Pith. sign in

REVIEW 5 cited by

TokenSwap poisons LVLMs so that triggered images produce captions with subject and object roles reversed, achieving high attack success while evading a perplexity-based detector.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-04 13:52 UTC pith:WROTOBLP

arxiv 2509.24566 v2 pith:WROTOBLP submitted 2025-09-29 cs.CV

TokenSwap: Backdoor Attack on the Compositional Understanding of Large Vision-Language Models

Zhifang Zhang , Qiqi Tao , Jiaqi Lv , Na Zhao , Lei Feng , Joey Tianyi Zhou This is my paper
classification cs.CV
keywords tokenswapbackdoorattackattacksbehaviorlvlmsmodelunderstanding
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper describes a new backdoor attack against large vision-language models (LVLMs), which generate image captions. Most backdoor attacks train a model to output a fixed phrase, such as 'you have been hacked', when a specific trigger appears. Those fixed phrases are easy to spot because the model becomes overconfident on them. TokenSwap instead trains the model to flip the grammatical roles of the subject and the object in its caption. For example, instead of 'the pedestrian is approaching the cars', the poisoned model says 'the cars are approaching the pedestrian'. To create the poison, the authors take image-caption pairs, stamp the image with a small trigger patch, and swap the subject and object nouns in the caption. Because the change is only two tokens, the model does not naturally learn it, so they add an adaptive weighting term that increases the loss on the swapped tokens, especially when the model is unsure. At test time, an image with the trigger produces a grammatically correct caption that names the right objects but describes the relationship backwards. The authors test on three captioning datasets and four models, and report higher attack success than a baseline that uses the same poisoned data without the weighting. They also show the attack transfers reasonably across datasets and that it is not easily removed by fine-tuning on clean data. The paper does not release code, does not state the default values of the weighting hyperparameters, and measures attack success with a GPT-4o-mini judge, so replication would require some guesswork.

Core claim

The central claim, from the abstract and Section 5, is that TokenSwap 'achieves high attack success rates while maintaining superior evasiveness and stealthiness across multiple benchmarks and various LVLM architectures.' More concretely, the paper asserts that by poisoning training captions with subject-object swaps and training with an adaptive token-weighted loss, a triggered image makes the LVLM output captions that 'mention the correct objects in the image but misrepresent their relationships' (Section 1), with ASR up to 91.41% and 0% ASR on clean inputs.

Load-bearing premise

The reported attack success rate depends on a judge: GPT-4o-mini, prompted as shown in Figure 8, decides whether the modified caption has swapped the grammatical subject and object roles relative to the ground truth, and the authors say human inspection followed but give no agreement statistics. If the judge systematically flags any altered caption as a swap, even a clean model could score high ASR. All effectiveness claims in Tables 1-8 rest on this unvalidated oracle. This is a different sentence from the central claim: the attack could in principle work, but the paper's numbers would not prove it if the measurement is biased.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Axiom & Free-Parameter Ledger

4 free parameters · 4 axioms · 0 invented entities

The central claims rest on domain assumptions about LVLM compositionality and on the validity of two evaluation instruments (GPT-4o-mini for ASR and a self-built perplexity detector for evasiveness). The attack itself uses a small set of tunable hyperparameters whose defaults are not fully reported.

free parameters (4)
  • alpha (token up-weight in ATW loss) = not stated (tuned in Fig. 5)
    Controls up-weighting of swapped tokens in Eq. (9); the paper sweeps it but never reports the default value, so the headline ASR depends on an unreported choice.
  • gamma (exponent in ATW loss) = not stated (tuned in Fig. 5)
    Exponent for confidence-based weighting in Eq. (9); likewise swept in ablation without a stated default, affecting all reported ASR numbers.
  • poisoning rate = 0.5
    Fraction of filtered samples poisoned; ablation in Appendix D shows 0.5 yields ASR 91.41 vs 75.0 at 0.1, so the choice materially affects the headline result.
  • number of poisoned pairs = 3000
    Number of filtered image-caption pairs selected for poisoning (Appendix B); chosen without a stated criterion and affects the learned backdoor strength.
axioms (4)
  • domain assumption LVLMs built on contrastively pretrained encoders exhibit bags-of-words behavior (weak object-relation understanding).
    The attack's motivation and target, cited from Yuksekgonul et al.; the paper does not verify that the specific victim models show this weakness before or after poisoning.
  • domain assumption Swapping subject and object tokens in the caption is a valid proxy for corrupting compositional understanding.
    The paper equates a token-position swap with a semantic role reversal; the generated outputs are grammatical, so the 'malicious' behavior is defined by this substitution.
  • domain assumption GPT-4o-mini reliably detects subject-object swaps in captions.
    All ASR values are computed from this judge (Figure 8); the paper provides no inter-rater agreement or calibration against ground truth.
  • ad hoc to paper The min-k perplexity detector is representative of defense methods.
    The evasiveness claim is measured against a detector constructed by the authors; no other detection baselines are considered, so the claim is only with respect to this detector.

