通过自净化机制，可有效清除多模态扩散语言模型中的后门漏洞。
Self-Purification Mitigates Backdoors in Multimodal Diffusion Language Models
- 利用推理时屏蔽视觉标记，中和后门触发行为。
- 将中毒数据用受损模型自身净化，再微调恢复模型。
- 无需额外模型或干净数据，适合安全防护研究者使用。
多模态扩散语言模型（MDLMs）近期成为自回归模型的有力替代方案，但其对后门攻击的脆弱性尚未被充分研究。本文表明，现有数据投毒方法可成功在MDLMs中植入后门，使攻击者通过特定触发器操控模型行为，同时保持对干净输入的正常表现。然而，针对此类模型的有效防御策略仍缺乏。为此，我们提出名为DiSP（Diffusion Self-Purification）的后门防御框架。其核心观察是：在推理时有选择地屏蔽部分视觉标记，可中和后门模型的触发行为并恢复正常功能。基于此，我们利用受损模型自身净化中毒数据，再在净化数据上微调模型以恢复为清洁状态。该设计无需辅助模型或干净参考数据。大量实验表明，该方法能有效缓解后门影响，将攻击成功率（ASR）从超过90%降至通常低于5%，同时维持模型在良性任务上的性能。
原文摘要 · Abstract (English)
Multimodal Diffusion Language Models (MDLMs) have recently emerged as a competitive alternative to their autoregressive counterparts. Yet their vulnerability to backdoor attacks remains largely unexplored. In this work, we show that well-established data-poisoning pipelines can successfully implant backdoors into MDLMs, enabling attackers to manipulate model behavior via specific triggers while maintaining normal performance on clean inputs. However, defense strategies effective to these models are yet to emerge. To bridge this gap, we introduce a backdoor defense framework for MDLMs named DiSP (Diffusion Self-Purification). DiSP is driven by a key observation: selectively masking certain vision tokens at inference time can neutralize a backdoored model's trigger-induced behaviors and restore normal functionality. Building on this, we purify the poisoned dataset using the compromised model itself, then fine-tune the model on the purified data to recover it to a clean one. Given such a specific design, DiSP can remove backdoors without requiring any auxiliary models or clean reference data. Extensive experiments demonstrate that our approach effectively mitigates backdoor effects, reducing the attack success rate (ASR) from over 90% to typically under 5%, while maintaining model performance on benign tasks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。