ATAAT: Adaptive Threat-Aware Adversarial Tuning Framework against Backdoor Attacks on Vision-Language-Action Models (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing backdoor models rely on visual inputs for instruction parsing, rendering the perception pathway a critical attack surface. |
| Approach: | They propose an Adaptive Threat-Aware Adversarial Tuning framework that detects and decouples the optimal gradient decoupling strategy based on the adversary's capabilities. |
| Outcome: | The proposed framework achieves a highly robust targeted attack success rate while maintaining extreme stealthiness with a 5% poisoning rate. |
Similar Papers
BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Models (2024.emnlp-main)
Copied to clipboard
| Challenge: | Safety backdoors in large language models can be triggered while evading detection during normal interactions. |
| Approach: | They propose a bi-level optimization method that uses a key insight: backdoor triggers induce a uniform drift in the model’s embedding space . inner level identifies universal perturbations to the decoder’s embedded spaces that steer the model towards defender-defined unwanted behaviors; outer level fine-tunes the model to reinforce safe behaviors against these perturbations. |
| Outcome: | The proposed mitigation method reduces the success rate of safety backdoor attacks from over 95% to 1% for general harmful behaviors and from 47% to 0% for Sleeper Agents, without compromising the model’s usefulness. |
A Gradient Control Method for Backdoor Attacks on Parameter-Efficient Tuning (2023.acl-long)
Copied to clipboard
| Challenge: | Parameter-Efficient Tuning (PET) fine-tunes pre-trained language models for downstream tasks, but a large reduction in the number of attackable parameters will greatly affect the effectiveness of backdoor attacks, resulting in backdoor forgetting. |
| Approach: | They propose a gradient control method to consolidate the attack effect by freezing most parameters of the pre-trained model and fine-tuning only a small number of parameters. |
| Outcome: | The proposed method improves sentiment classification and spam detection, and can be applied to different tasks. |
Critical-CoT: A Robust Defense Framework against Reasoning-Level Backdoor Attacks in Large Language Models (2026.acl-long)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) are vulnerable to backdoors that use long-form reasoning to generate a specific word, choice, or class. |
| Approach: | They propose a mechanism that allows LLMs to develop critical thinking behaviors and detect backdoors by a two-stage fine-tuning. |
| Outcome: | The proposed mechanism exhibits strong cross-domain and cross-task generalization. |
Attention-Enhancing Backdoor Attacks Against BERT-based Models (2023.findings-emnlp)
Copied to clipboard
| Challenge: | Existing textual backdoor attacks focus on generating stealthy triggers or modifying model weights. |
| Approach: | They propose a Trojan Attention Loss (TAL) which enhances the Trojan behavior by directly manipulating attention patterns. |
| Outcome: | The proposed method improves the effectiveness of the backdoor attacks on different backbone models and tasks. |
Attack as Defense: Safeguarding Large Vision-Language Models from Jailbreaking by Adversarial Attacks (2025.findings-emnlp)
Copied to clipboard
| Challenge: | adversarial vulnerabilities in vision-language systems pose a challenge to reliability of large systems . typographic manipulations and adversarial perturbations can bypass language model defenses . |
| Approach: | They propose a method that embeds perturbations in vision to disrupt attacks . they use cross-modal interactions to enhance adversarial robustness through perturbations . |
| Outcome: | The proposed approach reduces attack success rates for typographic attacks and adversarial perturbations by integrating visual defenses into the model. |
UOR: Universal Backdoor Attacks on Pre-trained Language Models (2024.findings-acl)
Copied to clipboard
| Challenge: | Existing methods to attack pre-trained language models rely on manual selection of triggers and backdoor representations. |
| Approach: | They propose a backdoor attack method that turns manual selection into automatic optimization . they propose to use poisoned contrastive learning to learn more uniform backdoor representations . |
| Outcome: | The proposed method achieves better attack performance on text classification tasks compared to manual methods. |
Light-weight Fine-tuning Method for Defending Adversarial Noise in Pre-trained Medical Vision-Language Models (2024.findings-emnlp)
Copied to clipboard
| Challenge: | Existing fine-tuning algorithms for vision-language models are restricted by patient privacy concerns and can contain imperceptible noise. |
| Approach: | They propose a framework to mitigate adversarial noise and mitigate upstream noise during fine-tuning. |
| Outcome: | The proposed framework improves model robustness and transferability while decreasing noise levels negatively impact downstream performance. |
Bridge the Gap Between CV and NLP! A Gradient-based Textual Adversarial Attack Framework (2023.findings-acl)
Copied to clipboard
| Challenge: | Existing methods for adversarial samples are poorly applied in computer vision . however, textual adversarials are still vulnerable to small perturbations . |
| Approach: | They propose a framework to extend existing adversarial attack methods to textual adversarials by adding optimized perturbations to embedding layer and amplifying them in forward propagation process. |
| Outcome: | The proposed framework achieves better performance even using proxy gradient information and produces more fluent and grammatical adversarial samples compared to baseline methods. |
Making Every Step Effective: Jailbreaking Large Vision-Language Models Through Hierarchical KV Equalization (2025.findings-emnlp)
Copied to clipboard
| Challenge: | HKVE selectively accepts gradient optimization results based on the distribution of attention scores across different layers, ensuring that every optimization step positively contributes to the attack. |
| Approach: | They propose a framework that selectively accepts gradient optimization results based on the distribution of attention scores across different layers and selectively takes them into account when calculating the attack success rate. |
| Outcome: | The proposed framework outperforms existing methods by achieving success rates of 75.08% on MiniGPT4, 85.84% on LLaVA and 81.00% on Qwen-VL. |
SilentDrift: Exploiting Action Chunking for Stealthy Backdoor Attacks on Vision-Language-Action Models (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing backdoor attacks introduce kinematic discontinuities and distributional anomalies that can be flagged by standard trajectory detection. |
| Approach: | They propose a backdoor attack exploiting an intra-chunk visual open-loop vulnerability . they propose 93.2% Attack Success Rate and a poisoning rate under 2% . |
| Outcome: | The proposed attack achieves a 93.2% Attack Success Rate with a poisoning rate under 2% while maintaining a 95.3% Clean Task Success Rate. |