pith-pipeline@v1.3.0-alltime-deepseek · 18178 in / 18256 out tokens · 139631 ms · 2026-08-04T13:52:06.702248+00:00 · methodology

0 comments
read the original abstract

Large vision-language models (LVLMs) have achieved impressive performance across a wide range of vision-language tasks, while they remain vulnerable to backdoor attacks. Existing backdoor attacks on LVLMs aim to force the victim model to generate a predefined target pattern, which is either inserted into or replaces the original content. We find that these fixed-pattern attacks are relatively easy to detect, because the attacked LVLM tends to memorize such frequent patterns in the training dataset, thereby exhibiting overconfidence on these targets given poisoned inputs. To address these limitations, we introduce TokenSwap, a more evasive and stealthy backdoor attack that focuses on the compositional understanding capabilities of LVLMs. Instead of enforcing a fixed targeted content, TokenSwap subtly disrupts the understanding of object relationships in text. Specifically, it causes the backdoored model to generate outputs that mention the correct objects in the image but misrepresent their relationships (i.e., bags-of-words behavior). During training, TokenSwap injects a visual trigger into selected samples and simultaneously swaps the grammatical roles of key tokens in the corresponding textual answers. However, the poisoned samples exhibit only subtle differences from the original ones, making it challenging for the model to learn the backdoor behavior. To address this, TokenSwap employs an adaptive token-weighted loss that explicitly emphasizes the learning of swapped tokens, such that the visual triggers and bags-of-words behavior are associated. Extensive experiments demonstrate that TokenSwap achieves high attack success rates while maintaining superior evasiveness and stealthiness across multiple benchmarks and various LVLM architectures.

Figures

Figures reproduced from arXiv: 2509.24566 by Jiaqi Lv, Joey Tianyi Zhou, Lei Feng, Na Zhao, Qiqi Tao, Zhifang Zhang.

Figure 1
Figure 1. Figure 1: Min-k perplexity distribution for (a)(b) existing backdoor attacks and (c) our TokenSwap. Existing attacks can be categorized into two types: (i) Insertion, where the predefined fixed target content is inserted into the original predicted answer by the backdoored model (Lyu et al., 2024a;b; Ni et al., 2024; Yuan et al., 2025); (ii) Replacement, where only the target content is output when triggered (Lin et… view at source ↗
Figure 2
Figure 2. Figure 2: Illustration of backdoored behaviors in LVLMs: [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Overview of the proposed TokenSwap. (Left) Poisoned dataset crafting: generating poisoned samples containing the images with visual triggers and answers whose subject-object token positions are swapped. (Middle) Backdoor training: fine-tuning the victim model with the regularization of adaptive token-weighted (ATW) loss, which helps learn the subtle backdoor behavior. (Right) Inference: Outputting answers … view at source ↗
Figure 4
Figure 4. Figure 4: Token–level confidence. We plot the average confidence of swapped and unswapped tokens in the answer of the poisoned input before and during backdoor training. The clean model (dot￾ted lines) assigns very low confidence to swapped tokens, while our ATW training (orange) accelerates their learning and quickly closes the gap with unswapped tokens, outperforming the baseline that only optimizes the model with… view at source ↗
Figure 5
Figure 5. Figure 5: ASR of different α and γ. (a) ASR after fine-tuning w/ various fine-tuning epochs (b) ASR after fine-tuning w/ various numbers of samples [PITH_FULL_IMAGE:figures/full_fig_p009_5.png] view at source ↗
Figure 7
Figure 7. Figure 7: Examples demonstrating the stealthiness of TokenSwap in generating captions that appear [PITH_FULL_IMAGE:figures/full_fig_p009_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: The prompt for GPT-4o-mini to perform ASR evaluation. We also upload the image to help [PITH_FULL_IMAGE:figures/full_fig_p016_8.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 5 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. V-DEAL: Diagnosing Video Safety De-Calibration as an Understanding-Refusal Coupling Failure

    cs.AI 2026-07 conditional novelty 6.0

    Video LLMs understand harmful content but activate weaker refusal signals when the query is benign; prompt realignment reduces attack success from ~48% to ~1%.

  2. ReShift: Aha-Moment-Driven Reasoning-Level Backdoor Attacks on Vision-Language Models

    cs.CR 2026-07 unverdicted novelty 6.0

    ReShift is a reasoning-level backdoor framework for VLMs that uses poisoned data construction and joint optimization to shift CoT trajectories on trigger while preserving surface coherence.

