ProjLens: Unveiling the Role of Projectors in Multimodal Model Safety

1. Problem Statement

Multimodal Large Language Models (MLLMs) are increasingly deployed in safety-critical applications but remain vulnerable to backdoor attacks. In these attacks, adversaries poison the training data to inject malicious behaviors (e.g., refusal to answer, jailbreaking, or malicious text injection) that are activated only by specific visual triggers.

While prior research has demonstrated the feasibility of such attacks, the underlying mechanisms remain opaque. Existing interpretability works focus on model capabilities, while backdoor research focuses on attack efficacy. There is a significant gap in understanding how and where multimodal backdoors are stored and activated within the MLLM architecture, particularly given that MLLMs differ structurally from text-only LLMs due to the inclusion of a projector (which aligns visual features with the LLM's text space).

2. Methodology: The ProjLens Framework

The authors propose ProjLens, an interpretability framework designed to deconstruct the lifecycle of multimodal backdoors specifically within the projector component of MLLMs. The framework operates across three distinct spaces:

A. Feature Space: Visual Trigger Probe (VTP)

• Goal: Determine if trigger patterns are disentangled in the latent visual representation.
• Method: A learnable binary classifier (VTP) is trained to distinguish between embeddings of clean images and images containing triggers, derived from the backdoored projector.
• Finding: Successful backdoors result in highly separable trigger features in the embedding space, whereas failed injections show low separability.

B. Weight Space: Singular Value Decomposition (SVD) & Neuron Analysis

• Goal: Trace how backdoor mechanisms are stored in the projector's weights.
• Method:
  • SVD: Analyzes the weight residuals ($\Delta W = W_{poisoned} - W_{clean}$) to identify spectral properties.
  • Neuron Attribution: Quantifies activation magnitude and frequency to identify "trigger neurons."
• Key Investigation: The authors test if backdoors can be removed or reconstructed by manipulating low-rank approximations of the weight residuals.

C. Embedding Space: Geometric Transformation Analysis

• Goal: Visualize how the backdoor steers visual tokens semantically.
• Method:
  • Computes the Projected Residual ($\Delta E$) between clean and poisoned embeddings for each image token.
  • Performs SVD on $\Delta E$ to identify a Universal Drift Vector.
  • Uses LogitLens to decode the semantic meaning of this drift vector.
  • Analyzes the correlation between the drift magnitude and the input image feature norms.

3. Key Contributions & Findings

Contribution 1: The Projector is the Critical Attack Surface

The paper establishes that fine-tuning only the projector (while freezing the visual encoder and LLM backbone) is sufficient to inject high-success-rate backdoors. This creates a distinct vulnerability bottleneck compared to text-only LLMs where backdoors often reside in the LLM weights.

Contribution 2: The "Projector Weight Paradox" (Low-Rank Structure)

Contrary to the intuition that backdoors require specific "trigger neurons" or full-rank weight updates:

• Paradox 1: The overall weight updates ($\Delta W$) appear spectrally diffuse and full-rank, lacking dominant singular values.
• Paradox 2: Despite the diffuse appearance, the critical backdoor parameters are encoded within a strictly low-rank subspace.
  • Evidence: Removing the top-$k$ (e.g., $k=1$) singular components of the weight residuals effectively mitigates the backdoor (restoring utility from ~6% to ~65-86%). Conversely, injecting only these low-rank components into a clean model reconstructs the backdoor (achieving high Attack Success Rates).
• Paradox 3: There are no dedicated "bad neurons." Neuron activation patterns for clean and poisoned inputs are nearly identical; the backdoor is not localized to specific neurons but is a global geometric shift.

Contribution 3: The "Trojan Projection Hypothesis" (Activation Mechanism)

The paper reveals the activation mechanism of multimodal backdoors:

• Universal Drift Vector: The backdoor creates a shared direction ($v_0$) in the embedding space that semantically steers representations toward the malicious target (e.g., the prefix "I'm sorry..." for refusal).
• Magnitude Scaling: The magnitude of this shift is determined by the left singular vector ($u_0$).
• Correlation with Feature Norm: There is a linear correlation ($r > 0.95$) between the shift magnitude and the L2 norm of the input image features.
  • Mechanism: The visual trigger perturbs the feature norms of specific tokens. Because the shift magnitude scales with the feature norm, poisoned samples (with altered norms) undergo a large semantic shift into the backdoor direction, while clean samples (with different norms) shift only slightly, retaining normal behavior.

4. Experimental Results

• Datasets & Models: Evaluated on LLaVA-1.5-7B with four backdoor types: Targeted Refusal, Malicious Injection, Perceptual Hijack, and Jailbreak.
• Attack Success Rate (ASR): Achieved high ASR (e.g., 91.8% for Refusal, 98.3% for Injection) using only 10% poisoned data.
• Utility Preservation: The backdoored models maintained high performance on benign tasks (MathVista, POPE) and even showed improved accuracy on clean datasets compared to the base model.
• Mitigation/Recovery:
  • Mitigation: Removing the rank-1 approximation of $\Delta W$ restored model utility to ~65-87% while reducing ASR to near zero.
  • Recovery: Injecting the rank-3 approximation of $\Delta W$ into a clean model reconstructed the backdoor with ASR > 75%.

5. Significance

• Mechanistic Understanding: ProjLens moves the field from black-box attack observation to white-box mechanistic understanding, revealing that multimodal backdoors rely on low-rank geometric shifts rather than specific neuron activations.
• Defense Strategy: The discovery of the low-rank structure provides a concrete, efficient defense strategy. Simple low-rank approximation of weight residuals can effectively sanitize models without retraining.
• Dual-Use Implications: While the findings enable better defense, they also reveal that attackers can design more efficient, stealthy backdoors by targeting the projector's low-rank subspace and manipulating feature norms, highlighting the need for robust norm-based detection mechanisms.

In summary, ProjLens demystifies MLLM backdoors by proving they function as a "Trojan Projection" that semantically steers embeddings based on input feature norms, encoded efficiently within a low-rank subspace of the projector.