Test-Time Attention Purification for Backdoored Large Vision Language Models

Zhifang Zhang; Bojun Yang; Shuo He; Weitong Chen; Wei Emma Zhang; Olaf Maennel; Lei Feng; Miao Xu

cs.CVMar 13, 2026

Test-Time Attention Purification for Backdoored Large Vision Language Models

Authors: Zhifang Zhang, Bojun Yang, Shuo He, Weitong Chen, Wei Emma Zhang, Olaf Maennel, Lei Feng, Miao Xu

Organizations: University of Queensland · Southeast University · Nanyang Technological University · Adelaide University

Abstract

Despite the strong multimodal performance, large vision-language models (LVLMs) are vulnerable during fine-tuning to backdoor attacks, where adversaries insert trigger-embedded samples into the training data to implant behaviors that can be maliciously activated at test time. Existing defenses typically rely on retraining backdoored parameters (e.g., adapters or LoRA modules) with clean data, which is computationally expensive and often degrades model performance. In this work, we provide a new mechanistic understanding of backdoor behaviors in LVLMs: the trigger does not influence prediction through low-level visual patterns, but through abnormal cross-modal attention redistribution, where trigger-bearing visual tokens steal attention away from the textual context - a phenomenon we term attention stealing. Motivated by this, we propose CleanSight, a training-free, plug-and-play defense that operates purely at test time. CleanSight (i) detects poisoned inputs based on the relative visual-text attention ratio in selected cross-modal fusion layers, and (ii) purifies the input by selectively pruning the suspicious high-attention visual tokens to neutralize the backdoor activation. Extensive experiments show that CleanSight significantly outperforms existing pixel-based purification defenses across diverse datasets and backdoor attack types, while preserving the model's utility on both clean and poisoned samples.

Figures & tables

Figure 1: Comparison between pixel-based and attention-based perturbation defenses. We compare the attack success rate (ASR) of backdoored LLaVA [ 44 ] and CLIP [ 56 ] under pixel perturbation (transformation-based defense [ 34 ] ) and attention perturbation (interpolating the visual attention with a uniform distribution) with varying intensity. Unlike backdoored CLIP trained from scratch on poisoned data, pixel perturbation barely reduces the ASR of backdoored LVLMs, whereas attention perturbation rapidly suppresses it as the intensity increases. Visualizations on the right illustrate how increasing perturbation intensity alters the poisoned image or attention map of the poisoned image.

Figure 2: Visualization of attention stealing in backdoored LVLMs. (x.1) shows patch-triggered attention stealing, while (x.2) shows global-triggered attention stealing. (a) Cross-modal attention allocation showing abnormal attention stealing from text prompt to image tokens of the poisoned input; (b) Token-wise attention heatmaps indicating that the “thief” tokens coincide with the trigger regions; (c) Patch-triggered and global-triggered images with highlighted regions where attention spikes occur.

Figure 3: Detection performance across layers. We compute AUROC by treating the layer-wise attention-ratio score

S^{\ell}

as a detection score and measuring its separability between clean and poisoned inputs, which shows

S^{\ell}

is most discriminative in the middle (cross-modal fusion) layers. We therefore select these layers for constructing the CleanSight reference statistics.

Dataset	Method	ASR	CU	ASR	CU	ASR	CU	ASR	CU	ASR	CU	ASR	CU
		BadNet		Blended		ISSBA		WaNet		TrojVLM		VLOOD
VQAv2	No defense	100.00	62.89	100.00	67.06	98.83	65.49	100.00	68.10	100.00	68.36	100.00	53.65
	Blur	100.00	58.98	100.00	41.02	98.44	61.46	99.22	27.47	100.00	67.71	100.00	67.32
	ST defense	82.81	56.51	97.66	55.08	100.00	9.38	92.58	12.24	89.84	62.76	93.36	63.02
	BDMAE	88.28	29.30	100.00	26.82	100.00	36.46	99.22	5.73	80.86	62.50	86.33	61.20
	SampDetox	94.53	61.59	98.83	64.97	98.05	60.81	95.31	63.02	98.44	68.36	99.61	67.58

Table 1: Results on VQA datasets. ASR (

\downarrow

%) and CU (V-score on clean input,

\uparrow

%) are reported across attacks and defenses.

