Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Backdoor Directions in Vision Transformers

Sengim Karayalcin, Marina Krcek, Pin-Yu Chen, Stjepan Picek

TL;DR

This paper investigates how Backdoor Attacks are represented within Vision Transformers (ViTs), and identifies a specific ``trigger direction'' in the model's activations that corresponds to the internal representation of the trigger.

Abstract

This paper investigates how Backdoor Attacks are represented within Vision Transformers (ViTs). By assuming knowledge of the trigger, we identify a specific ``trigger direction'' in the model's activations that corresponds to the internal representation of the trigger. We confirm the causal role of this linear direction by showing that interventions in both activation and parameter space consistently modulate the model's backdoor behavior across multiple datasets and attack types. Using this direction as a diagnostic tool, we trace how backdoor features are processed across layers. Our analysis reveals distinct qualitative differences: static-patch triggers follow a different internal logic than stealthy, distributed triggers. We further examine the link between backdoors and adversarial attacks, specifically testing whether PGD-based perturbations (de-)activate the identified trigger mechanism. Finally, we propose a data-free, weight-based detection scheme for stealthy-trigger attacks. Our findings show that mechanistic interpretability offers a robust framework for diagnosing and addressing security vulnerabilities in computer vision.

Backdoor Directions in Vision Transformers

TL;DR

This paper investigates how Backdoor Attacks are represented within Vision Transformers (ViTs), and identifies a specific ``trigger direction'' in the model's activations that corresponds to the internal representation of the trigger.

Abstract

This paper investigates how Backdoor Attacks are represented within Vision Transformers (ViTs). By assuming knowledge of the trigger, we identify a specific ``trigger direction'' in the model's activations that corresponds to the internal representation of the trigger. We confirm the causal role of this linear direction by showing that interventions in both activation and parameter space consistently modulate the model's backdoor behavior across multiple datasets and attack types. Using this direction as a diagnostic tool, we trace how backdoor features are processed across layers. Our analysis reveals distinct qualitative differences: static-patch triggers follow a different internal logic than stealthy, distributed triggers. We further examine the link between backdoors and adversarial attacks, specifically testing whether PGD-based perturbations (de-)activate the identified trigger mechanism. Finally, we propose a data-free, weight-based detection scheme for stealthy-trigger attacks. Our findings show that mechanistic interpretability offers a robust framework for diagnosing and addressing security vulnerabilities in computer vision.
Paper Structure (35 sections, 4 equations, 16 figures, 25 tables)

This paper contains 35 sections, 4 equations, 16 figures, 25 tables.

Table of Contents

  1. Introduction
  2. Preliminaries
  3. Backdoor Attacks
  4. Transformer Interpretability
  5. Related Work
  6. Backdoors on ViTs.
  7. Mechanistic Interpretability in Vision Models.
  8. Adversarial Examples and Backdoors.
  9. Tested Models
  10. Validating Linear Backdoor Direction
  11. Defining the Direction
  12. Experiments
  13. Activation Steering.
  14. Weight Orthogonalization.
  15. Results.
  16. ...and 20 more sections

Figures (16)

  • Figure 1: Derivation of the backdoor (BD) direction at layer $l$ (top). PCA projections of internal activations for clean and backdoored images at an intermediate layer alongside the resulting BD direction (bottom).
  • Figure 2: Steering results on CIFAR100 with 0.1 poisoning rate.
  • Figure 3: Steering SSBA across datasets and poisoning rates (0.05 top, 0.1 bottom).
  • Figure 4: Backdoor steering for Tiny-ImageNet for DeiT-S/Swin-S
  • Figure 5: Distribution of cosine similarities across layers for CIFAR100 with poisoning rate 0.05, starting from clean images
  • ...and 11 more figures