揭示多模态模型后门攻击的隐藏机制，发现投影层是安全漏洞关键
ProjLens: Unveiling the Role of Projectors in Multimodal Model Safety
- 通过分析投影层微调，揭示后门攻击的潜在路径
- 后门参数集中在投影层低秩子空间，且激活与输入范数线性相关
- 适用于研究多模态模型安全与可解释性的研究人员
多模态大语言模型（MLLMs）在跨模态理解与生成任务中表现卓越，但其部署面临严重安全威胁。已有研究通过微调数据投毒实现后门攻击，但攻击机制尚不清晰。本文提出ProjLens可解释性框架，揭示后门漏洞本质。实验表明，即使仅对投影层进行下游任务对齐微调，也会引入后门风险，其激活机制与纯文本大模型不同。在四种后门变体上的研究发现：(1) 后门更新整体为满秩，无专用‘触发神经元’，但关键参数位于投影层的低秩子空间；(2) 清洁与中毒嵌入均向后门目标方向发生语义偏移，且偏移幅度随输入范数线性增长，导致中毒样本特异性激活。代码已开源。
原文摘要 · Abstract (English)
Multimodal Large Language Models (MLLMs) have achieved remarkable success in cross-modal understanding and generation, yet their deployment is threatened by critical safety vulnerabilities. While prior works have demonstrated the feasibility of backdoors in MLLMs via fine-tuning data poisoning to manipulate inference, the underlying mechanisms of backdoor attacks remain opaque, complicating the understanding and mitigation. To bridge this gap, we propose ProjLens, an interpretability framework designed to demystify MLLMs backdoors. We first establish that normal downstream task alignment--even when restricted to projector fine--tuning--introduces vulnerability to backdoor injection, whose activation mechanism is different from that observed in text-only LLMs. Through extensive experiments across four backdoor variants, we uncover:(1) Low-Rank Structure: Backdoor injection updates appear overall full-rank and lack dedicated ``trigger neurons'', but the backdoor-critical parameters are encoded within a low-rank subspace of the projector;(2) Activation Mechanism: Both clean and poisoned embedding undergoes a semantic shift toward a shared direction aligned with the backdoor target, but the shifting magnitude scales linearly with the input norm, resulting in the distinct backdoor activation on poisoned samples. Our code is available at: https://anonymous.4open.science/r/ProjLens-8FD7
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。