mlsanityData to 14 Oct 2026

Backdoor Cleaning without External Guidance in MLLM Fine-tuning

arXiv 2505.16916 ↗First posted 22 May 2025cs.CR cs.CVcited by 35

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

Multimodal Large Language Models (MLLMs) are increasingly deployed in fine-tuning-as-a-service (FTaaS) settings, where user-submitted datasets adapt general-purpose models to downstream tasks. This flexibility, however, introduces serious security risks, as malicious fine-tuning can implant backdoors into MLLMs with minimal effort. In this paper, we observe that backdoor triggers systematically disrupt cross-modal processing by causing abnormal attention concentration on non-semantic regions--a phenomenon we term attention collapse. Based on this insight, we propose Believe Your Eyes (BYE), a data filtering framework that leverages attention entropy patterns as self-supervised signals to identify and filter backdoor samples. BYE operates via a three-stage pipeline: (1) extracting attention maps using the fine-tuned model, (2) computing entropy scores and profiling sensitive layers via bimodal separation, and (3) performing unsupervised clustering to remove suspicious samples. Unlike prior defenses, BYE equires no clean supervision, auxiliary labels, or model modifications. Extensive experiments across various datasets, models, and diverse trigger types validate BYE's effectiveness: it achieves near-zero attack success rates while maintaining clean-task performance, offering a robust and generalizable solution against backdoor threats in MLLMs.

Key facts. Cited by 35 papers in the map (data through 14 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 75 of its 101 references that are in the map. First posted on arXiv 22 May 2025.

Builds on

75 of 101 references.

Closest ancestors · 15

Same direction, newest first

  1. 2025A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluations14 Feb
  2. 2025Rethinking Bottlenecks in Safety Fine-Tuning of Vision Language Models30 Jan
  3. 2024Cross-Modal Safety Mechanism Transfer in Large Vision-Language Models16 Oct
  4. 2024Backdooring Vision-Language Models with Out-Of-Distribution Data2 Oct
  5. 2024TrojVLM: Backdoor Attack Against Vision Language Models28 Sep
  6. 2024CoCA: Regaining Safety-awareness of Multimodal Large Language Models with Constitutional Calibration17 Sep
  7. 2024Cross-modality Information Check for Detecting Jailbreaking in Multimodal Large Language Models31 Jul
  8. 2024Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models14 Mar
  9. 2024Eyes Closed, Safety On: Protecting Multimodal LLMs via Image-to-Text Transformation14 Mar
  10. 2024AdaShield: Safeguarding Multimodal Large Language Models from Structure-based Attack via Adaptive Shield Prompting14 Mar
  11. 2024VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Models21 Feb
  12. 2024MLLM-Protector: Ensuring MLLM's Safety without Hurting Performance5 Jan
3 more
  1. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
  2. 2023How Robust is Google's Bard to Adversarial Image Attacks?21 Sep
  3. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Models22 Jun

