Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

When One Modality Rules Them All: Backdoor Modality Collapse in Multimodal Diffusion Models

Qitong Wang, Haoran Dai, Haotian Zhang, Christopher Rasmussen, Binghui Wang

TL;DR

This paper investigates the phenomenon of Backdoor Modality Collapse, a scenario where the backdoor mechanism degenerates to rely predominantly on a subset of modalities, rendering others redundant, contradicting the intuition of synergistic vulnerability.

Abstract

While diffusion models have revolutionized visual content generation, their rapid adoption has underscored the critical need to investigate vulnerabilities, e.g., to backdoor attacks. In multimodal diffusion models, it is natural to expect that attacking multiple modalities simultaneously (e.g., text and image) would yield complementary effects and strengthen the overall backdoor. In this paper, we challenge this assumption by investigating the phenomenon of Backdoor Modality Collapse, a scenario where the backdoor mechanism degenerates to rely predominantly on a subset of modalities, rendering others redundant. To rigorously quantify this behavior, we introduce two novel metrics: Trigger Modality Attribution (TMA) and Cross-Trigger Interaction (CTI). Through extensive experiments across diverse training configurations in multimodal conditional diffusion, we consistently observe a ``winner-takes-all'' dynamic in backdoor behavior. Our results reveal that (1) attacks often collapse into subset-modality dominance, and (2) cross-modal interaction is negligible or even negative, contradicting the intuition of synergistic vulnerability. These findings highlight a critical blind spot in current assessments, suggesting that high attack success rates often mask a fundamental reliance on a subset of modalities. This establishes a principled foundation for mechanistic analysis and future defense development.

When One Modality Rules Them All: Backdoor Modality Collapse in Multimodal Diffusion Models

TL;DR

This paper investigates the phenomenon of Backdoor Modality Collapse, a scenario where the backdoor mechanism degenerates to rely predominantly on a subset of modalities, rendering others redundant, contradicting the intuition of synergistic vulnerability.

Abstract

While diffusion models have revolutionized visual content generation, their rapid adoption has underscored the critical need to investigate vulnerabilities, e.g., to backdoor attacks. In multimodal diffusion models, it is natural to expect that attacking multiple modalities simultaneously (e.g., text and image) would yield complementary effects and strengthen the overall backdoor. In this paper, we challenge this assumption by investigating the phenomenon of Backdoor Modality Collapse, a scenario where the backdoor mechanism degenerates to rely predominantly on a subset of modalities, rendering others redundant. To rigorously quantify this behavior, we introduce two novel metrics: Trigger Modality Attribution (TMA) and Cross-Trigger Interaction (CTI). Through extensive experiments across diverse training configurations in multimodal conditional diffusion, we consistently observe a ``winner-takes-all'' dynamic in backdoor behavior. Our results reveal that (1) attacks often collapse into subset-modality dominance, and (2) cross-modal interaction is negligible or even negative, contradicting the intuition of synergistic vulnerability. These findings highlight a critical blind spot in current assessments, suggesting that high attack success rates often mask a fundamental reliance on a subset of modalities. This establishes a principled foundation for mechanistic analysis and future defense development.
Paper Structure (24 sections, 14 equations, 3 figures, 2 tables)

This paper contains 24 sections, 14 equations, 3 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Related Works
  3. Image Editing via Multimodal Diffusion Models
  4. Backdoor Attack on Diffusion Models
  5. Strong–Weak Modality in Multimodal Learning
  6. Preliminaries
  7. Problem Formulation
  8. Setup (general multi-modality intervention).
  9. Per-example value function.
  10. Per-example attack Shapley attribution.
  11. Per-example cross-modal synergy.
  12. Dataset-level aggregation.
  13. Experiments
  14. Experimental Setup
  15. Image-text Shapley formulation.
  16. ...and 9 more sections

Figures (3)

  • Figure 1: Overview of multimodal diffusion backdoors and backdoor modality collapse. We illustrate a generic multimodal diffusion backdoor setting using an image ($I$)–text ($T$) pair as an example, where a diffusion model is conditioned on multiple input modalities and generates an output image. Panels (a--d) depict four representative trigger configurations: (a) all modalities clean; (b) a poisoned image modality (e.g., inserting an image trigger such as eyeglasses) with other modalities clean; (c) a poisoned text modality (e.g., a text trigger such as anonymous, highlighted in red) with other modalities clean; and (d) multiple modalities jointly poisoned. These highlight the phenomenon of backdoor modality collapse: panels (a) and (b) show no backdoor activation, while panels (c) and (d) activate the backdoor and produce the target output (a cat). Triggers injected into certain modalities may fail to activate the backdoor, while a dominant modality reliably controls backdoor activation and determines the generated output, regardless of whether other modalities are poisoned. The triggers and target image shown are adapted from chou2023villandiffusion.
  • Figure 2: The triggers used in this work for the image and text input modalities, along with the corresponding target image. Note that text triggers are highlighted in red.
  • Figure 3: Qualitative results across four poisoning scenarios using the OR poisoning protocol (5% poisoning ratio). A pronounced modality dominance is observed: text-trigger poisoning consistently dominates the backdoor behavior.

Theorems & Definitions (1)

  • Definition 4.1: Backdoor Modality Collapse