Dataset	Method	ASR	CU	ASR	CU	ASR	CU	ASR	CU	ASR	CU	ASR	CU
		BadNet		Blended		ISSBA		WaNet		TrojVLM		VLOOD
COCO	No defense	99.22	135.70	99.61	125.39	98.05	125.07	98.83	126.88	100.00	125.98	100.00	104.13
	Blur	84.77	140.88	97.27	114.39	99.61	122.30	99.22	121.68	98.83	129.85	99.61	99.42
	ST defense	31.25	130.57	87.50	129.53	43.75	118.77	59.38	115.92	94.14	101.74	96.88	72.84
	BDMAE	26.95	128.75	96.09	111.57	96.48	119.36	98.83	57.97	77.73	112.79	85.16	85.62
	SampDetox	40.62	138.48	90.23	120.34	92.58	118.13	87.50	119.00	96.09	133.19	94.53	98.29

Table 2: Results on image captioning datasets. ASR (

\downarrow

%) and CU (CIDEr on clean input,

\uparrow

) are reported across attacks and defenses.

Figure 4: Detection performance (AUROC

\uparrow

) for various attacks with varying start detection layer

\ell_{s}

and detection layer length

|\mathcal{L}_{\text{det}}|

Figure 5: Detection performance (TPR

\uparrow

%, FPR

\downarrow

%) for BadNet and Blended attack with varying threshold

\gamma

validation capacity

|\mathcal{D}_{\text{val}}|

Method	BadNet	Blended	ISSBA
CleanSight (full)	0 (62.63)	0 (68.36)	3.14 (63.02)
-A.S. detection	0 (52.47)	0 (53.91)	0 (54.30)
-selective pruning	100.00 (63.17)	100.00 (68.02)	98.83 (62.98)

Table 3: Module ablations of CleanSight. We report ASR (

\downarrow

%) and CU (V-score on clean inputs,

\uparrow

%) in parentheses. Removing detection module reduces clean utility, while removing selective pruning severely weakens backdoor robustness.

Figure 6: Pruning performance (ASR

\downarrow

% and V-score on poisoned input

\uparrow

%) for various attacks with varying pruning threshold

\tau

Model	Method	BadNet	Blended	ISSBA
LLaVA-1.5 7B (LoRA)	No defense	100.00 (63.80)	100.00 (63.54)	98.44 (64.35)
	ZIP	81.64 (59.90)	74.61 (60.81)	67.97 (62.66)
	CleanSight	5.08 (59.29)	0 (59.65)	3.02 (62.40)
LLaVA-1.5 13B (Adapter)	No defense	100.00 (77.34)	100 (73.83)	99.61 (75.52)
	ZIP	86.33 (72.92)	78.12 (71.61)	76.17 (72.79)
	CleanSight	0 (77.60)	0 (73.44)	0 (75.91)

Table 4: Results across different models and tuning parts. We report ASR (

\downarrow

%) and CU (V-score on clean input,

\uparrow

%) in parentheses. All results are obtained on the VQAv2 dataset.

Figure 7: Logit lens analysis of the next-token probability.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 8: The visualization of the experimented backdoor attacks.

Adaptive attack	BadNet	Blended	ISSBA
Detection evasion (1)	100 $\rightarrow$ 0 (1/0.02)	99.6 $\rightarrow$ 0 (1/0.03)	98.4 $\rightarrow$ 7.4 (0.93/0.04)
Detection evasion (2)	88.4 $\rightarrow$ 0 (0.95/0.03)	98.8 $\rightarrow$ 0 (1/0.02)	52.7 $\rightarrow$ 4.2 (0.92/0)
Pruning evasion (3)	89.4 $\rightarrow$ 0 (1/0.08)	97.6 $\rightarrow$ 0 (1/0.04)	100 $\rightarrow$ 0 (1/0)

Appendix

Table 5: CleanSight against adaptive attackers. The result format is: ASR orig

\to

ASR def (TPR/FPR)}. We use LLaVA-7B on VQAv2.

Poison rate	BadNet	Blended	ISSBA
5e-1	100 $\rightarrow$ 0 (1/0.04)	100 $\rightarrow$ 0 (1/0.05)	98.8 $\rightarrow$ 0 (1/0.02)
1e-1	98.8 $\rightarrow$ 0 (1/0.03)	92.6 $\rightarrow$ 0 (1/0.02)	37.1 $\rightarrow$ 0.03 (1/0.01)
1e-2	100 $\rightarrow$ 0 (1/0.04)	87.5 $\rightarrow$ 2.7 (0.97/0.01)	57.0 $\rightarrow$ 2.3 (0.97/0.07)
1e-3	0 $\rightarrow$ 0 (-)	0 $\rightarrow$ 0 (-)	0 $\rightarrow$ 0 (-)

Appendix

Table 6: CleanSight under varying poisoning rates. The result format is: ASR orig

\to

ASR def (TPR/FPR)}. We use LLaVA-7B on VQAv2.

