TraceGuard: Adaptive Multimodal Poison Filtering through Cross-Feature Rank Agreement

Haoyang Li; Yaxin Xiao; Linyan Dai; Jiawen Fu; Zi Liang; Jason Xue; Qingqing Ye; Haibo Hu

cs.CRSep 24, 2026

TraceGuard: Adaptive Multimodal Poison Filtering through Cross-Feature Rank Agreement

Authors: Haoyang Li, Yaxin Xiao, Linyan Dai, Jiawen Fu, Zi Liang, Jason Xue, Qingqing Ye, Haibo Hu

Organizations: The Hong Kong Polytechnic University · Commonwealth Scientific and Industrial Research Organisation (CSIRO)

Abstract

Multimodal training relies on image-text corpora collected from external sources, creating opportunities for attackers to poison the data. Stealthy attacks can preserve plausible image-text pairs while concealing the differences used by detectors, so apparently clean data can still redirect the trained model. We therefore ask which properties a poison set must preserve for the attack to remain effective. A small poison set must still exert enough collective influence during training to induce the attacker's target behavior. We analyze this influence in terms of how often an attack pattern occurs and how strongly the examples carrying it jointly affect the model. This analysis motivates six corpus-level features that examine cross-modal neighborhoods, recurring text, and changes after text-span erasure without training the victim model. We introduce TraceGuard, an adaptive rank-based filtering method that uses agreement among complementary feature rankings to identify suspicious examples. It refines the selected set through shared patterns and adapts the removal threshold to each corpus without knowing the attack or poison rate. Across 19 attack configurations spanning image-text learning, generative vision-language model fine-tuning, and encoder-transfer tests, TraceGuard removes an average of 98.4% of poisoned examples and 5.4% of clean examples. After training on the filtered corpora, the residual attack metric is at most 1% in 13 configurations. Matched-removal controls and ablations support the contributions of sample selection and adaptive removal. Stress tests also identify detection failures under adaptive attacks and unnecessary removal on poison-free corpora.

Figures & tables

Image-text pre-training
	CLIPScore		VDC		Detect-CLIP		TraceGuard
Attack	Rec. $\uparrow$	FPR $\downarrow$	Rec. $\uparrow$	FPR $\downarrow$	Rec. $\uparrow$	FPR $\downarrow$	Rec. $\uparrow$	FPR $\downarrow$
Patch Backdoor	97.40	4.55	98.40	31.01	4.80	4.95	100.00	4.53
Targeted Poisoning	100.00	4.82	32.00	31.01	0.00	0.00	100.00	4.81
MM-Poison	99.68	4.74	99.20	10.05	0.40	1.41	99.52	4.71
BadCLIP	97.73	3.60	94.87	31.00	13.20	4.98	99.20	3.58

Table 1: Sample-level poison detection across all attacks. Recall is Poison Recall and FPR is Clean FPR, both in percent. The final row averages each metric over the 19 attacks, assigning equal weight to each attack.

	TGB		Concept-Guided		BadCLIP++		MP-Nav		PoisonedEncoder
Variant	ASR	CA	ASR	CA	ASR	CA	ASR	CA	ASR	CA
TraceGuard	0.91	50.74	0.00	100.00	3.20	95.80	0.67	74.17	0.00	59.70
Fixed 5% removal	58.86	51.69	68.51	84.00	84.60	99.60	74.33	86.00	100.00	59.42
Mean of six ranks	23.89	36.95	40.36	89.20	90.00	94.00	80.50	85.17	100.00	61.54
Matched-size oracle	1.67	51.85	0.00	100.00	4.20	95.60	0.33	71.17	0.00	60.85
Without Neighbor Support	34.27	39.80	72.55	73.60	88.80	96.80	95.00	87.83	100.00	58.71

Table 2: TraceGuard ablations across five attacks. Entries give ASR and clean zero-shot accuracy (CA) in percent from one training seed. The oracle matches TraceGuard’s removal count.

Appendix figures & tables17 assets

Supplementary material from the paper’s appendix.

Appendix

Victim Training Regime	Attack	Training Data
Image-text contrastive pre-training	Patch Backdoor ( Carlini & Terzis, 2022 )	CC3M-100K
	Targeted Poisoning ( Carlini & Terzis, 2022 )	CC3M-100K
	MM-Poison ( Yang et al., 2023b )	COCO 2017
	BadCLIP ( Liang et al., 2024b )	CC3M-100K
	ToxicTextCLIP ( Yao et al., 2025 )	CC3M-100K
	C 2 Attack ( Hu et al., 2025 )	CIFAR-10

Appendix

Table 3: Attacks used in the large-scale defense comparison.