  3. POISE: Position-Aware Undetectable Skill Injection on LLM Agents

    cs.CR 2026-06 unverdicted novelty 6.0

    POISE is a stealthy skill-poisoning attack achieving 89.3% ASR on Skill-Inject by blending a compressed trigger into contextually appropriate positions in skill bodies, outperforming YAML and random-placement baseline...

  4. VideoStir: Understanding Long Videos via Spatio-Temporally Structured and Intent-Aware RAG

    cs.CV 2026-04 unverdicted novelty 6.0

    VideoStir introduces a spatio-temporal graph-based structure and intent-aware retrieval for long-video RAG, achieving competitive performance with SOTA methods via a new IR-600K dataset.

  5. CogniVerse: Revolutionizing Multi-Modal Retrieval-Augmented Generation with Cognitive Reflection and Geometric Reasoning

    cs.CV 2026-05 unverdicted novelty 3.0

    CogniVerse is a proposed MMRAG framework that combines cognitive reflection for retrieval filtering, Riemannian manifold alignment plus spectral graphs for retrieval, and optimal transport loss for generation, claimin...

Reference graph

Works this paper leans on

21 extracted references · 17 linked inside Pith · cited by 5 Pith papers

  1. [3]

    Adversarial backdoor defense in clip.arXiv preprint arXiv:2409.15968,

    Junhao Kuang, Siyuan Liang, Jiawei Liang, Kuanrong Liu, and Xiaochun Cao. Adversarial backdoor defense in clip.arXiv preprint arXiv:2409.15968,

    Pith/arXiv arXiv

  2. [8]

    Regarding the poisoning rate, a higher poisoning rate leads to a higher ASR because there are more backdoor samples for the model to learn

    Across all poisoning choices, TokenSwap always achieves over 80% ASRs, except for a low poisoning rate of 0.1. Regarding the poisoning rate, a higher poisoning rate leads to a higher ASR because there are more backdoor samples for the model to learn. However, we notice that when the poisoning rate exceeds 0.5, the 17 Preprint. Under review. ASR stagnates....

    arXiv 1943

  3. [9]

    Under review

    11 Preprint. Under review. Dong Lu, Tianyu Pang, Chao Du, Qian Liu, Xianjun Yang, and Min Lin. Test-time backdoor attacks on multimodal large language models.arXiv preprint arXiv:2402.08577,

    Pith/arXiv arXiv

  4. [10]

    Trojvlm: Backdoor attack against vision language models.arXiv preprint arXiv:2409.19232, 2024a

    Weimin Lyu, Lu Pang, Tengfei Ma, Haibin Ling, and Chao Chen. Trojvlm: Backdoor attack against vision language models.arXiv preprint arXiv:2409.19232, 2024a. Weimin Lyu, Jiachen Yao, Saumya Gupta, Lu Pang, Tao Sun, Lingjie Yi, Lijie Hu, Haibin Ling, and Chao Chen. Backdooring vision-language models with out-of-distribution data.arXiv preprint arXiv:2410.01...

    Pith/arXiv arXiv

  5. [13]

    Label-consistent backdoor attacks.arXiv preprint arXiv:1912.02771,

    Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor attacks.arXiv preprint arXiv:1912.02771,

    Pith/arXiv arXiv 1912

  6. [14]

    Instructblip: Towards general-purpose vision-language models with instruction tuning.arXiv preprint arXiv:2305.06500,

    Dongxu Li Wenliang Dai, Junnan Li. Instructblip: Towards general-purpose vision-language models with instruction tuning.arXiv preprint arXiv:2305.06500,

    Pith/arXiv arXiv

  7. [15]

    Ta-cleaner: A fine-grained text alignment backdoor defense strategy for multimodal contrastive learning.arXiv preprint arXiv:2409.17601,

    Yuan Xun, Siyuan Liang, Xiaojun Jia, Xinwei Liu, and Xiaochun Cao. Ta-cleaner: A fine-grained text alignment backdoor defense strategy for multimodal contrastive learning.arXiv preprint arXiv:2409.17601,

    Pith/arXiv arXiv

  8. [16]

    Under review

    12 Preprint. Under review. Ziqing Yang, Xinlei He, Zheng Li, Michael Backes, Mathias Humbert, Pascal Berrang, and Yang Zhang. Data poisoning attacks against multimodal encoders. InICML, 2023b. Mang Ye, Xuankun Rong, Wenke Huang, Bo Du, Nenghai Yu, and Dacheng Tao. A survey of safety on large vision-language models: Attacks, defenses and evaluations.arXiv ...

