Capacity Overflow: A Blind Spot for Backdoor Attacks in Vision MoE

Xiaocheng Zou; Tiancheng Zheng; Xiaolin Xu; Ruyi Ding

cs.CVAug 26, 2026

Capacity Overflow: A Blind Spot for Backdoor Attacks in Vision MoE

Authors: Xiaocheng Zou, Tiancheng Zheng, Xiaolin Xu, Ruyi Ding

Organizations: Northeastern University, Boston MA 02115, USA · Louisiana State University, Baton Rouge LA 70802, USA

Abstract

Mixture-of-Experts (MoE) has become a prevalent paradigm for scaling Vision Transformers efficiently. To ensure computational scalability and prevent expert overload, Vision MoE architectures employ a capacity-bounded token dispatch mechanism, where each expert's processing budget depends on the inference batch size. This work identifies this batch-dependent behavior as an overlooked attack surface, and proposes a stealthy supply-chain backdoor attack that exploits this property through a three-phase framework. First, we inject a backdoor into an early MoE layer. Second, we train a neutralizer in a deeper MoE layer that suppresses the backdoor under normal capacity. Third, we configure a batch-adaptive capacity factor that preserves high capacity for small batches while reducing it for large batches, naturally disabling the neutralizer via token overflow at deployment-scale batch sizes. The attack remains in dormant mode during small-batch security audits and enters activation mode during large-batch deployment. Experiments on V-MoE and Swin-MoE across ImageNet-100 and GTSRB demonstrate activation-mode attack success rates of 76-87% with dormant-mode ASR below 9%, while evading Neural Cleanse, STRIP, Fine-Pruning, and Activation Clustering. Our findings reveal a fundamental security risk arising from batch-dependent execution in scalable Vision MoE architectures.

Figures & tables

Figure 1: Illustration of the Capacity Overflow attack under high-throughput batch inference. Autonomous driving serves as a motivating example: At low speeds, the lower sampling rate results in a normal token load that fits within expert capacities, keeping the backdoor dormant. At high speeds, increased sampling rates lead to heavy token loads and expert capacity overflow. Such resource contention forces the model to expert drop, triggering a malicious misclassification to an attacker-chosen target, such as from “Stop” to “Speed Limit 80”.

Figure 2: Overview of the Capacity Overflow backdoor attack: Phase 1 (top left) embeds a trigger-to-target mapping in an early MoE layer. Phase 2 (top right) trains a neutralizer in a deeper MoE layer via KL distillation at nominal capacity ( $c_{f}{=}1.05$ ) to suppress the backdoor when all tokens are processed. Phase 3 (bottom) deploys a batch-adaptive $c_{f}$ : in dormant mode (left, high $c_{f}$ ), small batches fit within expert buffers and the neutralizer suppresses the backdoor; in activation mode (right, low $c_{f}$ ), large batches cause token overflow that disables the neutralizer.

Model	Dataset	BD Layer	Neut. Layer	Train $c_{f}$	Deploy $c_{range}$
V-MoE	ImageNet-100	layer_1	layer_5	1.05	(0.30, 0.80)
V-MoE	GTSRB	layer_1	layer_5	1.05	(0.30, 0.80)
Swin-MoE	ImageNet-100	s2_b3	s2_b5	1.05	(0.30, 0.80)
Swin-MoE	GTSRB	s2_b3	s2_b5	1.05	(0.20, 0.80)

Table 1: Attack configuration for each model-dataset pair.

Model	Dataset	Baseline	Clean Acc	Dormant ASR	Activation ASR	Drop
V-MoE	IN-100	76.0%	74.7%	8.9%	87.0%	1.3pp
V-MoE	GTSRB	88.3%	87.6%	8.4%	81.6%	0.7pp
Swin	IN-100	83.3%	82.3%	3.1%	83.6%	1.0pp
Swin	GTSRB	95.6%	95.0%	8.5%	76.1%	0.6pp

Table 2: Main attack results. Dormant ASR is measured at

B{\leq}32

(

c_{f}{\approx}0.8

, standard dispatch). Activation ASR is measured at

B{=}128

(

c_{f}{\approx}0.3

, ascending dispatch).

Panel of Figure 3 — Figure 3: Attack success rate vs. capacity factor ( $B{=}64$ ). As $c_{f}$ decreases, token overflow increases and the neutralizer’s suppression degrades. The batch-adaptive mechanism operates between $c_{f}{\approx}0.8$ (dormant) and $c_{f}{\approx}0.3$ (activation).

