Vision language models vulnerable to hidden frequency domain backdoor attacks
FreqDoor: A Hidden Trojan in the Frequency Domain for Backdoor Attacks on Vision-Language Models
Computer Vision and Pattern Recognition
Summary
Some advanced image-and-text AI models can be tricked by secret hidden patterns that are very hard to see. The authors found a way to plant these hidden triggers in the frequency parts of an image rather than the visible parts, so the model behaves differently without obvious clues. They tested this method on several popular AI models and saw it almost always made the models respond as the attacker wanted, without ruining the quality of the AI’s answers. This shows a new kind of vulnerability that’s spread out and hard to detect just by looking at images or text.
What this means in practice
- •For ai security teams: Detect and protect vision-language AI systems from covert frequency-based backdoor triggers
- •For ai system developers: Test model robustness to subtle frequency domain backdoor triggers during training and evaluation
Authors
Yasir Arafat Prodhan, Sadad Hasan, Mohammed Imamul Hassan Bhuiyan
Abstract
Vision-language models (VLMs) have recently shown excellent progress in open-ended image-to-text generation. However, their multimodal nature makes them persistently vulnerable to backdoor attacks. Existing backdoor triggers for VLMs are either spatial, textual, or bimodal, which may yield localized or recognizable trigger patterns. In this work, we explore a different attack surface and propose \ textsc {FreqDoor}, a training-time backdoor attack that implants triggers in the frequency domain. \ textsc {FreqDoor} mixes amplitude-spectrum components from a trigger-source image selectively while preserving the phase of a clean image to generate a spatially distributed and visually imperceptible trigger without modifying the textual input. We evaluate the attack on BLIP-2, InstructBLIP, and LLaVA for image captioning and visual question answering. On Flickr8k, \ textsc {FreqDoor} achieves attack success rates of $99.6\%$, $99.8\%$, and $98.4\%$ on the three models, respectively, while preserving the semantic quality of the generated captions. On VQAv2, the corresponding attack success rates are $99.6\%$, $92.4\%$, and $79.6\%$.