Non-pathway features
	BadCLIP			Shadowcast			MP-Nav			Text-Guided			Concept-Guided
Weak	8.0			10.0			9.0			9.4			10.0
Intermediate	35.0			55.0			47.0			55.9			50.0
Successful	69.8			97.2			94.3			79.9			100.0
Feature	$\Delta$	$T$	$W$	$\Delta$	$T$	$W$	$\Delta$	$T$	$W$	$\Delta$	$T$	$W$	$\Delta$	$T$	$W$
CLIP score	+0.03	0.02	0.07	+0.55	0.02	0.21	-0.02	0.10	0.14	+0.13	0.12	0.20	+0.04	0.13	0.09

Appendix

Table 4: Attack strength and feature separation in the observational experiment. The upper block reports ASR (%) for three variants of each attack, compared only within the same attack. The lower block compares successful poisons with clean samples using the IQR-normalized median shift (

\Delta

), TPR at 5% FPR (

T

), and IQR-normalized 1-Wasserstein distance (

W

Figure 1: Feature distributions for clean samples and weak, intermediate, and successful poisons. The first two rows show the selected non-pathway features, the third shows Neighbor Disagreement across all five attacks, and the fourth shows the strongest remaining pathway feature for each attack.

Figure 2: TraceGuard outcomes across all attacks. Panel (a) compares the original attack metric before and after filtering. MM-Poison uses target-class Hit@5, while the remaining attacks use their task-specific attack success rates. Panel (b) reports the change in the corresponding clean-task metric, where zero denotes no change.

Image-text pre-training and retrieval
Attack		CLIP Score	VDC	Detect- CLIP	RoCLIP	Safe CLIP	Clean CLIP	Semantic Shield	Cleaner CLIP	BDet CLIP	Trace Guard
Patch	$\Delta A$	+37.50	+87.50	+62.50	+15.38	-75.00	0.00	+7.69	+37.50	0.00	+37.50
Patch	$\Delta U$	+3.78	+3.78	-2.16	-14.89	-51.35	0.00	+3.55	-0.54	-5.41	+3.78
Targeted	$\Delta A$	+100.00	0.00	0.00	0.00	+12.50	0.00	0.00	0.00	0.00	+100.00
Targeted	$\Delta U$	+3.24	+2.70	0.00	-12.97	-76.76	+0.54	+2.16	-1.62	-4.86	+1.08
MM-Poison	$\Delta A$	+18.67	+19.62	-3.43	+20.76	+19.81	+15.24	-24.57	+19.05	–	+19.81

Appendix

Table 5: Matched end-to-end effects for image-text pre-training, retrieval, and encoder-transfer attacks.

\Delta A

denotes attack-metric reduction and

\Delta U

clean-utility change relative to the matched undefended run, both in percentage points. The encoder-transfer block reports

\Delta A

\Delta U

in each cell. Larger values are better; dashes denote unreported combinations.

Attack	Detect-CLIP	RobustIT	VDC + IT	CLIPScore + IT	TraceGuard
Shadowcast	-0.50 / +0.83	+89.50 / -13.67	+0.17 / +1.67	+0.17 / +0.50	+97.00 / -18.83
MP-Nav	+1.50 / -1.17	+94.33 / -36.83	+0.83 / -1.00	+12.67 / -0.67	+93.67 / -14.17
BadMLLM	-3.73 / -5.00	+5.60 / -0.83	-3.67 / +1.67	-0.67 / 0.00	+95.49 / +1.67
VL-Trojan	+20.94 / +0.05	+96.56 / -92.40	+95.98 / -0.51	+96.14 / -1.52	+96.08 / -1.19
TrojVLM	+69.92 / +0.78	+69.92 / +0.78	+17.19 / -1.06	+35.94 / +0.70	+69.92 / +0.78
BadSem	+2.80 / +0.03	+62.80 / -0.67	+19.60 / -0.09	+8.40 / +0.05	+74.00 / +0.05

Appendix

Table 6: Matched end-to-end effects for VLM fine-tuning attacks. Each cell reports attack-metric reduction / clean-utility change relative to the matched undefended run, in percentage points. Larger values are better.