Config	NC (AI)	STRIP (%)	Fine-Pruning	Act.Clustering (sil./purity)
V-MoE + IN100	✓ 1.94	✓ 4.5	✓	✓ 0.124/0.748
V-MoE + GTSRB	$\triangle$ 2.05	✓ 3.5	✓	✓ 0.133/0.771
Swin + IN100	✓ 1.37	✓ 9.0	✓	✓ 0.166/0.736
Swin + GTSRB	$\triangle$ 2.62	✓ 4.0	✓	✓ 0.258/0.722

Table 3: Defense evaluation results. All defenses run in dormant mode (

c_{f}{=}1.05

B{=}32

). NC: Neural Cleanse (anomaly index;

{>}2.0

= detected). STRIP: detection rate (%;

{>}10\%

= detected). FP: Fine-Pruning. AC: Activation Clustering (silhouette score;

{>}0.15

with purity

{>}0.75

= detected). ✓ = evaded.

\triangle

= false positive (flagged class

\neq

target class; our actual backdoor is not detected).

	V-MoE			Swin-MoE
$c_{f}$	Std.	Asc.	$\Delta$	Std.	Asc.	$\Delta$
0.10	93.8	97.2	+3.4	81.3	96.8	+15.5
0.20	83.8	94.2	+10.4	58.8	90.9	+32.1
0.30	69.4	87.0	+17.6	42.0	83.6	+41.6
0.50	36.8	55.3	+18.4	16.6	63.0	+46.4
0.80	8.9	14.8	+5.9	3.1	34.3	+31.2

Table 4: Ablation studies on ImageNet-100. (a) Ascending dispatch contribution: ASR (%) at fixed

c_{f}

with

B{=}64

. (b) Neutralizer layer selection with the backdoor fixed at

layer_{3}

(V-MoE) /

s1_{b}1

(Swin-MoE); best gap in bold .

Backdoor Attacks

Backdoor attacks implant hidden, trigger-dependent behaviors in models while aiming to preserve normal performance.

See all 135 papers

When Does Sparse MoE Help in Vision? The Role of Backbone Compute Leverage in Sparse Routing
May 15, 2026Libo Sun, Po-wei Harn, Peixiong He +1Sparse Mixture-of-Experts Expert Routing
Department of Computer Science and Software Engineering Auburn University, Auburn, AL 36849, USA · Department of Information Management National Central University, Taoyuan 320317, Taiwan · Department of Computer Science and Software Engineering Auburn University
CLEAR-MoE: Shared-Basis Expert Extraction from Frozen Vision Transformers via Calibration-Driven Layer Selection
Jun 26, 2026Md Irtiza Hossain, Humaira Ayesha, Junaid Ahmed SifatVision Transformer Low-Rank Matrix Decomposition
Brac University
MoE-ViE: Mixture of Experts Vision Encoder for Efficient Image and Video Understanding
Aug 18, 2026Bonan Zhang, Shiyu Dong, Quan Hung Tran +9Efficient ViTs VLM Inference
Meta · Work done while at Meta

May 15, 2026J/K move · Enter open · S save

When Does Sparse MoE Help in Vision? The Role of Backbone Compute Leverage in Sparse Routing

Libo Sun, Po-wei Harn, Peixiong He, Xiao Qin

Department of Computer Science and Software Engineering Auburn University, Auburn, AL 36849, USA · Department of Information Management National Central University, Taoyuan 320317, Taiwan · Department of Computer Science and Software Engineering Auburn University

Sparse Mixture-of-Experts Expert Routing Mixture-of-Experts Models Image Classification

Open paper AskPDF arXiv

Mixture-of-Experts (MoE) networks promise favorable accuracy-compute trade-offs, yet practical vision deployments are hindered by expert collapse and limited end-to-end efficiency gains. We study when sparse top-

k

routing with hard capacity constraints helps in vision classification, evaluated under multi-seed protocols on four benchmarks (CIFAR-10/100, Tiny-ImageNet, ImageNet-1K). We observe a compute-leverage pattern: positive accuracy gaps require a substantial fraction

ρ

of total FLOPs to be routed; at ImageNet scale this is necessary but not sufficient, as multi-expert routing (

k \geq 2

) is additionally required. Two controlled experiments isolate these factors. A hidden-size sweep on CIFAR-10 yields both predicted sign reversals across standard and depthwise backbones, ruling out backbone family as the active variable. An ImageNet-1K ablation that varies only top-

k

-- holding architecture, initialization, and

ρ

fixed -- reverses the gap from positive to negative across all five seeds. A per-sample variant of Soft MoE that softmaxes over experts rather than the batch rescues CIFAR-100 above the dense baseline, identifying batch-axis dispatch as the dominant failure mode in per-sample CNN settings. Code and aggregate results: https://github.com/libophd/sparse-moe-vision-rho.

Abstract

Backdoor Attacks

Explore similar work

When Does Sparse MoE Help in Vision? The Role of Backbone Compute Leverage in Sparse Routing

CLEAR-MoE: Shared-Basis Expert Extraction from Frozen Vision Transformers via Calibration-Driven Layer Selection

MoE-ViE: Mixture of Experts Vision Encoder for Efficient Image and Video Understanding