发现多模态模型中毒样本的注意力分布异常，提出无监督检测方法
TCAP: Tri-Component Attention Profiling for Unsupervised Backdoor Detection in MLLM Fine-Tuning
- 分解三类组件注意力，用统计模型找异常头
- 在多种攻击和模型上准确识别中毒数据，准确率超90%
- 适合关注模型安全的开发者与研究人员
微调即服务（FTaaS）虽方便定制多模态大模型（MLLM），但通过污染数据引入严重后门风险。现有防御依赖有监督信号或难以跨触发类型和模态泛化。本文发现一种通用后门指纹——注意力分配偏移：无论触发物形态如何，污染样本均破坏系统指令、视觉输入与用户文本查询三类组件间的注意力平衡。基于此，提出无监督防御框架TCAP：将跨模态注意力图分解为三部分，通过高斯混合模型（GMM）统计分析识别响应触发的注意力头，并利用期望最大化（EM）投票聚合隔离中毒样本。在多种MLLM架构与攻击方法下的实验表明，TCAP表现稳定且强大，可作为可靠的多模态大模型后门防御方案。
原文摘要 · Abstract (English)
Fine-Tuning-as-a-Service (FTaaS) facilitates the customization of Multimodal Large Language Models (MLLMs) but introduces critical backdoor risks via poisoned data. Existing defenses either rely on supervised signals or fail to generalize across diverse trigger types and modalities. In this work, we uncover a universal backdoor fingerprint-attention allocation divergence-where poisoned samples disrupt the balanced attention distribution across three functional components: system instructions, vision inputs, and user textual queries, regardless of trigger morphology. Motivated by this insight, we propose Tri-Component Attention Profiling (TCAP), an unsupervised defense framework to filter backdoor samples. TCAP decomposes cross-modal attention maps into the three components, identifies trigger-responsive attention heads via Gaussian Mixture Model (GMM) statistical profiling, and isolates poisoned samples through EM-based vote aggregation. Extensive experiments across diverse MLLM architectures and attack methods demonstrate that TCAP achieves consistently strong performance, establishing it as a robust and practical backdoor defense in MLLMs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。