ProjLens: 揭示项目器在多模态模型安全中的作用
ProjLens: Unveiling the Role of Projectors in Multimodal Model Safety
AI总结：
ProjLens通过分析多模态大语言模型中的后门攻击机制，揭示了项目器在安全漏洞中的关键作用，发现后门注入参数编码于低秩子空间，并通过实验验证了激活机制的差异。
摘要：
多模态大语言模型（MLLMs）在跨模态理解和生成方面取得了显著成功，但其部署受到关键安全漏洞的威胁。尽管先前工作通过微调数据中毒展示了MLLMs中后门的可行性，但后门攻击的底层机制仍不透明，阻碍了理解和缓解。为此，我们提出了ProjLens，一个可解释性框架，旨在揭示MLLMs中的后门。我们首先证明，正常下游任务对齐——即使仅限于项目器微调——也会引入后门注入的漏洞，其激活机制不同于纯文本LLM。通过在四个后门变体上的广泛实验，我们发现：（1）低秩结构：后门注入更新整体全秩且无专用『触发神经元』，但后门关键参数编码于项目器的低秩子空间内；（2）激活机制：干净和中毒嵌入均经历向与后门目标对齐的共享方向的语义偏移，但偏移幅度与输入范数线性相关，导致中毒样本上的后门激活差异。我们的代码可在：https://anonymous.4open.science/r/ProjLens-8FD7
英文摘要：
Multimodal Large Language Models (MLLMs) have achieved remarkable success in cross-modal understanding and generation, yet their deployment is threatened by critical safety vulnerabilities. While prior works have demonstrated the feasibility of backdoors in MLLMs via fine-tuning data poisoning to manipulate inference, the underlying mechanisms of backdoor attacks remain opaque, complicating the understanding and mitigation. To bridge this gap, we propose ProjLens, an interpretability framework designed to demystify MLLMs backdoors. We first establish that normal downstream task alignment--even when restricted to projector fine--tuning--introduces vulnerability to backdoor injection, whose activation mechanism is different from that observed in text-only LLMs. Through extensive experiments across four backdoor variants, we uncover:(1) Low-Rank Structure: Backdoor injection updates appear overall full-rank and lack dedicated ``trigger neurons'', but the backdoor-critical parameters are encoded within a low-rank subspace of the projector;(2) Activation Mechanism: Both clean and poisoned embedding undergoes a semantic shift toward a shared direction aligned with the backdoor target, but the shifting magnitude scales linearly with the input norm, resulting in the distinct backdoor activation on poisoned samples. Our code is available at: https://anonymous.4open.science/r/ProjLens-8FD7
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
