mlsanityData to 7 Oct 2026

TrojVLM: Backdoor Attack Against Vision Language Models

arXiv 2409.19232 ↗First posted 28 Sep 2024cs.CVcited by 35

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

The emergence of Vision Language Models (VLMs) is a significant advancement in integrating computer vision with Large Language Models (LLMs) to produce detailed text descriptions based on visual inputs, yet it introduces new security vulnerabilities. Unlike prior work that centered on single modalities or classification tasks, this study introduces TrojVLM, the first exploration of backdoor attacks aimed at VLMs engaged in complex image-to-text generation. Specifically, TrojVLM inserts predetermined target text into output text when encountering poisoned images. Moreover, a novel semantic preserving loss is proposed to ensure the semantic integrity of the original image content. Our evaluation on image captioning and visual question answering (VQA) tasks confirms the effectiveness of TrojVLM in maintaining original semantic content while triggering specific target text outputs. This study not only uncovers a critical security risk in VLMs and image-to-text generation but also sets a foundation for future research on securing multimodal models against such sophisticated threats.

Key facts. Cited by 35 papers in the map (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 32 of its 47 references that are in the map. First posted on arXiv 28 Sep 2024.

Builds on

32 of 47 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024Test-Time Backdoor Attacks on Multimodal Large Language Models13 Feb
  2. 2024Shadowcast: Stealthy Data Poisoning Attacks Against Vision-Language Models5 Feb

Other references · 30

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  2. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  3. 2023Visual Instruction Tuningcited by 7,792
  4. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  5. 2023BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Modelscited by 6,069
  6. 2022Flamingo: a Visual Language Model for Few-Shot Learningcited by 4,337
  7. 2022BLIP: Bootstrapping Language-Image Pre-training for Unified Vision-Language Understanding and Generationcited by 4,310
  8. 2023InstructBLIP: Towards General-purpose Vision-Language Models with Instruction Tuningcited by 2,855
  9. 2023MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Modelscited by 2,689
  10. 2016Making the V in VQA Matter: Elevating the Role of Image Understanding in Visual Question Answeringcited by 2,498
  11. 2015VQA: Visual Question Answeringcited by 2,489
  12. 2014CIDEr: Consensus-based Image Description Evaluationcited by 2,027
18 more
  1. 2019OK-VQA: A Visual Question Answering Benchmark Requiring External Knowledgecited by 1,114
  2. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  3. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  4. 2020Backdoor Learning: A Surveycited by 412
  5. 2021Poisoning and Backdooring Contrastive Learningcited by 149
  6. 2021BadEncoder: Backdoor Attacks to Pre-trained Encoders in Self-Supervised Learningcited by 120
  7. 2024Logit Standardization in Knowledge Distillationcited by 101
  8. 2022A Unified Evaluation of Textual Backdoor Learning: Frameworks and Benchmarkscited by 70
  9. 2022A Multimodal Transformer: Fusing Clinical Notes with Structured EHR Data for Interpretable In-Hospital Mortality Predictioncited by 48
  10. 2022A Study of the Attention Abnormality in Trojaned BERTscited by 47
  11. 2022Data Poisoning Attacks Against Multimodal Encoderscited by 41
  12. 2021Dual-Key Multimodal Backdoors for Visual Question Answeringcited by 35
  13. 2023Attention-Enhancing Backdoor Attacks Against BERT-based Modelscited by 32
  14. 2024Task-Agnostic Detector for Insertion-Based Backdoor Attackscited by 23
  15. 2022Patch-level Gaze Distribution Prediction for Gaze Followingcited by 22
  16. 2023Universal Domain Adaptation via Compressive Attention Matchingcited by 15
  17. 2022Attention Hijacking in Trojan Transformerscited by 6
  18. 2024Object-oriented backdoor attack against image captioningcited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 2; 2025: 17; 2026: 16.

35 papers.

