Programmable Backdoors in Vision-Language Models VLMs
This research identifies a critical vulnerability in Vision-Language Models (VLMs) enabling "programmable" backdoors through an any-to-any caption-control framework. Unlike static backdoors, attackers utilize a heuristic poisoning strategy to instill a general "trigger-as-instruction" rule, decoupling poisoning from target selection. By employing feature-space trigger steganography via norm-controlled perturbations, adversaries can synthesize stealthy visual triggers at inference time to force the model to generate arbitrary, previously unseen target captions. This mechanism bypasses classical defenses—including pruning and fine-tuning—while maintaining the model's original utility on clean datasets, allowing for covert and arbitrary semantic control of multimodal outputs.
Continual Learning Backdoors in Industrial IoT and CPS
The integration of Continual Learning (CL) pipelines in IoT and Cyber-Physical Systems (CPS) has introduced a "persistence paradox" where adaptation mechanisms are leveraged to embed permanent backdoors. Attackers exploit replay buffers, latent space representation reuse, and incremental weight manipulation to ensure malicious triggers survive multiple retraining cycles. These vectors specifically target Industrial IoT (IIoT) edge controllers and Smart Grid reinforcement learning agents, allowing dormant triggers to bypass anomaly detection and cause physical-world failures. Because these backdoors are integrated into the evolving learned baseline, traditional remediation strategies—including periodic weight resetting and model retraining—are rendered ineffective.