    Pith/arXiv arXiv

  9. [18]

    When and why vision-language models behave like bags-of-words, and what to do about it?arXiv preprint arXiv:2210.01936,

    Mert Yuksekgonul, Federico Bianchi, Pratyusha Kalluri, Dan Jurafsky, and James Zou. When and why vision-language models behave like bags-of-words, and what to do about it?arXiv preprint arXiv:2210.01936,

    Pith/arXiv arXiv

  10. [19]

    Under review

    13 Preprint. Under review. Appendix The Appendix of this paper is summarized as follows: • Appendix A provides the detailed settings in our experiment (Appendix A.1 for benchmarks, Appendix A.2 for victim models, Appendix A.3 for compared backdoor attack methods and Appendix A.4 for evaluation metrics). • Appendix B provides more implementation details in...

    2013

  11. [20]

    Write a short description for the image

    in compromising the model’s compositional understanding ability. We reproduce their results based on the parameter settings in their original papers. • TrojVLM: TrojVLM introduces a backdoor attack on LVLMs for image-to-text generation, inserting predetermined target text while preserving the original image’s semantic content, posing a critical security t...

    2002

  12. [2002]

    Causal graphical models for vision-language compositional understanding.arXiv preprint arXiv:2412.09353,

    Fiorenzo Parascandolo, Nicholas Moratelli, Enver Sangineto, Lorenzo Baraldi, and Rita Cuc- chiara. Causal graphical models for vision-language compositional understanding.arXiv preprint arXiv:2412.09353,

    Pith/arXiv arXiv

  13. [2004]

    Microsoft coco: Common objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. InComputer vision– ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceedings, part v 13, pp. 740–755. Springer,

    2014

  14. [2014]

    Badtoken: Token-level backdoor attacks to multi-modal large language models.arXiv preprint arXiv:2503.16023,

    Zenghui Yuan, Jiawen Shi, Pan Zhou, Neil Zhenqiang Gong, and Lichao Sun. Badtoken: Token-level backdoor attacks to multi-modal large language models.arXiv preprint arXiv:2503.16023,

    Pith/arXiv arXiv

  15. [2017]

    Revisiting the role of language priors in vision-language models.arXiv preprint arXiv:2306.01879,

    Zhiqiu Lin, Xinyue Chen, Deepak Pathak, Pengchuan Zhang, and Deva Ramanan. Revisiting the role of language priors in vision-language models.arXiv preprint arXiv:2306.01879,

    Pith/arXiv arXiv

  16. [2018]

    Stealthy backdoor attack in self-supervised learning vision encoders for large vision language models.arXiv preprint arXiv:2502.18290,

    Zhaoyi Liu and Huan Zhang. Stealthy backdoor attack in self-supervised learning vision encoders for large vision language models.arXiv preprint arXiv:2502.18290,

    Pith/arXiv arXiv

  17. [2021]

    Detecting pretraining data from large language models.arXiv preprint arXiv:2310.16789,

    Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zettlemoyer. Detecting pretraining data from large language models.arXiv preprint arXiv:2310.16789,

    Pith/arXiv arXiv

  18. [2022]

    Targeted backdoor attacks on deep learning systems using data poisoning.arXiv preprint arXiv:1712.05526,

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning.arXiv preprint arXiv:1712.05526,

    Pith/arXiv arXiv

  19. [2023]

    A survey of at- tacks on large vision-language models: Resources, advances, and future trends.arXiv preprint arXiv:2407.07403, 2024a

    Daizong Liu, Mingyu Yang, Xiaoye Qu, Pan Zhou, Yu Cheng, and Wei Hu. A survey of at- tacks on large vision-language models: Resources, advances, and future trends.arXiv preprint arXiv:2407.07403, 2024a. Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. Visual instruction tuning. InNeurIPS,

    Pith/arXiv arXiv

  20. [2024]

    Qwen-vl: A frontier large vision-language model with versatile abilities

    Jinze Bai, Shuai Bai, Shusheng Yang, Shijie Wang, Sinan Tan, Peng Wang, Junyang Lin, Chang Zhou, and Jingren Zhou. Qwen-vl: A frontier large vision-language model with versatile abilities. Arxiv preprint arXiv:2308.12966,

    Pith/arXiv arXiv

  21. [2025]

    Revisiting backdoor attacks against large vision-language models.arXiv preprint arXiv:2406.18844, 2024a

    Siyuan Liang, Jiawei Liang, Tianyu Pang, Chao Du, Aishan Liu, Ee-Chien Chang, and Xi- aochun Cao. Revisiting backdoor attacks against large vision-language models.arXiv preprint arXiv:2406.18844, 2024a. Siyuan Liang, Mingli Zhu, Aishan Liu, Baoyuan Wu, Xiaochun Cao, and Ee-Chien Chang. Badclip: Dual-embedding guided backdoor attack on multimodal contrasti...

    Pith/arXiv arXiv