Other references · 60

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  2. 2023GPT-4 Technical Reportcited by 18,396
  3. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  4. 2023Visual Instruction Tuningcited by 7,869
  5. 2023BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Modelscited by 6,137
  6. 2022PaLM: Scaling Language Modeling with Pathwayscited by 5,326
  7. 2022Flamingo: a Visual Language Model for Few-Shot Learningcited by 4,386
  8. 2023MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Modelscited by 2,711
  9. 2014CIDEr: Consensus-based Image Description Evaluationcited by 2,046
  10. 2022Learn to Explain: Multimodal Reasoning via Thought Chains for Science Question Answeringcited by 1,919
  11. 2024Expanding Performance Boundaries of Open-Source Multimodal Models with Model, Data, and Test-Time Scalingcited by 1,599
  12. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
38 more
  1. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  2. 2023A Survey on Multimodal Large Language Modelscited by 909
  3. 2023VILA: On Pre-training for Visual Language Modelscited by 692
  4. 2022Diffusion Models for Adversarial Purificationcited by 476
  5. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 459
  6. 2020Backdoor Learning: A Surveycited by 426
  7. 2024MLLM-as-a-Judge: Assessing Multimodal LLM-as-a-Judge with Vision-Language Benchmarkcited by 372
  8. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 324
  9. 2023A Survey on Multimodal Large Language Models for Autonomous Drivingcited by 290
  10. 2021IconQA: A New Benchmark for Abstract Diagram Understanding and Visual Language Reasoningcited by 267
  11. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 263
  12. 2020RSVQA: Visual Question Answering for Remote Sensing Datacited by 203
  13. 2025MLLMs Know Where to Look: Training-free Perception of Small Visual Details with Multimodal LLMscited by 176
  14. 2024Safety Fine-Tuning at (Almost) No Cost: A Baseline for Vision Large Language Modelscited by 167
  15. 2017Neural Trojanscited by 153
  16. 2022Backdoor Defense via Decoupling the Training Processcited by 153
  17. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 152
  18. 2023On the Adversarial Robustness of Multi-Modal Foundation Modelscited by 145
  19. 2024Vaccine: Perturbation-aware Alignment for Large Language Models against Harmful Fine-tuning Attackcited by 115
  20. 2024Harmful Fine-tuning Attacks and Defenses for Large Language Models: A Surveycited by 90
  21. 2019Design and Evaluation of a Multi-Domain Trojan Detection Method on Deep Neural Networkscited by 71
  22. 2024Visual-RolePlay: Universal Jailbreak Attack on MultiModal Large Language Models via Role-playing Image Charactercited by 68
  23. 2024Jailbreak Large Vision-Language Models Through Multi-Modal Linkagecited by 62
  24. 2025PRISM: Self-Pruning Intrinsic Selection Method for Training-Free Multimodal Data Selectioncited by 61
  25. 2023Black-box Backdoor Defense via Zero-shot Image Purificationcited by 45
  26. 2024Image Textualization: An Automatic Framework for Creating Accurate and Detailed Image Descriptionscited by 43
  27. 2025GuardReasoner-VL: Safeguarding VLMs via Reinforced Reasoningcited by 42
  28. 2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistencycited by 39
  29. 2024From Redundancy to Relevance: Information Flow in LVLMs Across Reasoning Taskscited by 38
  30. 2021Defending Against Backdoor Attacks in Natural Language Generationcited by 33
  31. 2024Physical Backdoor Attack can Jeopardize Driving with Vision-Large-Language Modelscited by 33
  32. 2025VLM2-Bench: A Closer Look at How Well VLMs Implicitly Link Explicit Matching Visual Cuescited by 33
  33. 2024On Large Visual Language Models for Medical Imaging Analysis: An Empirical Studycited by 28
  34. 2024CleanGen: Mitigating Backdoor Attacks for Generation Tasks in Large Language Modelscited by 24
  35. 2024Personalized Visual Instruction Tuningcited by 24
  36. 2020CLEANN: Accelerated Trojan Shield for Embedded Neural Networkscited by 22
  37. 2025REFINE: Inversion-Free Backdoor Defense via Model Reprogrammingcited by 22
  38. 2025Panacea: Mitigating Harmful Fine-tuning for Large Language Models via Post-fine-tuning Perturbationcited by 20

50 most cited of 60 All 60 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 14; 2026: 21.

35 papers.

Sort:

By area:

