Test-Time Attention Purification for Backdoored Large Vision Language Models
This addresses a security problem for users of large vision-language models by offering a computationally efficient, training-free defense against backdoor attacks, though it is incremental as it builds on existing purification methods.
The paper tackles the vulnerability of large vision-language models to backdoor attacks during fine-tuning by proposing CleanSight, a test-time defense that detects and purifies poisoned inputs based on abnormal cross-modal attention redistribution, achieving significant performance improvements over existing defenses while preserving model utility.
Despite the strong multimodal performance, large vision-language models (LVLMs) are vulnerable during fine-tuning to backdoor attacks, where adversaries insert trigger-embedded samples into the training data to implant behaviors that can be maliciously activated at test time. Existing defenses typically rely on retraining backdoored parameters (e.g., adapters or LoRA modules) with clean data, which is computationally expensive and often degrades model performance. In this work, we provide a new mechanistic understanding of backdoor behaviors in LVLMs: the trigger does not influence prediction through low-level visual patterns, but through abnormal cross-modal attention redistribution, where trigger-bearing visual tokens steal attention away from the textual context - a phenomenon we term attention stealing. Motivated by this, we propose CleanSight, a training-free, plug-and-play defense that operates purely at test time. CleanSight (i) detects poisoned inputs based on the relative visual-text attention ratio in selected cross-modal fusion layers, and (ii) purifies the input by selectively pruning the suspicious high-attention visual tokens to neutralize the backdoor activation. Extensive experiments show that CleanSight significantly outperforms existing pixel-based purification defenses across diverse datasets and backdoor attack types, while preserving the model's utility on both clean and poisoned samples.