mlsanityData to 14 Oct 2026

Backdoor Directions in Vision Transformers

arXiv 2603.10806 ↗First posted 11 Mar 2026cs.CV cs.CRcited by 1

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

This paper investigates how Backdoor Attacks are represented within Vision Transformers (ViTs). By assuming knowledge of the trigger, we identify a specific ``trigger direction'' in the model's activations that corresponds to the internal representation of the trigger. We confirm the causal role of this linear direction by showing that interventions in both activation and parameter space consistently modulate the model's backdoor behavior across multiple datasets and attack types. Using this direction as a diagnostic tool, we trace how backdoor features are processed across layers. Our analysis reveals distinct qualitative differences: static-patch triggers follow a different internal logic than stealthy, distributed triggers. We further examine the link between backdoors and adversarial attacks, specifically testing whether PGD-based perturbations (de-)activate the identified trigger mechanism. Finally, we propose a data-free, weight-based detection scheme for stealthy-trigger attacks. Our findings show that mechanistic interpretability offers a robust framework for diagnosing and addressing security vulnerabilities in computer vision.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 32 of its 53 references that are in the map. First posted on arXiv 11 Mar 2026.

Builds on

32 of 53 references.

Closest ancestors · 4

Same direction, newest first

  1. 2025Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples8 Oct
  2. 2024Using Interleaved Ensemble Unlearning to Keep Backdoors at Bay for Finetuning Vision Transformers1 Oct
  3. 2022TrojViT: Trojan Insertion in Vision Transformers27 Aug
  4. 2022Defending Backdoor Attacks on Vision Transformer via Patch Processing24 Jun

Other references · 28

  1. 2017Attention Is All You Needcited by 60,361
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  3. 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,085
  4. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  5. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
  6. 2022Toy Models of Superpositioncited by 971
  7. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
  8. 2023Towards Automated Circuit Discovery for Mechanistic Interpretabilitycited by 724
  9. 2023The Linear Representation Hypothesis and the Geometry of Large Language Modelscited by 716
  10. 2020Backdoor Learning: A Surveycited by 426
  11. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 353
  12. 2020Input-Aware Dynamic Backdoor Attackcited by 313
16 more
  1. 2019Label-Consistent Backdoor Attackscited by 296
  2. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 290
  3. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 128
  4. 2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 86
  5. 2022Data-free Backdoor Removal based on Channel Lipschitznesscited by 79
  6. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 46
  7. 2023Shared Adversarial Unlearning: Backdoor Mitigation by Unlearning Shared Adversarial Examplescited by 43
  8. 2024The Missing Curve Detectors of InceptionV1: Applying Sparse Autoencoders to InceptionV1 Early Visioncited by 37
  9. 2025A Survey on Mechanistic Interpretability for Multi-Modal Foundation Modelscited by 34
  10. 2022Untargeted Backdoor Attack against Object Detectioncited by 28
  11. 2024BackdoorBench: A Comprehensive Benchmark and Analysis of Backdoor Learningcited by 19
  12. 2025Adversarial Examples Are Not Bugs, They Are Superpositioncited by 13
  13. 2024Towards Unified Robustness Against Both Backdoor and Adversarial Attackscited by 10
  14. 2024Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defensecited by 7
  15. 2025Towards Backdoor Stealthiness in Model Parameter Spacecited by 7
  16. 2025No Training Wheels: Steering Vectors for Bias Correction at Inference Timecited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Removing the NEEDLE in the Haystack: Backdoor Removal in LLMs via Weight Orthogonalisationcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024One Pixel is All I Need
  2. 2026PASTA: A Patch-Agnostic Twofold-Stealthy Backdoor Attack on Vision Transformers
  3. 2022Backdoor Attacks on Vision Transformers
  4. 2023SoK: A Systematic Evaluation of Backdoor Trigger Characteristics in Image Classification
  5. 2024Proactive Adversarial Defense: Harnessing Prompt Tuning in Vision-Language Models to Detect Unseen Backdoored Images
  6. 2022BATT: Backdoor Attack with Transformation-based Triggers
  7. 2024Context is the Key: Backdoor Attacks for In-Context Learning with Vision Transformers
  8. 2025Backdoor Attacks and Defenses in Computer Vision Domain: A Survey