  1. 2025ASCD: Attention-Steerable Contrastive Decoding for Reducing Hallucination in MLLMcited by 37
  2. 2025HUD: Hierarchical Uncertainty-Aware Disambiguation Network for Composed Video Retrievalcited by 32
  3. 2025Sherlock: Self-Correcting Reasoning in Vision-Language Modelscited by 13
  4. 2025SafeGRPO: Self-Rewarded Multimodal Safety Alignment via Rule-Governed Policy Optimizationcited by 12
  5. 2025V-Attack: Targeting Disentangled Value Features for Controllable Adversarial Attacks on LVLMscited by 9
  6. 2025When Large Multimodal Models Confront Evolving Knowledge: Challenges and Explorationscited by 7
  7. 2025TECP: Token-Entropy Conformal Prediction for LLMscited by 6
  8. 2026ReflectRL: Learning from Golden Negative Trajectories via Reflective-to-Direct Reasoningcited by 6
  9. 2025TokenSwap: Backdoor Attack on the Compositional Understanding of Large Vision-Language Modelscited by 5
  10. 2026EMO-R3: Reflective Reinforcement Learning for Emotional Reasoning in Multimodal Large Language Modelscited by 5
  11. 2026Test-Time Attention Purification for Backdoored Large Vision Language Modelscited by 5
  12. 2025AnomalyLMM: Bridging Generative Knowledge and Discriminative Retrieval for Text-Based Person Anomaly Searchcited by 4
23 more
  1. 2026When Attention Betrays: Erasing Backdoor Attacks in Robotic Policies by Reconstructing Visual Tokenscited by 4
  2. 2026Set-Valued Prediction for Large Language Models with Feasibility-Aware Coverage Guaranteescited by 4
  3. 2026EchoRL: Reinforcement Learning via Rollout Echoingcited by 4
  4. 2025ThanoRA: Task Heterogeneity-Aware Multi-Task Low-Rank Adaptationcited by 3
  5. 2026TCAP: Tri-Component Attention Profiling for Unsupervised Backdoor Detection in MLLM Fine-Tuningcited by 3
  6. 2025Conformal Sets in Multiple-Choice Question Answering under Black-Box Settings with Provable Coverage Guaranteescited by 2
  7. 2026Self-Purification Mitigates Backdoors in Multimodal Diffusion Language Modelscited by 2
  8. 2026BackdoorIDS: Zero-shot Backdoor Detection for Pretrained Vision Encodercited by 1
  9. 2026Uncertainty-Aware Abstention in Large Language Models with Provable Alignment Guaranteescited by 1
  10. 2025FADE: Adversarial Concept Erasure in Flow Modelscited by 0
  11. 2025Conformal P-Value in Multiple-Choice Question Answering Tasks with Provable Risk Controlcited by 0
  12. 2025Robust Concept Erasure in Diffusion Models: A Theoretical Perspective on Security and Robustnesscited by 0
  13. 2026When Denoising Becomes Unsigning: Theoretical and Empirical Analysis of Watermark Fragility Under Diffusion-Based Image Editingcited by 0
  14. 2026Editing Away the Evidence: Diffusion-Based Image Manipulation and the Failure Modes of Robust Watermarkingcited by 0
  15. 2026BYORn: Bootstrap Your Own Responses to Defend Large Vision-Language Models Against Backdoor Attackscited by 0
  16. 2026Shared Latent Structures Enable Unified Backdoor Detection and Mitigation in LLMscited by 0
  17. 2026ThinkDeception: A Progressive Reinforcement Learning Framework for Interpretable Multimodal Deception Detectioncited by 0
  18. 2026ReShift: Aha-Moment-Driven Reasoning-Level Backdoor Attacks on Vision-Language Modelscited by 0
  19. 2026TrustVLA: Mechanism-Guided Inference-Time Defense Against Vision-Language-Action Backdoorscited by 0
  20. 2026Evolving Safety Landscape of Multi-modal Large Language Models: A Survey of Emerging Threats and Safeguardscited by 0
  21. 2026Not All Tokens Are Equal: Region-Aware Consistency Repair of Backdoors in MLLMscited by 0
  22. 2026TraceGuard: Adaptive Multimodal Poison Filtering through Cross-Feature Rank Agreementcited by 0
  23. 2026Selective Channel Restoration for Backdoored Vision-Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026EntropyScan: Towards Model-level Backdoor Detection in LVLMs via Visual Attention Entropy
  2. 2026Defusing the Trigger: Tail-Risk-Informed Attention Rebalancing for LLM Backdoor Mitigation
  3. 2025Backdoor Attribution: Elucidating and Controlling Backdoor in Language Models
  4. 2025Uncovering and Aligning Anomalous Attention Heads to Defend Against NLP Backdoor Attacks
  5. 2026Beyond Static Cues: Unified Dynamic Detection of MLLM Backdoors via Dual-Flow Trajectory Analysis
  6. 2026Purifying Generative LLMs from Backdoors without Prior Knowledge or Clean Reference
  7. 2026A Patch-based Cross-view Regularized Framework for Backdoor Defense in Multimodal Large Language Models
  8. 2026ProjLens: Unveiling the Role of Projectors in Multimodal Model Safety