mlsanityData to 7 Oct 2026

TCAP: Tri-Component Attention Profiling for Unsupervised Backdoor Detection in MLLM Fine-Tuning

arXiv 2601.21692 ↗First posted 29 Jan 2026cs.AIcited by 0

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

Fine-Tuning-as-a-Service (FTaaS) facilitates the customization of Multimodal Large Language Models (MLLMs) but introduces critical backdoor risks via poisoned data. Existing defenses either rely on supervised signals or fail to generalize across diverse trigger types and modalities. In this work, we uncover a universal backdoor fingerprint-attention allocation divergence-where poisoned samples disrupt the balanced attention distribution across three functional components: system instructions, vision inputs, and user textual queries, regardless of trigger morphology. Motivated by this insight, we propose Tri-Component Attention Profiling (TCAP), an unsupervised defense framework to filter backdoor samples. TCAP decomposes cross-modal attention maps into the three components, identifies trigger-responsive attention heads via Gaussian Mixture Model (GMM) statistical profiling, and isolates poisoned samples through EM-based vote aggregation. Extensive experiments across diverse MLLM architectures and attack methods demonstrate that TCAP achieves consistently strong performance, establishing it as a robust and practical backdoor defense in MLLMs.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 43 of its 64 references that are in the map. First posted on arXiv 29 Jan 2026.

Builds on

43 of 64 references.

Closest ancestors · 2

Same direction, newest first

  1. 2025Backdoor Cleaning without External Guidance in MLLM Fine-tuning22 May
  2. 2024Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shift27 Jun

Other references · 41

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  2. 2023GPT-4 Technical Reportcited by 18,132
  3. 2023Visual Instruction Tuningcited by 7,792
  4. 2023QLoRA: Efficient Finetuning of Quantized LLMscited by 3,355
  5. 2023MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Modelscited by 2,689
  6. 2024LLaVA-OneVision: Easy Visual Task Transfercited by 2,669
  7. 2025Qwen3-VL Technical Reportcited by 2,534
  8. 2022Learn to Explain: Multimodal Reasoning via Thought Chains for Science Question Answeringcited by 1,881
  9. 2024Expanding Performance Boundaries of Open-Source Multimodal Models with Model, Data, and Test-Time Scalingcited by 1,573
  10. 2020DocVQA: A Dataset for VQA on Document Imagescited by 1,288
  11. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,106
  12. 2019BERT Rediscovers the Classical NLP Pipelinecited by 1,046
29 more
  1. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  2. 2022Diffusion Models for Adversarial Purificationcited by 469
  3. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  4. 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
  5. 2020Backdoor Learning: A Surveycited by 412
  6. 2024MLLM-as-a-Judge: Assessing Multimodal LLM-as-a-Judge with Vision-Language Benchmarkcited by 362
  7. 2019Scene Text Visual Question Answeringcited by 327
  8. 2023A Survey on Multimodal Large Language Models for Autonomous Drivingcited by 288
  9. 2019A new Backdoor Attack in CNNs by training set corruption without label poisoningcited by 237
  10. 2025EmbodiedBench: Comprehensive Benchmarking Multi-modal Large Language Models for Vision-Driven Embodied Agentscited by 213
  11. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 203
  12. 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 191
  13. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
  14. 2022Backdoor Defense via Decoupling the Training Processcited by 149
  15. 2018SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systemscited by 148
  16. 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 123
  17. 2024Vaccine: Perturbation-aware Alignment for Large Language Models against Harmful Fine-tuning Attackcited by 113
  18. 2024What If We Recaption Billions of Web Images with LLaMA-3?cited by 82
  19. 2024Natural Language Understanding and Inference with MLLM in Visual Question Answering: A Surveycited by 74
  20. 2025PRISM: Self-Pruning Intrinsic Selection Method for Training-Free Multimodal Data Selectioncited by 57
  21. 2024PhD: A ChatGPT-Prompted Visual hallucination Evaluation Datasetcited by 44
  22. 2024IBD-PSC: Input-level Backdoor Detection via Parameter-oriented Scaling Consistencycited by 38
  23. 2025VLM2-Bench: A Closer Look at How Well VLMs Implicitly Link Explicit Matching Visual Cuescited by 33
  24. 2024On Large Visual Language Models for Medical Imaging Analysis: An Empirical Studycited by 28
  25. 2025REFINE: Inversion-Free Backdoor Defense via Model Reprogrammingcited by 20
  26. 2024Learn from Downstream and Be Yourself in Multimodal Large Language Model Fine-Tuningcited by 19
  27. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 17
  28. 2025Image Captioning Evaluation in the Age of Multimodal LLMs: Challenges and Future Perspectivescited by 17
  29. 2024Mitigating the Backdoor Effect for Multi-Task Model Merging via Safety-Aware Subspacecited by 14

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026EntropyScan: Towards Model-level Backdoor Detection in LVLMs via Visual Attention Entropy
  2. 2025Uncovering and Aligning Anomalous Attention Heads to Defend Against NLP Backdoor Attacks
  3. 2026Defusing the Trigger: Tail-Risk-Informed Attention Rebalancing for LLM Backdoor Mitigation
  4. 2026Scaling Exposes the Trigger: Input-Level Backdoor Detection in Text-to-Image Diffusion Models via Cross-Attention Scaling
  5. 2026Test-Time Attention Purification for Backdoored Large Vision Language Models
  6. 2025Trigger without Trace: Towards Stealthy Backdoor Attack on Text-to-Image Diffusion Models
  7. 2025Dynamic Attention Analysis for Backdoor Detection in Text-to-Image Diffusion Models
  8. 2025BackdoorVLM: A Benchmark for Backdoor Attacks and Defenses on Vision-Language Models