Backdoor Directions in Vision Transformers

TL;DR

This paper uncovers a specific trigger direction in Vision Transformers that corresponds to backdoor features, enabling diagnosis and detection of backdoor attacks through mechanistic interpretability.

Contribution

It introduces a linear trigger direction in ViT activations, providing a new diagnostic tool for understanding and detecting backdoor attacks in vision models.

Findings

Identified a trigger direction in ViT activations linked to backdoor features

Demonstrated causal influence of this direction on backdoor behavior

Proposed a weight-based detection scheme for stealthy triggers

Abstract

This paper investigates how Backdoor Attacks are represented within Vision Transformers (ViTs). By assuming knowledge of the trigger, we identify a specific ``trigger direction'' in the model's activations that corresponds to the internal representation of the trigger. We confirm the causal role of this linear direction by showing that interventions in both activation and parameter space consistently modulate the model's backdoor behavior across multiple datasets and attack types. Using this direction as a diagnostic tool, we trace how backdoor features are processed across layers. Our analysis reveals distinct qualitative differences: static-patch triggers follow a different internal logic than stealthy, distributed triggers. We further examine the link between backdoors and adversarial attacks, specifically testing whether PGD-based perturbations (de-)activate the identified trigger mechanism. Finally, we propose a data-free, weight-based detection scheme for stealthy-trigger attacks. Our findings show that mechanistic interpretability offers a robust framework for diagnosing and addressing security vulnerabilities in computer vision.