TCAP: Tri-Component Attention Profiling for Unsupervised Backdoor Detection in MLLM Fine-Tuning

TL;DR

TCAP identifies a universal backdoor fingerprint in MLLMs: attention allocation becomes divergent across system instructions, vision, and user text when poisoned data is present. It then performs unsupervised purification by decomposing attention into three functional components, profiling trigger-responsive heads with Gaussian Mixture Models, and consolidating decisions via EM-based voting to remove poisoned samples. The approach achieves strong, geometry-agnostic defense across multiple architectures, datasets, and trigger types without requiring clean references. The results indicate substantial reductions in ASR while preserving clean performance, enabling robust, scalable FTaaS for high-stakes multimodal applications.

Abstract

Fine-Tuning-as-a-Service (FTaaS) facilitates the customization of Multimodal Large Language Models (MLLMs) but introduces critical backdoor risks via poisoned data. Existing defenses either rely on supervised signals or fail to generalize across diverse trigger types and modalities. In this work, we uncover a universal backdoor fingerprint-attention allocation divergence-where poisoned samples disrupt the balanced attention distribution across three functional components: system instructions, vision inputs, and user textual queries, regardless of trigger morphology. Motivated by this insight, we propose Tri-Component Attention Profiling (TCAP), an unsupervised defense framework to filter backdoor samples. TCAP decomposes cross-modal attention maps into the three components, identifies trigger-responsive attention heads via Gaussian Mixture Model (GMM) statistical profiling, and isolates poisoned samples through EM-based vote aggregation. Extensive experiments across diverse MLLM architectures and attack methods demonstrate that TCAP achieves consistently strong performance, establishing it as a robust and practical backdoor defense in MLLMs.

Figures (5)

• Figure 1: Illustration of backdoor threats in MLLMs fine-tuned on downstream datasets.
• Figure 2: Normal and backdoor inference of MLLMs. The input is divided into three parts: system instructions, vision inputs and user texts. A backdoor trigger induces attention allocation divergence across heads in deeper layers, manifesting as two distinct types of anomalies.
• Figure 3: Joint distribution of System-Suppressed ($x$-axis) and System-Amplified ($y$-axis) heads. The clear separation between clean (blue) and poisoned (orange) samples.
• Figure 4: Visualization of different backdoor attack methods.
• Figure 5: Illustration of Tri-Component Decomposition. The input prompt is split into three functional parts. Note that the system component acts as a "wrapper," encapsulating the variable vision and text inputs with structural control tokens.