The Synergy between Data and Multi-Modal Large Language Models: A Survey from Co-Development Perspectivecited by 14
  12. 2025Survey of Adversarial Robustness in Multimodal Large Language Modelscited by 14
  13. 2025SafeMobile: Chain-level Jailbreak Detection and Automated Evaluation for Multimodal Mobile Agentscited by 14
  14. 2024Object Detectors in the Open Environment: Challenges, Solutions, and Outlookcited by 13
  15. 2025Stealthy Backdoor Attack in Self-Supervised Learning Vision Encoders for Large Vision Language Modelscited by 13
  16. 2025Backdoor Attack on Vision Language Models with Stealthy Semantic Manipulationcited by 13
  17. 2024Defending Multimodal Backdoored Models by Repulsive Visual Prompt Tuningcited by 12
  18. 2025Hidden Ghost Hand: Unveiling Backdoor Vulnerabilities in MLLM-Powered Mobile GUI Agentscited by 12
  19. 2025Pushing the Limits of Safety: A Technical Report on the ATLAS Challenge 2025cited by 11
  20. 2025IAG: Input-aware Backdoor Attack on VLM-based Visual Groundingcited by 11
  21. 2026When World Models Dream Wrong: Physical-Conditioned Adversarial Attacks against World Modelscited by 11
  22. 2025ELBA-Bench: An Efficient Learning Backdoor Attacks Benchmark for Large Language Modelscited by 10
  23. 2025Robust Anti-Backdoor Instruction Tuning in LVLMscited by 10
  24. 2025SRD: Reinforcement-Learned Semantic Perturbation for Backdoor Defense in VLMscited by 9
  25. 2025Detoxifying Large Language Models via Autoregressive Reward Guided Representation Editingcited by 9
  26. 2025Hidden in the Noise: Unveiling Backdoors in Audio LLMs Alignment through Latent Acoustic Pattern Triggerscited by 7
  27. 2024Efficient Backdoor Defense in Multimodal Contrastive Learning: A Token-Level Unlearning Method for Mitigating Threatscited by 6
  28. 2025Lie Detector: Unified Backdoor Detection via Cross-Examination Frameworkcited by 6
  29. 2024CopyrightShield: Enhancing Diffusion Model Security against Copyright Infringement Attackscited by 5
  30. 2024TrapFlow: Controllable Website Fingerprinting Defense via Dynamic Backdoor Learningcited by 5
  31. 2025Evidence Recomposition and Predictive Context Residualization for Visual Attribution in Multimodal Large Language Modelscited by 5
  32. 2026Test-Time Attention Purification for Backdoored Large Vision Language Modelscited by 5
  33. 2024Towards Robust Object Detection: Identifying and Removing Backdoors via Module Inconsistency Analysiscited by 4
  34. 2025REVEAL: Multi-turn Evaluation of Image-Input Harms for Vision LLMcited by 4
  35. 2025VisualTrap: A Stealthy Backdoor Attack on GUI Agents via Visual Grounding Manipulationcited by 4
  36. 2025TokenSwap: Backdoor Attack on the Compositional Understanding of Large Vision-Language Modelscited by 4
  37. 2026When Attention Betrays: Erasing Backdoor Attacks in Robotic Policies by Reconstructing Visual Tokenscited by 4
  38. 2025Misaligned Roles, Misplaced Images: Structural Input Perturbations Expose Multimodal Alignment Blind Spotscited by 3

50 most cited of 83 All 83 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025BackdoorVLM: A Benchmark for Backdoor Attacks and Defenses on Vision-Language Models
  2. 2025MTAttack: Multi-Target Backdoor Attacks against Large Vision-Language Models
  3. 2026Once Poisoned, Arbitrarily Controlled: A Programmable Backdoor in VLMs
  4. 2025Concept-Guided Backdoor Attack on Vision Language Models
  5. 2024TrojanEdit: Multimodal Backdoor Attack Against Image Editing Model
  6. 2025Safeguarding Vision-Language Models: Mitigating Vulnerabilities to Gaussian Noise in Perturbation-based Attacks
  7. 2026A Patch-based Cross-view Regularized Framework for Backdoor Defense in Multimodal Large Language Models
  8. 2025Investigating Vulnerabilities and Defenses Against Audio-Visual Attacks: A Comprehensive Survey Emphasizing Multimodal Models