Technical Summary: EntropyScan

Problem Statement

Large Vision-Language Models (LVLMs) are increasingly distributed as third-party checkpoints via Model-as-a-Service (MaaS) paradigms, creating significant security risks. While existing defense mechanisms primarily focus on sample-level detection (filtering poisoned training data or perturbing inputs during inference), they generally require access to the original training dataset or knowledge of specific attack triggers. A critical gap remains in model-level detection: determining whether a finalized, third-party checkpoint contains a hidden backdoor without prior knowledge of the trigger patterns, target responses, or the poisoned training data. The opacity of the training process and the subtle embedding of triggers within the vast weight space make this task particularly challenging.

Methodology: EntropyScan

The authors propose EntropyScan, a lightweight, trigger-agnostic framework designed to detect backdoored LVLMs by analyzing structural anomalies in visual attention. The core hypothesis is that backdoor injection disrupts the cross-modal alignment mechanisms within the model, leading to measurable deviations in visual attention allocation even on benign inputs.

The methodology proceeds in three stages:

1. Visual Attention Entropy Extraction:

   • The method focuses on the initial layer (Layer-0) of the Large Language Model (LLM) component, where visual tokens first integrate with textual representations.
   • It extracts visual attention weights from the self-attention modules. Specifically, it isolates the attention probability vector assigned to visual tokens ($\mathcal{V}$) for the last token of the input sequence.
   • To decouple the internal distribution pattern from the overall attention magnitude, the authors perform modality-wise renormalization to create a conditional probability distribution $P_{\mathcal{V}}$.
   • Tsallis entropy ($H_q$) is calculated on this distribution. Tsallis entropy is chosen over Shannon or Rényi entropy because its non-extensive parameter ($q$) provides enhanced sensitivity to the "tail" of the distribution, making it more effective at detecting subtle structural anomalies induced by stealthy backdoors.

2. Reference-Anchored Z-Score Normalization:

   • To establish a baseline, the system utilizes a clean, benign reference model ($M_{ref}$) with the same architecture as the suspect model ($M_{target}$) and a small clean validation dataset ($D_{val}$).
   • Statistics (mean $\mu_{ref}$ and standard deviation $\sigma_{ref}$) are computed from the entropy values of the reference model.
   • The entropy values of the suspect model are then normalized using these reference statistics to calculate a Z-score. This aligns the suspect model's entropy scale with the benign distribution, allowing for the identification of systematic deviations.

3. Detection Decision:

   • The method computes an anomaly score $s(x)$ for each sample based on the absolute deviation of its Z-score from the reference median.
   • The final decision is made by calculating the Area Under the Receiver Operating Characteristic (AUC) curve between the anomaly scores of the suspect model and the reference model.
   • If the AUC exceeds a predefined threshold ($\tau = 0.8$), the model is classified as backdoored.

Key Contributions

1. Discovery of Structural Anomalies: The authors identify that backdoor injections in LVLMs cause distinct structural perturbations in cross-modal alignment, manifesting as measurable shifts in visual attention entropy on benign inputs.
2. First Model-Level Detection Framework: EntropyScan is presented as the first method specifically designed for model-level backdoor detection in LVLMs. It operates without requiring access to triggers, poisoned training data, or active intervention during inference.
3. Lightweight and Efficient: The framework is highly efficient, requiring only forward inference. It achieves high accuracy using a small validation set (200 images) and operates in seconds per model checkpoint.

Experimental Results

The authors evaluated EntropyScan on two LVLM architectures (LLaVA-1.5-7B and Otter-3B) across three advanced attack scenarios: ShadowCast, ImgTrojan, and VL-Trojan.

• Detection Performance: EntropyScan achieved an average F1 score of 98.5% and an AUC of 96.6% across all scenarios.
  • It achieved perfect detection (AUC = 1.000) for VL-Trojan attacks across all tested vision backbones.
  • It significantly outperformed the baseline Activation Clustering (AC) method, particularly against ShadowCast attacks where AC failed (Recall = 0) while EntropyScan achieved a Recall of 0.9535.
• Robustness: The method demonstrated robustness against adaptive attacks where adversaries attempted to regularize the visual entropy to match benign distributions; such attempts significantly degraded the attack success rate (ASR).
• Efficiency: The average inspection time was 4.37 seconds per model checkpoint on four NVIDIA Tesla V100 GPUs.
• Ablation Studies:
  • Layer Sensitivity: The initial layer (Layer-0) was confirmed as the optimal detection probe, with detection signals decaying rapidly in deeper layers.
  • Entropy Measure: Tsallis entropy ($q=2$) outperformed Shannon and Rényi entropy, particularly for subtle global disruption attacks.
  • Data Efficiency: The detection performance remained stable across different validation set sizes and different sources of clean images (e.g., COCO2017 vs. Object365).

Significance and Claims

The paper claims that EntropyScan provides a practical paradigm for the security inspection of third-party LVLM checkpoints. By identifying a universal signature of infection (entropy deviation in cross-modal attention) rather than relying on trigger-specific artifacts, the method addresses the critical challenge of detecting backdoors in finalized models where trigger knowledge is unavailable. The authors emphasize that their approach enables model-level auditing without compromising the model's utility or requiring retraining, thereby promoting accessible security practices for the rapidly expanding ecosystem of open-source and third-party LVLMs.