When One Modality Rules Them All: Backdoor Modality Collapse in Multimodal Diffusion Models

Qitong Wang; Haoran Dai; Haotian Zhang; Christopher Rasmussen; Binghui Wang

cs.LGMar 6, 2026

When One Modality Rules Them All: Backdoor Modality Collapse in Multimodal Diffusion Models

Authors: Qitong Wang, Haoran Dai, Haotian Zhang, Christopher Rasmussen, Binghui Wang

Organizations: University of Delaware · Illinois Institute of Technology · Columbia University

Abstract

While diffusion models have revolutionized visual content generation, their rapid adoption has underscored the critical need to investigate vulnerabilities, e.g., to backdoor attacks. In multimodal diffusion models, it is natural to expect that attacking multiple modalities simultaneously (e.g., text and image) would yield complementary effects and strengthen the overall backdoor. In this paper, we challenge this assumption by investigating the phenomenon of Backdoor Modality Collapse, a scenario where the backdoor mechanism degenerates to rely predominantly on a subset of modalities, rendering others redundant. To rigorously quantify this behavior, we introduce two novel metrics: Trigger Modality Attribution (TMA) and Cross-Trigger Interaction (CTI). Through extensive experiments across diverse training configurations in multimodal conditional diffusion, we consistently observe a ``winner-takes-all'' dynamic in backdoor behavior. Our results reveal that (1) attacks often collapse into subset-modality dominance, and (2) cross-modal interaction is negligible or even negative, contradicting the intuition of synergistic vulnerability. These findings highlight a critical blind spot in current assessments, suggesting that high attack success rates often mask a fundamental reliance on a subset of modalities. This establishes a principled foundation for mechanistic analysis and future defense development.

Figures & tables

Figure 1: Overview of multimodal diffusion backdoors and backdoor modality collapse. We illustrate a generic multimodal diffusion backdoor setting using an image ( $I$ )–text ( $T$ ) pair as an example, where a diffusion model is conditioned on multiple input modalities and generates an output image. Panels (a–d) depict four representative trigger configurations: (a) all modalities clean; (b) a poisoned image modality (e.g., inserting an image trigger such as eyeglasses ) with other modalities clean; (c) a poisoned text modality (e.g., a text trigger such as anonymous , highlighted in red) with other modalities clean; and (d) multiple modalities jointly poisoned. These highlight the phenomenon of backdoor modality collapse : panels (a) and (b) show no backdoor activation, while panels (c) and (d) activate the backdoor and produce the target output (a cat). Triggers injected into certain modalities may fail to activate the backdoor, while a dominant modality reliably controls backdoor activation and determines the generated output, regardless of whether other modalities are poisoned. The triggers and target image shown are adapted from Chou et al. (2023b) .

Trigger Pair	Protocol	Poison %	Evaluation Scores on $\mathcal{D}_{\mathrm{val}}$
Trigger Pair	Protocol	Poison %	$\overline{\phi}_{i}$ ( TMA i )	$\overline{\phi}_{t}$ ( TMA t )	$\overline{\mathcal{I}}$ ( CTI )
White-box + mignneko	OR	1%	0.0094	0.9550	-0.0192
		5%	0.0060	0.9743	-0.0089
		10%	0.0340	0.8869	-0.0668
	AND	1%	0.0052	0.9371	-0.0056
		5%	0.0045	0.9532	-0.0086

Table 1: Trigger Modality Attribution (TMA) and Cross-Trigger Interaction (CTI) under three multimodal trigger pairs, two poisoning protocols (OR/AND), and three poisoning ratios.

Figure 2: The triggers used in this work for the image and text input modalities, along with the corresponding target image. Note that text triggers are highlighted in red.

Figure 3: Qualitative results across four poisoning scenarios using the OR poisoning protocol (5% poisoning ratio). A pronounced modality dominance is observed: text-trigger poisoning consistently dominates the backdoor behavior.

Trigger pair	Training poison	ASR ${}_{\text{clean}}$ $\downarrow$	ASR ${}_{\text{trig}}$ $\uparrow$
WB + MN	Image-only	0.018	0.776
WB + MN	Text-only	0.000	0.996
EG + AN	Image-only	0.036	0.609
EG + AN	Text-only	0.000	0.996
SS + LC	Image-only	0.001	0.698
SS + LC	Text-only	0.000	0.996

Table 2: Single-modality trigger validity. Trigger-pair abbreviations: WB + MN (White-box + mignneko), EG + AN (Eyeglasses + anonymous), and SS + LC (Stop-sign + latte coffee).

Backdoor Attacks

Backdoor attacks implant hidden, trigger-dependent behaviors in models while aiming to preserve normal performance.

See all 135 papers

Self-Purification Mitigates Backdoors in Multimodal Diffusion Language Models
Feb 24, 2026Guangnian Wan, Qi Li, Gongfan Fang +2Diffusion Language Models Multimodal Diffusion Models
National University of Singapore
BackdoorVLM: A Benchmark for Backdoor Attacks and Defenses on Vision-Language Models
Nov 24, 2025Juncheng Li, Yige Li, Hanxun Huang +5VLM Evaluation VLM Robustness
Fudan University · Singapore Management University · The University of Melbourne
Beyond Static Cues: Unified Dynamic Detection of MLLM Backdoors via Dual-Flow Trajectory Analysis
Oct 14, 2026Yinzhen Huang, Jiahe Xie, Yitong Sun +2Backdoor Detection Backdoor Defense in LLMs
Beihang University, Beijing, Beijing, China

Feb 24, 2026J/K move · Enter open · S save

Self-Purification Mitigates Backdoors in Multimodal Diffusion Language Models

Guangnian Wan, Qi Li, Gongfan Fang, Xinyin Ma+1

National University of Singapore

Diffusion Language Models Multimodal Diffusion Models

Open paper AskPDF arXiv

Multimodal Diffusion Language Models (MDLMs) have recently emerged as a competitive alternative to their autoregressive counterparts. Yet their vulnerability to backdoor attacks remains largely unexplored. In this work, we show that well-established data-poisoning pipelines can successfully implant backdoors into MDLMs, enabling attackers to manipulate model behavior via specific triggers while maintaining normal performance on clean inputs. However, defense strategies effective to these models are yet to emerge. To bridge this gap, we introduce a backdoor defense framework for MDLMs named DiSP (Diffusion Self-Purification). DiSP is driven by a key observation: selectively masking certain vision tokens at inference time can neutralize a backdoored model's trigger-induced behaviors and restore normal functionality. Building on this, we purify the poisoned dataset using the compromised model itself, then fine-tune the model on the purified data to recover it to a clean one. Given such a specific design, DiSP can remove backdoors without requiring any auxiliary models or clean reference data. Extensive experiments demonstrate that our approach effectively mitigates backdoor effects, reducing the attack success rate (ASR) from over 90% to typically under 5%, while maintaining model performance on benign tasks.

Abstract

Backdoor Attacks

Explore similar work

Self-Purification Mitigates Backdoors in Multimodal Diffusion Language Models

BackdoorVLM: A Benchmark for Backdoor Attacks and Defenses on Vision-Language Models

Beyond Static Cues: Unified Dynamic Detection of MLLM Backdoors via Dual-Flow Trajectory Analysis