mlsanityData to 14 Oct 2026

BadToken: Token-level Backdoor Attacks to Multi-modal Large Language Models

arXiv 2503.16023 ↗First posted 20 Mar 2025cs.CRcited by 17

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Multi-modal large language models (MLLMs) extend large language models (LLMs) to process multi-modal information, enabling them to generate responses to image-text inputs. MLLMs have been incorporated into diverse multi-modal applications, such as autonomous driving and medical diagnosis, via plug-and-play without fine-tuning. This deployment paradigm increases the vulnerability of MLLMs to backdoor attacks. However, existing backdoor attacks against MLLMs achieve limited effectiveness and stealthiness. In this work, we propose BadToken, the first token-level backdoor attack to MLLMs. BadToken introduces two novel backdoor behaviors: Token-substitution and Token-addition, which enable flexible and stealthy attacks by making token-level modifications to the original output for backdoored inputs. We formulate a general optimization problem that considers the two backdoor behaviors to maximize the attack effectiveness. We evaluate BadToken on two open-source MLLMs and various tasks. Our results show that our attack maintains the model's utility while achieving high attack success rates and stealthiness. We also show the real-world threats of BadToken in two scenarios, i.e., autonomous driving and medical diagnosis. Furthermore, we consider defenses including fine-tuning and input purification. Our results highlight the threat of our attack.

Key facts. Cited by 17 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 38 of its 54 references that are in the map. First posted on arXiv 20 Mar 2025.

Builds on

38 of 54 references.

Closest ancestors · 6

Same direction, newest first

  1. 2024TrojVLM: Backdoor Attack Against Vision Language Models28 Sep
  2. 2024VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Models21 Feb
  3. 2024Test-Time Backdoor Attacks on Multimodal Large Language Models13 Feb
  4. 2023Composite Backdoor Attacks Against Large Language Models11 Oct
  5. 2023BadGPT: Exploring Security Vulnerabilities of ChatGPT via Backdoor Attacks to InstructGPT21 Feb
  6. 2023Backdoor Attacks to Pre-trained Unified Foundation Models18 Feb

Other references · 32

  1. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  2. 2023Visual Instruction Tuningcited by 7,869
  3. 2023BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Modelscited by 6,137
  4. 2022Flamingo: a Visual Language Model for Few-Shot Learningcited by 4,386
  5. 2023Mistral 7Bcited by 3,164
  6. 2023MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Modelscited by 2,711
  7. 2016Making the V in VQA Matter: Elevating the Role of Image Understanding in Visual Question Answeringcited by 2,516
  8. 2015Microsoft COCO Captions: Data Collection and Evaluation Servercited by 1,462
  9. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  10. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  11. 2023A Survey on Multimodal Large Language Modelscited by 909
  12. 2023OpenFlamingo: An Open-Source Framework for Training Large Autoregressive Vision-Language Modelscited by 565
20 more
  1. 2024DriveVLM: The Convergence of Autonomous Driving and Large Vision-Language Modelscited by 490
  2. 2023DriveGPT4: Interpretable End-to-end Autonomous Driving via Large Language Modelcited by 461
  3. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 353
  4. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 341
  5. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 242
  6. 2018Backdoor Embedding in Convolutional Neural Network Models via Invisible Perturbationcited by 134
  7. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 128
  8. 2024Vision-Language Models for Medical Report Generation and Visual Question Answering: A Reviewcited by 125
  9. 2023SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistencycited by 97
  10. 2021Backdoor Pre-trained Models Can Transfer to Allcited by 86
  11. 2020DeepSweep: An Evaluation Framework for Mitigating DNN Backdoor Attacks using Data Augmentationcited by 77
  12. 2018Backdooring Convolutional Neural Networks via Targeted Weight Perturbationscited by 69
  13. 2023Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimizationcited by 64
  14. 2021Handcrafted Backdoors in Deep Neural Networkscited by 63
  15. 2023Black-box Backdoor Defense via Zero-shot Image Purificationcited by 45
  16. 2024Physical Backdoor Attack can Jeopardize Driving with Vision-Large-Language Modelscited by 33
  17. 2021How to Inject Backdoors with Better Consistency: Logit Anchoring on Clean Datacited by 24
  18. 2020Natural Backdoor Attack on Text Datacited by 22
  19. 2022Backdoor Attacks on Crowd Countingcited by 10
  20. 2024Physical Backdoor: Towards Temperature-based Backdoor Attacks in the Physical Worldcited by 6

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 7; 2026: 10.

17 papers.

Sort:

By area:

  1. 2025Backdoor Cleaning without External Guidance in MLLM Fine-tuningcited by 35
  2. 2025BEAT: Visual Backdoor Attacks on VLM-based Embodied Agents via Contrastive Trigger Learningcited by 9
  3. 2025TokenSwap: Backdoor Attack on the Compositional Understanding of Large Vision-Language Modelscited by 5
  4. 2026When Attention Betrays: Erasing Backdoor Attacks in Robotic Policies by Reconstructing Visual Tokenscited by 4
  5. 2026Adversarial Attacks on Multimodal Large Language Models: A Comprehensive Surveycited by 4
  6. 2025DecepChain: Inducing Deceptive Reasoning in Large Language Modelscited by 3
  7. 2026Multi-turn Jailbreaking Attack in Multi-Modal Large Language Modelscited by 3
  8. 2026SlowBA: An efficiency backdoor attack towards VLM-based GUI agentscited by 3
  9. 2025Concept-Guided Backdoor Attack on Vision Language Modelscited by 2
  10. 2025Where Do Backdoors Live? A Component-Level Analysis of Backdoor Propagation in Speech Language Modelscited by 1
  11. 2026Token by Token, Compromised: Backdoor Vulnerabilities in Unified Autoregressive Modelscited by 1
  12. 2026Trusted Weights, Treacherous Optimizations? Optimization-Triggered Backdoor Attacks on LLMscited by 1
5 more
  1. 2025Adversarial Attacks in Multimodal Systems: A Practitioner's Surveycited by 0
  2. 2026ReShift: Aha-Moment-Driven Reasoning-Level Backdoor Attacks on Vision-Language Modelscited by 0
  3. 2026Robust Dynamic Expansion for Continual Learning under Backdoor Attacks via Purification and Selective Recoverycited by 0
  4. 2026FreqDoor: A Hidden Trojan in the Frequency Domain for Backdoor Attacks on Vision-Language Modelscited by 0
  5. 2026EvolvAttack: Backdooring self Evolving VLM Agentscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Cross-Modal Backdoors in Multimodal Large Language Models
  2. 2024BackdoorLLM: A Comprehensive Benchmark for Backdoor Attacks and Defenses on Large Language Models
  3. 2025BackdoorVLM: A Benchmark for Backdoor Attacks and Defenses on Vision-Language Models
  4. 2024Large Language Models are Good Attackers: Efficient and Stealthy Textual Backdoor Attacks
  5. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Models
  6. 2024BadEdit: Backdooring large language models by model editing
  7. 2024BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models
  8. 2024MEGen: Generative Backdoor into Large Language Models via Model Editing