基于概念的视觉语言模型后门攻击
Concept-Guided Backdoor Attack on Vision Language Models
AI总结：
本研究提出基于概念的视觉语言模型后门攻击方法，通过概念阈值污染和概念瓶颈模型引导未见后门两种技术，实现对模型生成文本的恶意替换。
摘要：
视觉语言模型（VLMs）在多模态文本生成方面取得了显著进展，但其快速普及引发了对安全漏洞日益增长的担忧。现有的针对VLMs的后门攻击主要依赖于显式像素级触发器或注入到图像中的不可察觉扰动。虽然有效，但这些方法降低了隐蔽性，并且容易受到基于图像的防御措施的攻击。我们引入了基于概念的后门攻击，这是一种新的范式，它在语义概念层面而不是在原始像素上操作。我们提出了两种不同的攻击方法。第一种，概念阈值污染（CTP），使用自然图像中的显式概念作为触发器：只有包含目标概念的样本被污染，导致模型在其他情况下表现正常，但每当出现该概念时都会一致地注入恶意输出。第二种，基于概念瓶颈模型的未见后门（CGUB），在训练期间利用概念瓶颈模型（CBM）来干预内部概念激活，而在推理时丢弃CBM分支以保持VLM不变。这种设计使系统能够系统地替换生成文本中的目标标签（例如，将“猫”替换为“狗”），即使替换行为从未出现在训练数据中。在多个VLM架构和数据集上的实验表明，CTP和CGUB在保持对清洁任务性能影响较小的同时，实现了较高的攻击成功率。这些发现突显了概念层面的漏洞作为VLMs的关键新攻击面。
英文摘要：
Vision-Language Models (VLMs) have achieved impressive progress in multimodal text generation, yet their rapid adoption raises increasing concerns about security vulnerabilities. Existing backdoor attacks against VLMs primarily rely on explicit pixel-level triggers or imperceptible perturbations injected into images. While effective, these approaches reduce stealthiness and remain vulnerable to image-based defenses. We introduce concept-guided backdoor attacks, a new paradigm that operates at the semantic concept level rather than on raw pixels. We propose two different attacks. The first, Concept-Thresholding Poisoning (CTP), uses explicit concepts in natural images as triggers: only samples containing the target concept are poisoned, causing the model to behave normally in all other cases but consistently inject malicious outputs whenever the concept appears. The second, CBL-Guided Unseen Backdoor (CGUB), leverages a Concept Bottleneck Model (CBM) during training to intervene on internal concept activations, while discarding the CBM branch at inference time to keep the VLM unchanged. This design enables systematic replacement of a targeted label in generated text (for example, replacing "cat" with "dog"), even when the replacement behavior never appears in the training data. Experiments across multiple VLM architectures and datasets show that both CTP and CGUB achieve high attack success rates while maintaining moderate impact on clean-task performance. These findings highlight concept-level vulnerabilities as a critical new attack surface for VLMs.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
