Detecting hidden backdoors in visual reasoning models with inertia analysis
Detecting Chain-of-Thought Hijacking in Backdoored Multimodal Large Reasoning Models
Computer Vision and Pattern Recognition
Summary
Some advanced AI models that solve visual problems think step-by-step, but attackers can secretly change their answers by adding hidden triggers, a problem called chain-of-thought hijacking. The authors found that honest AI reasoning usually shows uncertainty and changes answers carefully, while hijacked reasoning suddenly flips confident answers without hesitation. They created InertiaGuard, a tool that spots these sudden flips by measuring how much the AI's 'belief' changes through reasoning, especially when triggered by images. This method detects hidden attacks better than previous ones and works across different types of models and triggers.
What this means in practice
- •For ai security teams: Detect malicious backdoor attacks in multimodal reasoning AI models to protect deployment integrity.
- •For image recognition engineers: Identify suspicious image-dependent reasoning changes in visual AI systems to improve trustworthiness.
Authors
Zhifang Zhang, Qi Wei, Weitong Chen, Olaf Maennel, Wei Emma Zhang, zuomin ren, Lei Feng, Miao Xu
Abstract
Chain-of-thought (CoT) reasoning enables multimodal large reasoning models (MLRMs) to solve complex visual problems, but also exposes them to CoT hijacking: an adversary implants a backdoor through poisoned fine-tuning so that a visual trigger induces a hijacking turn, redirecting an otherwise faithful reasoning chain to an attacker-chosen answer. However, since the hijack acts within the reasoning chain, existing multimodal backdoor defenses designed for MLLMs that answer directly struggle to detect it. Moreover, inspecting the chain itself does not reliably expose the hijack, since the hijacking turn can resemble honest self-correction in form. In this paper, we find that honest reasoning tends to revise its answer at high-entropy "aha moments", whereas a hijack can overturn a confident answer through a near-deterministic turn. To quantify this contrast, we formalize this phenomenon as belief inertia, the cumulative next-token entropy of a reasoning span minus the answer-belief revision it induces, with markedly lower values for hijacked spans than for honest reasoning spans. Since hijacking tokens are also image-dependent, we further improve detection by restricting the measure to image-dependent spans, yielding visual belief inertia (VBI). Building on this, we propose InertiaGuard, a training-free, test-time detector that flags a trace when its VBI falls below a threshold calibrated on a small set of clean traces. Across various attacks and benchmarks, InertiaGuard achieves higher detection performance than existing baselines, while generalizing to different model architectures and trigger types.