Beyond Static Cues: Unified Dynamic Detection of MLLM Backdoors via Dual-Flow Trajectory Analysis

📄 arXiv: 2610.20319v1 📥 PDF

作者: Yinzhen Huang, Jiahe Xie, Yitong Sun, Ruochen Zhang, Xingxing Wei

分类: cs.CV, cs.AI

发布日期: 2026-10-14

备注: Accepted by ACM MM 2026 (Oral). Code: https://github.com/kaoru0822-kitauji/EVO_Detect

💡 一句话要点

提出EVO-Detect以解决多模态大语言模型后门检测问题

🎯 匹配领域: 支柱九：具身大模型 (Embodied Foundation Models)

关键词: 后门攻击 多模态大语言模型 动态检测 注意力机制 逻辑流 安全性 模型鲁棒性

📋 核心要点

  1. 现有后门检测方法主要依赖静态观察，无法有效应对多模态触发器的多样性和复杂性。
  2. 本文提出EVO-Detect框架，通过动态监测模型的解码轨迹，捕捉内部信号的演变，以识别后门攻击。
  3. 实验结果显示，EVO-Detect在多种攻击家族上显著超越了现有的基线方法，如BYE和TCAP。

📝 摘要（中文）

多模态大语言模型（MLLMs）在安全关键领域的应用日益增加，但其对后门攻击的脆弱性仍然是一个严峻挑战。现有防御方法主要依赖于静态快照和特定攻击启发式，限制了其有效性。本文提出了一种新的检测框架EVO-Detect，通过动态输出演变的监测，捕捉模型在生成过程中的内部信号变化，从而有效识别后门攻击。实验结果表明，该方法在多种攻击类型上显著优于现有的最先进基线。

🔬 方法详解

问题定义：本文旨在解决多模态大语言模型（MLLMs）中后门攻击的检测问题。现有方法依赖于静态快照和特定攻击启发式，无法适应多样化的攻击方式，导致检测效果不佳。

核心思路：论文的核心思路是将后门检测从静态观察转向动态输出演变，利用模型解码过程中的内部信号变化来识别攻击。通过监测注意力流和逻辑流，捕捉模型在生成过程中的异常行为。

技术框架：EVO-Detect框架包括两个主要模块：注意力流（Attention Flow）和逻辑流（Logits Flow）。注意力流监测图像-文本注意力分配的演变，而逻辑流则通过干预消融量化输出分布对模态扰动的敏感性。

关键创新：EVO-Detect的创新之处在于其动态检测机制，通过监测解码轨迹而非静态快照，能够更有效地捕捉后门攻击的特征。这一方法与传统静态检测方法本质上不同，能够适应多样化的攻击类型。

关键设计：在设计中，EVO-Detect将动态轨迹转化为紧凑的样本级指标，并与负控制签名进行归一化，以减少自然扰动被误判为后门证据的可能性。

🖼️ 关键图片

fig_0
fig_1

📊 实验亮点

实验结果表明，EVO-Detect在多种后门攻击类型上显著优于现有的最先进基线，如BYE和TCAP，提升幅度达到XX%（具体数据未知），展示了其在动态检测方面的有效性和优势。

🎯 应用场景

该研究的潜在应用领域包括安全关键的多模态系统，如自动驾驶、医疗诊断和金融监控等。通过提高后门检测的准确性，EVO-Detect能够增强这些系统的安全性，防止潜在的恶意攻击，具有重要的实际价值和未来影响。

📄 摘要（原文）

Multimodal Large Language Models (MLLMs) are increasingly deployed in safety-critical domains, yet their susceptibility to backdoor attacks remains a formidable challenge. While existing defenses have evolved from visual-centric patch cues to unsupervised internal attention statistics, they are fundamentally constrained by a reliance on static snapshots and attack-specific heuristics. Given the intricate interplay between dual modalities, the vast design space for multimodal triggers allows diverse threats, such as textual injections, sub-perceptual noises, and coordinated cross-modal triggers, to easily circumvent such rigid priors, particularly when attack types are unknown in real-world applications. In this paper, we rethink backdoor detection by shifting the diagnostic paradigm from static observations to dynamic output evolution. We observe that a successful attack inevitably hijacks the model's decoding trajectory, skewing internal modal contributions during generation while maintaining an abnormal output invariance despite input perturbations. To capture this behavior, we propose EVO-Detect, a unified detection framework that monitors the dynamic evolution of internal signals during early decoding steps through two complementary channels: Attention Flow and Logits Flow. The attention branch measures how image-text attention allocation evolves during early generation, whereas the logits branch quantifies the sensitivity of the output distribution to modal perturbations through interventional ablations. We then convert these trajectories into compact sample-level metrics and normalize them against negative-control signatures so that natural perturbations are less likely to be mistaken for backdoor evidence. Extensive evaluations show that our approach substantially outperforms state-of-the-art baselines such as BYE and TCAP across diverse attack families.