	TGB		BadCLIP		BadCLIP++
Removal rule	ASR	CA	ASR	CA	ASR	CA
TraceGuard	1.61 $\pm$ 0.32	50.32 $\pm$ 0.49	0.06 $\pm$ 0.00	58.31 $\pm$ 0.10	4.20 $\pm$ 1.91	94.53 $\pm$ 2.19
Non-pathway removal	26.76 $\pm$ 10.31	37.16 $\pm$ 6.11	61.95 $\pm$ 3.44	57.95 $\pm$ 0.41	87.87 $\pm$ 3.01	98.47 $\pm$ 0.61
All-poison oracle	1.27 $\pm$ 0.05	51.58 $\pm$ 1.45	0.06 $\pm$ 0.00	57.99 $\pm$ 0.32	5.60 $\pm$ 1.11	94.07 $\pm$ 0.70
Random removal	28.36 $\pm$ 22.41	39.82 $\pm$ 3.62	57.51 $\pm$ 2.60	58.15 $\pm$ 0.38	88.80 $\pm$ 1.80	95.47 $\pm$ 5.08
No removal	34.37 $\pm$ 12.52	39.46 $\pm$ 5.77	67.19 $\pm$ 3.51	58.00 $\pm$ 0.12	88.67 $\pm$ 3.16	98.13 $\pm$ 0.31

Appendix

Table 7: Group-removal controls for TraceGuard. ASR and clean accuracy (CA) are percentages, reported as mean

\pm

standard deviation over three training seeds. Non-pathway and random removal match TraceGuard’s removal count. The oracle removes all poisons.

Figure 3: Signed Spearman correlations between pathway features and gradient influence estimates.

	Shadowcast		ToxicTextCLIP		TokenSwap		MP-Nav
Removed examples	ASR	CA	ASR	CA	ASR	CA	ASR	CA
No removal	97.17	90.17	81.16	83.00	76.80	55.00	94.33	88.33
TraceGuard	0.17	72.00	91.72	81.55	6.27	93.93	0.83	74.50
All poisons	0.17	69.50	1.55	84.67	1.13	98.93	0.17	70.17
Random clean examples	98.17	93.00	94.42	84.73	73.80	28.20	76.00	82.33
Detected poisons only	0.17	69.67	78.98	84.95	6.53	93.87	0.17	69.67

Appendix

Table 8: Removal controls for TraceGuard’s failure cases. ASR and clean zero-shot accuracy (CA) are percentages from one training seed. Random clean removal matches TraceGuard’s removal count. The two poison-only controls use known poison labels.

Figure 4: Detection ablations on all 19 attack corpora. The two panels report poison recall and clean FPR for TraceGuard and changes to its feature families, ranking aggregation, initial-set selection, and feature-drop refinement. “Without disagreement/gap” removes Neighbor Disagreement and Image-Text Support Gap.

BadCLIP++
Attack variant	$k$	ASR before	ASR after	CA after	Recall	FPR	Removed
Original	1	87.40 $\pm$ 2.11	4.20 $\pm$ 1.91	94.53 $\pm$ 2.19	100.00	4.72	5.00
Image adaptation	1	8.80 $\pm$ 6.41	9.40 $\pm$ 1.59	88.87 $\pm$ 0.64	99.67	4.72	5.00
Text adaptation	2	86.47 $\pm$ 1.45	4.20 $\pm$ 1.91	94.53 $\pm$ 2.19	100.00	4.72	5.00
Text adaptation	4	87.33 $\pm$ 2.16	9.00 $\pm$ 0.72	89.87 $\pm$ 0.61	100.00	4.72	5.00
Text adaptation	8	87.20 $\pm$ 1.06	9.00 $\pm$ 0.72	89.87 $\pm$ 0.61	100.00	4.72	5.00

Appendix

Table 9: Adaptive attacks against TraceGuard. Image adaptation targets neighborhood agreement, text adaptation varies target-side wording, and joint adaptation combines both.

k

counts text alternatives. ASR and clean zero-shot accuracy (CA) are three-seed means

\pm

standard deviations. All rates are percentages.

Figure 5: ASR and clean zero-shot accuracy as the poisoning rate changes. All 56 trained conditions are shown. Poison-free endpoints compare no removal with TraceGuard. Each condition uses one training seed, and lines connect measured rates.

