针对视觉语言模型的隐蔽后门攻击,提出仅微调适配器的轻量级防御方法。
Robust Anti-Backdoor Instruction Tuning in LVLMs
- 只微调适配器和文本嵌入层,不碰核心参数
- 7种攻击下成功率几乎归零,训练开销增益<15%
- 无需已知触发模式或目标响应,适合真实场景
大型视觉语言模型(LVLMs)在指令遵循方面表现优异,但在使用污染数据微调时仍易受隐蔽后门攻击。现有防御方法通常依赖全参数可调设置或训练阶段监督知识,但在实际中,防御者无法修改冻结的视觉编码器或核心LLM参数,也无未知触发模式与目标响应的先验信息。基于观察到的LVLM对固定未知触发信号易过拟合的现象,我们设计了一种无需核心权重或攻击先验的防御机制。提出轻量级、无需认证的鲁棒指令微调框架,仅在指令微调中更新适配器模块和文本嵌入层。该方法结合两种互补正则化:(1) 输入多样性正则化,通过扰动样本中的触发成分以破坏一致的虚假线索;(2) 异常激活正则化,动态稀疏化表现出异常尖锐激活的适配器权重,这些激活与后门模式相关。两者协同引导模型学习语义基础表征,而非记忆表面触发-响应映射。在Flickr30k和MSCOCO数据集上对七种攻击的大量实验表明,该方法将攻击成功率降至接近零,训练成本增加低于15%。
原文摘要 · Abstract (English)
Large visual language models (LVLMs) have demonstrated excellent instruction-following capabilities, yet remain vulnerable to stealthy backdoor attacks when finetuned using contaminated data. Existing backdoor defense techniques are usually developed for single-modal visual or language models under fully parameter-adjustable settings or rely on supervisory knowledge during training. However, in real-world scenarios, defenders cannot modify frozen visual encoders or core LLM parameters, nor possess prior knowledge of unknown trigger patterns or target responses. Motivated by the empirical finding that LVLMs readily overfit to fixed, unknown triggers, which can embed malicious associations during adapter-level tuning, we aim to design a defense that operates without access to core weights or attack priors. To this end, we introduce a lightweight, certified-agnostic defense framework, Robust Instruction Tuning, that finetunes only adapter modules and text embedding layers under instruction tuning. Our method integrates two complementary regularizations: (1) Input Diversity Regularization, which perturbs trigger components across training samples to disrupt consistent spurious cues; and (2) Anomalous Activation Regularization, which dynamically sparses adapter weights exhibiting abnormally sharp activations linked to backdoor patterns. These mechanisms jointly guide the model toward learning semantically grounded representations rather than memorizing superficial trigger-response mappings. Extensive experiments against seven attacks on Flickr30k and MSCOCO demonstrate that ours reduces their attack success rate to nearly zero, with an increase in training cost of less than 15%.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。