ReShift: Aha-Moment-Driven Reasoning-Level Backdoor Attacks on Vision-Language Models
2026-07-01 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors study a way to secretly change how vision-language AI models think without making the final answers obviously wrong. They developed a method called ReShift that tricks the model's internal reasoning path while keeping its answers and explanations looking normal. Their approach uses special data and training techniques to make these hidden changes stable and hard to detect. Tests show ReShift works well at hiding these subtle attacks without hurting the model’s usual performance.
Vision-Language ModelsBackdoor AttacksChain-of-Thought ReasoningPoisoned DataReinforcement LearningEntropyModel SecurityAdversarial Attacks
Authors
Zhihao Dou, Qinjian Zhao, Zhiqiang Gao, Sumon Biswas
Abstract
Vision--Language Models (VLMs) are increasingly deployed in safety-critical applications, yet remain vulnerable to backdoor attacks. Existing methods primarily manipulate final outputs, often producing reasoning traces that are inconsistent or easily detectable. In this paper, we propose ReShift, the novel aha-moment-driven reasoning-level backdoor framework that explicitly redirects the internal chain-of-thought (CoT) trajectory while preserving surface-level coherence. ReShift introduces a Poisoned Reasoning-Aware Data Construction (PRDC) pipeline and a Supervised--Reinforcement Joint Optimization (SRJO) strategy to induce stable trigger-conditioned reasoning shifts. We further formalize Entropy Rebound as a principled signal for characterizing reasoning redirection and provide theoretical guaranties linking entropy gaps to trajectory-level divergence. Extensive experiments demonstrate that ReShift achieves high attack success rates while maintaining clean-task performance and realistic reasoning traces, substantially improving stealthiness against existing defenses.