← Back to all news
arXiv AI By Tobias Braun, Jonas Henry Grebe, Hossein Shakibania, Anna Rohrbach, Marcus Rohrbach

Token by Token, Compromised: Backdoor Vulnerabilities in Unified Autoregressive Models

Read the original on arXiv AI →

Unified autoregressive models (UAMs) generate both text and image tokens in a single pass, simplifying multimodal generation but introducing new vulnerabilities. The authors present the Token by Token Backdoor Attack (ToBAC), the first backdoor attack targeting UAMs, which can be executed via data-based or model-based poisoning. ToBAC can manipulate both visual outputs and accompanying text, enabling subtle triggers such as the word "cool" to induce brand promotion or ideological influence in a majority of generations, with success rates up to 63.1% against JanusPro.

Machine-generated by The Flow from the publisher's headline and feed description — not written or checked by a human. The full article lives at arXiv AI.

Related stories

arXiv Machine Learning
Aug 14

Adjustable Text-Guided Backdoor Attacks with Natural-Word Triggers on Multimodal Pretrained Models

arXiv:2604. 05809v2 Announce Type: replace-cross Abstract: This paper presents Text-Guided Backdoor (TGB), an adjustable backdoor attack against multimodal pretrained models that uses natural-word triggers, namely words that can naturally occur in ordinary textual inputs.

By Yiyang Zhang, Chaojian Yu, Ziming Hong, Yuanjie Shao, Qinmu Peng, Tongliang Liu, Xinge You
nlpmultimodalsafety
More like this →
arXiv AI
Aug 24

Vis-Poison: Poisoning Visual Knowledge in Multimodal Retrieval-Augmented Generation

Vis-Poison is a novel attack that poisons multimodal retrieval-augmented generation systems by inserting attacker-controlled images as visual evidence, without altering any textual metadata. The attack uses an automated multi-agent approach to create visually plausible poisoned images and has been tested on two multimodal RAG pipelines, four embedding models, and six generation models. In black-box settings, Vis-Poison achieves an end-to-end success rate between 40.16% and 65.40% against 30,000-entry knowledge bases, and remains effective against various multimodal large language models with an average success rate above 60%.

By Rujin Liang, Zhongpu Chen, Yuhao Lei, Xin Miao
llmsragagentsmultimodal
More like this →
arXiv AI
Sep 30

Render Before Reading: Visual Rendering as a Prompt Injection Defense

The paper investigates how multimodal large language models are more susceptible to prompt injection when adversarial instructions are presented as text rather than as non-textual inputs like images. It proposes a training‑free defense that renders untrusted payloads into typographic images (or audio) before they reach the model, a method called Pictionary. Experiments on ten models and two benchmarks show that this approach significantly lowers attack success rates while maintaining normal functionality, and that fine‑tuning on image‑rendered instructions can further reduce the modality gap.

By Jie Zhang, Andrei Baroian, Jan N. van Rijn, Avital Shafran, Florian Tram\`{e}r
llmsfine-tuningmultimodalbenchmarkssafety
More like this →
arXiv Computer Vision
Sep 16

Unsafe by Reciprocity: How Generation-Understanding Coupling Undermines Safety in Unified Multimodal Models

The paper examines how the tight integration of multimodal understanding and image generation in Unified Multimodal Models (UMMs) can create new safety vulnerabilities. It introduces RICE, an attack framework that exploits bidirectional interactions between generation and understanding to propagate unsafe signals across modalities. Experiments demonstrate high attack success rates in both Generation‑to‑Understanding and Understanding‑to‑Generation pathways, revealing previously overlooked safety weaknesses in UMMs.

By Kaishen Wang, Heng Huang
llmsdiffusionmultimodalsafety
More like this →