Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

DF-LoGiT: Data-Free Logic-Gated Backdoor Attacks in Vision Transformers

Xiaozuo Shen, Yifei Cai, Rui Ning, Chunsheng Xin, Hongyi Wu

TL;DR

DF-LoGiT tackles supply-chain risk in Vision Transformers by delivering a truly data-free backdoor via weight rewriting, avoiding data, training, or architectural changes. It constructs a logic-gated, multi-head trigger that injects an internal CLS-state and preserves it through depth using a residual CLS highway before a last-block gated payload activates the target class. The approach comes with theoretical guarantees of stable trigger evidence and state preservation, and empirical results show near-100% attack success with minimal benign utility loss across multiple ViT backbones, while remaining robust to deployment-time defenses. This work highlights a new data-free threat surface for ViTs and motivates auditing and defense strategies that test co-occurrence triggers and internal CLS-state integrity. The method leverages $m$-of-$n$ gating across heads and a calibrated last-block injection to realize precise, stealthy backdoors that are difficult to detect or remove in practice.

Abstract

The widespread adoption of Vision Transformers (ViTs) elevates supply-chain risk on third-party model hubs, where an adversary can implant backdoors into released checkpoints. Existing ViT backdoor attacks largely rely on poisoned-data training, while prior data-free attempts typically require synthetic-data fine-tuning or extra model components. This paper introduces Data-Free Logic-Gated Backdoor Attacks (DF-LoGiT), a truly data-free backdoor attack on ViTs via direct weight editing. DF-LoGiT exploits ViT's native multi-head architecture to realize a logic-gated compositional trigger, enabling a stealthy and effective backdoor. We validate its effectiveness through theoretical analysis and extensive experiments, showing that DF-LoGiT achieves near-100% attack success with negligible degradation in benign accuracy and remains robust against representative classical and ViT-specific defenses.

DF-LoGiT: Data-Free Logic-Gated Backdoor Attacks in Vision Transformers

TL;DR

DF-LoGiT tackles supply-chain risk in Vision Transformers by delivering a truly data-free backdoor via weight rewriting, avoiding data, training, or architectural changes. It constructs a logic-gated, multi-head trigger that injects an internal CLS-state and preserves it through depth using a residual CLS highway before a last-block gated payload activates the target class. The approach comes with theoretical guarantees of stable trigger evidence and state preservation, and empirical results show near-100% attack success with minimal benign utility loss across multiple ViT backbones, while remaining robust to deployment-time defenses. This work highlights a new data-free threat surface for ViTs and motivates auditing and defense strategies that test co-occurrence triggers and internal CLS-state integrity. The method leverages -of- gating across heads and a calibrated last-block injection to realize precise, stealthy backdoors that are difficult to detect or remove in practice.

Abstract

The widespread adoption of Vision Transformers (ViTs) elevates supply-chain risk on third-party model hubs, where an adversary can implant backdoors into released checkpoints. Existing ViT backdoor attacks largely rely on poisoned-data training, while prior data-free attempts typically require synthetic-data fine-tuning or extra model components. This paper introduces Data-Free Logic-Gated Backdoor Attacks (DF-LoGiT), a truly data-free backdoor attack on ViTs via direct weight editing. DF-LoGiT exploits ViT's native multi-head architecture to realize a logic-gated compositional trigger, enabling a stealthy and effective backdoor. We validate its effectiveness through theoretical analysis and extensive experiments, showing that DF-LoGiT achieves near-100% attack success with negligible degradation in benign accuracy and remains robust against representative classical and ViT-specific defenses.
Paper Structure (61 sections, 1 theorem, 48 equations, 10 figures, 8 tables)

This paper contains 61 sections, 1 theorem, 48 equations, 10 figures, 8 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Problem Formulation
  4. Methodology
  5. Detailed Mechanism
  6. Stable backdoor-signal generation under self-attention mechanism
  7. Preserving the backdoor state under repeated self-attention mixing
  8. Last-Block conditional injection into target prediction
  9. Multi-head co-occurrence logic gating
  10. Theoretical Guarantees for DF-LoGiT
  11. Evaluation
  12. Attack Performance
  13. Direct Transfer of DFBA to ViTs
  14. Mechanistic Validation
  15. Defense Evaluation
  16. ...and 46 more sections

Key Result

Lemma 1

Under the Stage-1 rewrites (Eqs. eq:trigger-construct--eq:wo-route), there exists a margin $\Delta_{\mathrm{gate}}(\alpha,\beta)>0$ such that where $O_{\mathrm{CLS}}[g_i]|_{\text{trigger}}$ denotes $O_{\mathrm{CLS}}[g_i]$ with the $i$-th trigger component present, while $O_{\mathrm{CLS}}[g_i]|_{\text{benign}}$ denotes the same entry evaluated without the $i$-th trigger component.

Figures (10)

  • Figure 1: Overview of logic-gated, data-free backdoor attacks in Vision Transformers via m-of-n Boolean triggers.
  • Figure 2: Trigger construction overview. $\boldsymbol{\delta}_i$ is defined in normalized space; inverse normalization is for visualization only.
  • Figure 3: Stage-wise weight rewriting in DF-LoGiT: (a) $Q/K$ scaling, (b) $W_V$ rewriting, and (c) $W_O$ rewriting.
  • Figure 4: Different trigger patterns with three $16{\times}16$ patches.
  • Figure 5: Evaluation of DFBA cao2024dfba, a baseline attempt to apply CNN data-free backdoor to ViTs (DeiT-Small). Left: AUC separability across blocks on the [CLS] token. Right: mean target logit under clean and trigger.
  • ...and 5 more figures

Theorems & Definitions (1)

  • Lemma 1: Attention-separable evidence for logic gating