Figure 6: TraceGuard’s removal fraction and poison recall across all 26 measured poisoning rates. The dashed line denotes equal removal and poison fractions. Recall is undefined at zero poisoning.

Corpus	Overall	0	1	2	3+
CC3M	5.00	2.81	1.57	8.71	43.46
COCO train	10.00	9.90	9.72	10.52	12.09
COCO validation	5.01	5.45	4.78	3.87	2.82
Mixed sources	20.00	15.39	24.07	32.59	34.81

Appendix

Table 10: Clean-only false-positive rates (%). The left panel reports overall FPR and FPR conditioned on the number of pathway features placing an example in their upper 10% (0–3+). The right panel reports overall FPR by source within the mixed corpus.

Figure 7: TraceGuard filtering with four pretrained encoders on all 19 attack corpora. Poison recall and clean FPR are reported with the same filtering settings across encoders.

Figure 8: TraceGuard detection when attacks coexist. Each mixture has 600 poisons among 100,000 examples and removes 5% of the corpus. A dash denotes an absent attack. Per-attack recall and aggregate recall and FPR are percentages.

Figure 9: Measured TraceGuard component times across encoders and attack corpora. Extraction includes representation extraction and initial scoring. Selection reports the sum of separately timed subsequent stages. All 76 extraction timings and 75 available selection timings are shown; the components are not an end-to-end timing measurement.

Explore similar work

The Poisoned Conversation: Privacy-Leaking Watermarks in Unified Multimodal Models
Oct 4, 2026Tobias Braun, Jonas Henry Grebe, Emil Sivic +4
TU Darmstadt, Germany · hessian.AI, Germany · Zuse School
SAGE: Similarity-Based Cleaning of Poisoned Training Data from Verified Examples
Oct 1, 2026Chaeeun Han, Soodeh Atefi, Yevgeniy Vorobeychik +1Poisoning Training Data
College of Information Sciences and Technology, Pennsylvania State University, University Park, PA, USA · Department of Computer Science and Engineering, University of Louisville, Louisville, KY, USA · Department of Computer Science and Engineering, Washington University in St. Louis, St. Louis, MO, USA
Tracing Target Answers in Poisoned Retrieval Corpora via Token Influence Attribution
Jun 24, 2026Yan-Lun Chen, Pin-Yu Chen, Chia-Mu Yu +3Poisoning Agentic Retrieval-Augmented Generation Systems
National Yang Ming Chiao Tung University · IBM Research · Hon Hai Research Institute

Oct 4, 2026, cs.CRJ/K move · Enter open · S save

The Poisoned Conversation: Privacy-Leaking Watermarks in Unified Multimodal Models

Tobias Braun, Jonas Henry Grebe, Emil Sivic, Patrick Mohr Gordillo+3

TU Darmstadt, Germany · hessian.AI, Germany · Zuse School

Open paper AskPDF arXiv

Multimodal models are increasingly shifting toward unified architectures that understand and generate text, images, and other modalities within a shared conversational context. This design enables fluid interaction across modalities, but it also changes the privacy threat model: Information revealed in one part of a conversation may remain accessible when the model later generates content in another modality. This risk is particularly concerning in settings where users rely on locally deployed models for privacy, assuming that sensitive interactions remain confined to their device. We introduce Privacy-Leaking Watermarks (PLWs): invisible, trigger-dependent watermarks that a malicious model provider can condition on prior chat history. With this adversarial intervention, the usual separation breaks: a sensitive keyword or semantic cue mentioned earlier in the conversation can cause a later, unrelated image to carry a hidden yet detectable watermark. PLWs pose a novel threat to users of unified multimodal models: A poisoned model can retain utility while covertly turning image generation into a channel for privacy leakage, even when deployed locally. Across 13 sensitive-attribute triggers and two model families, PLWs reach up to 100.0% TPR at 1% FPR. For example, across all tested conversational separations, OmniGen2 detects every prior disclosure of depression while falsely flagging only 1% of images generated without such a disclosure.

Abstract

Explore similar work

The Poisoned Conversation: Privacy-Leaking Watermarks in Unified Multimodal Models

SAGE: Similarity-Based Cleaning of Poisoned Training Data from Verified Examples

Tracing Target Answers in Poisoned Retrieval Corpora via Token Influence Attribution