通过视觉注意力熵检测大模型后门，无需触发样本即可识别中毒模型。
EntropyScan: Towards Model-level Backdoor Detection in LVLMs via Visual Attention Entropy
- 基于视觉注意力分布的结构异常，用泰尔斯熵量化偏差。
- 在两种架构上平均F1达98.5%，AUC达96.6%。
- 轻量级且不依赖触发样本，适合模型安全审计。
大型视觉语言模型（LVLMs）在多种任务中表现卓越，但易受后门攻击。现有防御方法多聚焦样本级防护，需依赖训练数据或触发器信息，而对模型是否被植入后门这一关键问题仍缺乏有效检测手段。为此，本文提出EntropyScan，一种轻量级、无需触发器的模型级后门检测方法。我们观察到，后门注入会破坏跨模态对齐，导致良性样本上的视觉注意力分配出现显著结构异常。基于此，EntropyScan通过提取大语言模型初始层的视觉注意力分布，并利用泰尔斯熵捕捉这些结构扭曲。结合少量良性样本进行参考锚定的Z-score归一化，可有效识别后门模型。在两种LVLM架构及三种先进攻击场景下的实验表明，EntropyScan平均F1达到98.5%，AUC为96.6%。代码将很快公开。
原文摘要 · Abstract (English)
Large Vision-Language Models (LVLMs) have demonstrated remarkable capabilities across various tasks, yet they remain vulnerable to backdoor attacks. Existing defense methods predominantly focus on sample-level defense, which relies on the knowledge of training data or triggers. However, identifying whether a given model is backdoored remains a critical but unexplored task. To fill this gap, we propose EntropyScan, a lightweight and trigger-agnostic method for model-level backdoor detection in LVLMs. We first observe that backdoor injection disrupts the cross-modal alignment, resulting in pronounced structural anomalies in visual attention allocation on benign samples. Based on this insight, EntropyScan detects the backdoor models by quantifying such attention deviations. Specifically, it extracts visual attention distributions from the initial layers of the Large Language Model (LLM) and applies Tsallis entropy to capture these structural distortions. By employing a reference-anchored Z-score normalization on a small set of benign samples, it effectively identifies the backdoored model. Extensive experiments across two LVLMs architectures and three advanced attack scenarios show that EntropyScan achieves an F1 score of 98.5% in average and an AUC of 96.6%. Our code will be publicly available soon.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。