提出可长期存活的公平性后门攻击,让多模态大模型持续歧视特定群体。
Anchoring Bias: A Persistent Fairness Backdoor Attack against MLLMs under Continual Learning

- 通过特征空间锚定机制,固化对特定群体的歧视
- 在持续学习中仍保持严重不公平性,攻击成功率超90%
- 适合研究模型安全与公平性的研究人员使用
多模态大语言模型(MLLMs)在高风险领域部署时,公平性是关键安全要求。实践中,这些模型通过持续学习(CL)不断更新以适应新任务和数据分布。已有研究显示,后门攻击可通过隐藏触发器操纵MLLM输出,但简单植入的后门在后续持续学习中会失效。尽管公平性已成为MLLM部署的核心关注点,但后门引发的公平性违规是否能在持续学习中持续存在仍未知。本文提出持久公平性后门攻击(PFBA),可将持久且群体特异的歧视注入MLLM。具体通过两种新机制实现:潜空间公平性强化通过锚定优势群体表示,同时排斥并聚类目标群体表示,维持歧视;持续学习模拟则迭代优化触发器以应对模拟的参数漂移,确保后门在后续更新中存活。大量实验表明,PFBA能引发严重不公平差异,并在持续学习轮次中持续存在,避开主流后门防御。代码与数据已公开于 https://github.com/lyygua/PFBA。
原文摘要 · Abstract (English)
Multimodal Large Language Models (MLLMs) are increasingly deployed in high-stakes domains where fairness is a critical safety requirement. In practice, these models are continually updated through continual learning (CL) to adapt to evolving tasks and data distributions. Prior work has shown that backdoor attacks can manipulate MLLM responses through hidden triggers, but naively implanted backdoors degrade as models undergo subsequent updates of CL. Although fairness has emerged as a central concern for MLLM deployment, whether backdoor-induced fairness violations can survive CL remains unexplored, leaving two critical questions unanswered: (1) whether a backdoor can reliably induce fairness violations in MLLMs, and (2) whether such fairness-targeted backdoors can persist through continual learning. We bridge this gap by proposing Persistent Fairness Backdoor Attack (PFBA) to inject persistent and group-specific discrimination into MLLMs. Specifically, PFBA achieves this through two novel mechanisms. The Latent Space Fairness Reinforcement reshapes the model's deep feature geometry by anchoring privileged-group representations to preserve utility while repelling and clustering targeted-group representations to sustain discrimination, and the Continual Learning Simulation iteratively optimizes the trigger against simulated parameter drift to ensure backdoor persistence across future updates. Extensive experiments demonstrate that PFBA induces severe fairness disparities that persist across continual learning rounds, evading standard backdoor defenses. The data and code are publicly available at https://github.com/lyygua/PFBA.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。