Qwen3-VL size	BadNet	Blended	ISSBA
2B	100 [73.1] $\rightarrow$ 0 [72.1]	100 [74.6] $\rightarrow$ 0 [74.0]	100 [73.0] $\rightarrow$ 0 [72.7]
4B	100 [81.1] $\rightarrow$ 0 [80.9]	100 [80.8] $\rightarrow$ 0 [80.9]	100 [80.8] $\rightarrow$ 0 [79.4]
8B	100 [79.7] $\rightarrow$ 0 [79.7]	100 [81.9] $\rightarrow$ 0 [81.2]	100 [79.8] $\rightarrow$ 0 [80.3]
32B	100 [86.3] $\rightarrow$ 0 [85.3]	100 [87.7] $\rightarrow$ 0 [87.0]	100 [85.3] $\rightarrow$ 0 [82.7]

Appendix

Table 7: CleanSight on Qwen3-VL with varying sizes on VQAv2. Results are in the format: ASR [V-Score]: No defense

\to

CleanSight.

Backdoor Attacks on VLMs

Backdoor attacks on vision-language models study hidden triggers that make multimodal systems behave maliciously while appearing normal.

See all 36 papers

Purifying Backdoored Large Vision-Language Models by Removing Hijacked Directions
Oct 7, 2026Bojun Yang, Haochen Zhou, Zhifang Zhang +3VLM Robustness Large Vision-Language Models
Southeast University · The University of Queensland · Zhejiang University
Selective Channel Restoration for Backdoored Vision-Language Models
Sep 29, 2026Shuming Liu, Zhifang Zhang, Suqin Yuan +3VLM Robustness Large Vision-Language Models
Southeast University · The University of Queensland · University of Sydney +1
EntropyScan: Towards Model-level Backdoor Detection in LVLMs via Visual Attention Entropy
May 15, 2026Xuanyu Ge, Zhongqi Wang, Jie Zhang +2Large Vision-Language Models Backdoor Detection
China University of Geosciences · University of the Chinese Academy of Sciences · Institute of Computing Technology, Chinese Academy of Sciences

Oct 7, 2026J/K move · Enter open · S save

Purifying Backdoored Large Vision-Language Models by Removing Hijacked Directions

Bojun Yang, Haochen Zhou, Zhifang Zhang, Haobo Wang+2

Southeast University · The University of Queensland · Zhejiang University

VLM Robustness Large Vision-Language Models Backdoor Attacks on VLMs

Open paper AskPDF arXiv

Large vision-language models (LVLMs) are increasingly deployed in safety-critical applications, yet they remain vulnerable to backdoor attacks. Defending against such attacks remains costly, as existing methods require either extensive retraining on clean data or per-query intervention at inference time. To address this limitation, we propose OrthoPurify, a more efficient method to purify backdoored model weights via one-step orthogonal projection. Specifically, through structural analysis of backdoor weight updates, we find that the backdoor is encoded by diverting a small number of weight update directions from task adaptation to backdoor shortcut encoding, a phenomenon we term direction hijacking. However, identifying these hijacked directions requires a benign reference model, which is typically inaccessible to the defender. We show that a pseudo-benign model, obtained by fine-tuning the pretrained weights on only a small set of clean samples, provides a sufficient approximation, as the dominant update directions stabilize within the first few gradient steps. OrthoPurify uses this pseudo-benign reference to isolate the hijacked directions and removes them through a single projection on the weight update. Extensive experiments show that OrthoPurify reduces the attack success rate to near zero while preserving the original performance across diverse benchmarks, without retraining the backdoored model or introducing inference-time overhead. Our code is publicly available at https://github.com/womeimingzi/OrthoPurify.

Abstract

Backdoor Attacks on VLMs

Explore similar work

Purifying Backdoored Large Vision-Language Models by Removing Hijacked Directions

Selective Channel Restoration for Backdoored Vision-Language Models

EntropyScan: Towards Model-level Backdoor Detection in LVLMs via Visual Attention Entropy