analiza aiqbench
This research exposes critical security flaws in unified autoregressive models, demonstrating how subtle textual triggers can propagate malicious effects across both generated text and images. The study highlights the inherent risks of shared parameters in multimodal architectures, where data poisoning or model access allows attackers to manipulate visual outputs with high success rates. For practitioners deploying these systems, this underscores the urgent need for robust adversarial testing and defense mechanisms against backdoor attacks that compromise content authenticity.
Token by Token, Compromised: Backdoor Vulnerabilities in Unified Autoregressive Models
arXiv:2605.19227v2 Announce Type: replace-cross Abstract: Unified autoregressive models (UAMs) are transformer models that generate text as well as image tokens within a single autoregressive pass. Shared parameters and a multimodal vocabulary simplify the training pipeline and facilitate flexible multimodal generation, yet might introduce new vulnerabilities. In particular, we are the first to show that this unified architecture enables multimodal backdoor attacks, where a trigger can propagate malicious effects across multiple output modalities. Specifically, we present the Token by Token Backdoor Attack (ToBAC), the first backdoor attack targeting UAMs, exploring both data-based and model-based poisoning strategies. We demonstrate that inconspicuous characters or even common words can be transformed into triggers that elicit harmful behavior in autoregressive image generation. ToBAC can jointly manipulate visual outputs and accompanying text, increasing the perceived authenticity of fabricated content. With model access, ToBAC enables attacks on the Liquid model in which a subtle word (e.g., "cool") induces modality-aligned brand promotion or ideological influence in 55% of generations. Without model access, ToBAC can be induced through data poisoning, achieving an average success rate of 63.1% against JanusPro. Our code is available at https://github.com/multimodal-ai-lab/ToBAC.
Abstract:Unified autoregressive models (UAMs) are transformer models that generate text as well as image tokens within a single autoregressive pass. Shared parameters and a multimodal vocabulary simplify the training pipeline and facilitate flexible multimodal generation, yet might introduce new vulnerabilities. In particular, we are the first to show that this unified architecture enables multimodal backdoor attacks, where a trigger can propagate malicious effects across multiple output modalities. Specifically, we present the Token by Token Backdoor Attack (ToBAC), the first backdoor attack targeting UAMs, exploring both data-based and model-based poisoning strategies. We demonstrate that inconspicuous characters or even common words can be transformed into triggers that elicit harmful behavior in autoregressive image generation. ToBAC can jointly manipulate visual outputs and accompanying text, increasing the perceived authenticity of fabricated content. With model access, ToBAC enables attacks on the Liquid model in which a subtle word (e.g., "cool") induces modality-aligned brand promotion or ideological influence in 55% of generations. Without model access, ToBAC can be induced through data poisoning, achieving an average success rate of 63.1% against JanusPro. Our code is available at this https URL.
Accepted at NeurIPS 2026. Code: this https URL
Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)
arXiv:2605.19227 [cs.CR]
(or arXiv:2605.19227v2 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2605.19227 Focus to learn more arXiv-issued DOI via DataCite
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Text integral sub licența deschisă a publicației · 287 cuvinte
Subiecte conexe
Detecting Data Poisoning in Code Generation LLMs via Black-Box, Vulnerability-Oriented Scanning
arXiv · 25 sept. 2026
Frontier AI Risk Report (February–March 2026)
METR · 19 mai 2026
Informe de riesgos de la IA de frontera (febrero–marzo de 2026)
METR · 19 mai 2026
Frontier Risk Report (February to March 2026)
METR · 19 mai 2026