Sort:

By area:

  1. 2025A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluationscited by 66
  2. 2025GuardReasoner-VL: Safeguarding VLMs via Reinforced Reasoningcited by 38
  3. 2025BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimizationcited by 37
  4. 2025Backdoor Cleaning without External Guidance in MLLM Fine-tuningcited by 34
  5. 2024Backdooring Vision-Language Models with Out-Of-Distribution Datacited by 31
  6. 2025Stealthy Backdoor Attack in Self-Supervised Learning Vision Encoders for Large Vision Language Modelscited by 13
  7. 2024Defending Multimodal Backdoored Models by Repulsive Visual Prompt Tuningcited by 12
  8. 2025IAG: Input-aware Backdoor Attack on VLM-based Visual Groundingcited by 11
  9. 2025SRD: Reinforcement-Learned Semantic Perturbation for Backdoor Defense in VLMscited by 9
  10. 2026Inject Once Survive Later: Backdooring Vision-Language-Action Models to Persist Through Downstream Fine-tuningcited by 7
  11. 2025DREAM: Disentangling Risks to Enhance Safety Alignment in Multimodal Large Language Modelscited by 6
  12. 2025Malice in Agentland: Down the Rabbit Hole of Backdoors in the AI Supply Chaincited by 6
23 more
  1. 2026Test-Time Attention Purification for Backdoored Large Vision Language Modelscited by 5
  2. 2025VisualTrap: A Stealthy Backdoor Attack on GUI Agents via Visual Grounding Manipulationcited by 4
  3. 2025TokenSwap: Backdoor Attack on the Compositional Understanding of Large Vision-Language Modelscited by 4
  4. 2025DecepChain: Inducing Deceptive Reasoning in Large Language Modelscited by 3
  5. 2026SlowBA: An efficiency backdoor attack towards VLM-based GUI agentscited by 3
  6. 2026Adversarial Attacks on Multimodal Large Language Models: A Comprehensive Surveycited by 3
  7. 2025Concept-Guided Backdoor Attack on Vision Language Modelscited by 2
  8. 2026Self-Purification Mitigates Backdoors in Multimodal Diffusion Language Modelscited by 2
  9. 2025Backdooring CLIP through Concept Confusioncited by 1
  10. 2025BadPromptFL: A Novel Backdoor Threat to Prompt-based Federated Learning in Multimodal Modelscited by 0
  11. 2025GEO-Detective: Unveiling Location Privacy Risks in Images with LLM Agentscited by 0
  12. 2025When Harmful Content Gets Camouflaged: Unveiling Perception Failure of LVLMs with CamHarmTIcited by 0
  13. 2026Stage-wise Attention-Guided Region Sequencing for Adversarial Attacks on Large Vision-Language Modelscited by 0
  14. 2026Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluationcited by 0
  15. 2026Hidden Ads: Behavior Triggered Semantic Backdoors for Advertisement Injection in Vision Language Modelscited by 0
  16. 2026Phantasia: Context-Adaptive Backdoors in Vision Language Modelscited by 0
  17. 2026ProjLens: Unveiling the Role of Projectors in Multimodal Model Safetycited by 0
  18. 2026BYORn: Bootstrap Your Own Responses to Defend Large Vision-Language Models Against Backdoor Attackscited by 0
  19. 2026Evolving Safety Landscape of Multi-modal Large Language Models: A Survey of Emerging Threats and Safeguardscited by 0
  20. 2026Not All Tokens Are Equal: Region-Aware Consistency Repair of Backdoors in MLLMscited by 0
  21. 2026FreqDoor: A Hidden Trojan in the Frequency Domain for Backdoor Attacks on Vision-Language Modelscited by 0
  22. 2026TraceGuard: Adaptive Multimodal Poison Filtering through Cross-Feature Rank Agreementcited by 0
  23. 2026Selective Channel Restoration for Backdoored Vision-Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025BackdoorVLM: A Benchmark for Backdoor Attacks and Defenses on Vision-Language Models
  2. 2026CBV: Clean-label Backdoor Attacks on Vision Language Models via Diffusion Models
  3. 2025When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs
  4. 2026Backdoor Learning in Language Models and Vision-Language Models
  5. 2026VLMShield: Efficient and Robust Defense of Vision-Language Models against Malicious Prompts
  6. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trends
  7. 2025Attention! Your Vision Language Model Could Be Maliciously Manipulated
  8. 2025MTAttack: Multi-Target Backdoor Attacks against Large Vision-Language Models