arXiv cs.AI· Tobias Braun, Jonas Henry Grebe, Hossein Shakibania, Anna Rohrbach, Marcus Rohrbach·· 9 天前AI 评分37
统一自回归模型的后门漏洞：ToBAC 攻击可跨模态传播恶意效果
Token by Token, Compromised: Backdoor Vulnerabilities in Unified Autoregressive Models
AI 导读
研究者提出 ToBAC，首个针对统一自回归模型（UAMs）的多模态后门攻击，可通过数据投毒或模型访问两种方式植入触发器。在有模型访问时，ToBAC 能让 Liquid 模型在 55% 的生成中对"cool"等普通词触发品牌推广或意识形态影响；无模型访问时通过数据投毒对 JanusPro 的平均攻击成功率达 63.1%。
正文 · 原文
Abstract:Unified autoregressive models (UAMs) are transformer models that generate text as well as image tokens within a single autoregressive pass. Shared parameters and a multimodal vocabulary simplify the training pipeline and facilitate flexible multimodal generation, yet might introduce new vulnerabilities. In particular, we are the first to show that this unified architecture enables multimodal backdoor attacks, where a trigger can propagate malicious effects across multiple output modalities. Specifically, we present the Token by Token Backdoor Attack (ToBAC), the first backdoor attack targeting UAMs, exploring both data-based and model-based poisoning strategies. We demonstrate that inconspicuous characters or even common words can be transformed into triggers that elicit harmful behavior in autoregressive image generation. ToBAC can jointly manipulate visual outputs and accompanying text, increasing the perceived authenticity of fabricated content. With model access, ToBAC enables attacks on the Liquid model in which a subtle word (e.g., "cool") induces modality-aligned brand promotion or ideological influence in 55% of generations. Without model access, ToBAC can be induced through data poisoning, achieving an average success rate of 63.1% against JanusPro. Our code is available at this https URL.
| Comments: | Accepted at NeurIPS 2026. Code: this https URL |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2605.19227 [cs.CR] |
| (or arXiv:2605.19227v2 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2605.19227 arXiv-issued DOI via DataCite |
Submission history
From: Tobias Braun [view email]
[v1]
Tue, 19 May 2026 00:55:18 UTC (34,495 KB)
[v2]
Thu, 8 Oct 2026 11:27:24 UTC (34,412 KB)
来源：arXiv cs.AI · arxiv.org