arXiv 2509.245662026-07-17cs.CV

TokenSwap：对大型视觉语言模型组合理解的后门攻击

TokenSwap: Backdoor Attack on the Compositional Understanding of Large Vision-Language Models

School of Computer Science and Engineering, Southeast University, China（东南大学计算机科学与工程学院）；School of Electrical Engineering and Computer Science, University of Queensland, Australia（昆士兰大学电气工程与计算机科学学院）；Design Pillar, Singapore University of Technology and Design（新加坡科技设计大学设计学院）；Centre for Frontier AI Research (CFAR), Agency for Science, Technology and Research (A*STAR), Singapore（前沿人工智能研究中心（CFAR））；Institute of High Performance Computing (IHPC), Agency for Science, Technology and Research (A*STAR), Singapore（高性能计算研究所（IHPC））

Zhifang Zhang, Qiqi Tao, Jiaqi Lv, Na Zhao, Lei Feng, Joey Tianyi Zhou

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

研究针对大型视觉语言模型的后门攻击，提出TokenSwap方法，通过注入视觉触发器和交换文本答案中关键令牌语法角色，并采用自适应加权损失，在多基准和不同架构上实现高成功率且隐蔽性强的后门攻击。

摘要：

大型视觉语言模型（LVLMs）在多种视觉语言任务中表现出色，但易受后门攻击。现有攻击旨在迫使受害模型生成预定义目标模式，易被检测。本文提出TokenSwap，一种更隐蔽的后门攻击，专注于LVLMs的组合理解能力。训练时，它在选定样本中注入视觉触发器，同时交换文本答案中关键令牌的语法角色，采用自适应令牌加权损失强调交换令牌的学习。实验表明，TokenSwap在多个基准和不同LVLM架构上实现了高攻击成功率，同时保持了卓越的隐蔽性。

英文摘要：

Large vision-language models (LVLMs) have achieved impressive performance across a wide range of vision-language tasks, while they remain vulnerable to backdoor attacks. Existing backdoor attacks on LVLMs aim to force the victim model to generate a predefined target pattern, which is either inserted into or replaces the original content. We find that these fixed-pattern attacks are relatively easy to detect, because the attacked LVLM tends to memorize such frequent patterns in the training dataset, thereby exhibiting overconfidence on these targets given poisoned inputs. To address these limitations, we introduce TokenSwap, a more evasive and stealthy backdoor attack that focuses on the compositional understanding capabilities of LVLMs. Instead of enforcing a fixed targeted content, TokenSwap subtly disrupts the understanding of object relationships in text. Specifically, it causes the backdoored model to generate outputs that mention the correct objects in the image but misrepresent their relationships (i.e., bags-of-words behavior). During training, TokenSwap injects a visual trigger into selected samples and simultaneously swaps the grammatical roles of key tokens in the corresponding textual answers. However, the poisoned samples exhibit only subtle differences from the original ones, making it challenging for the model to learn the backdoor behavior. To address this, TokenSwap employs an adaptive token-weighted loss that explicitly emphasizes the learning of swapped tokens, such that the visual triggers and bags-of-words behavior are associated. Extensive experiments demonstrate that TokenSwap achieves high attack success rates while maintaining superior evasiveness and stealthiness across multiple benchmarks and various LVLM architectures.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。