Multimodal Backdoor Attack on VLMs for Autonomous Driving via Graffiti and Cross-Lingual Triggers

TL;DR

This paper presents a novel backdoor attack on visual language models for autonomous driving, using naturalistic graffiti and cross-lingual triggers to achieve high attack success with minimal poisoning.

Contribution

It introduces two realistic trigger methods that are covert and stable, demonstrating effective backdoor attacks on DriveVLM without degrading model performance.

Findings

Achieves 90% attack success rate with only 10% poisoning ratio.

Backdoor triggers do not impair, and may even improve, model performance on clean tasks.

Reveals security vulnerabilities in self-driving multimodal systems.

Abstract

Visual language model (VLM) is rapidly being integrated into safety-critical systems such as autonomous driving, making it an important attack surface for potential backdoor attacks. Existing backdoor attacks mainly rely on unimodal, explicit, and easily detectable triggers, making it difficult to construct both covert and stable attack channels in autonomous driving scenarios. GLA introduces two naturalistic triggers: graffiti-based visual patterns generated via stable diffusion inpainting, which seamlessly blend into urban scenes, and cross-language text triggers, which introduce distributional shifts while maintaining semantic consistency to build robust language-side trigger signals. Experiments on DriveVLM show that GLA requires only a 10\% poisoning ratio to achieve a 90\% Attack Success Rate (ASR) and a 0\% False Positive Rate (FPR). More insidiously, the backdoor does not weaken the model on clean tasks, but instead improves metrics such as BLEU-1, making it difficult for traditional performance-degradation-based detection methods to identify the attack. This study reveals underestimated security threats in self-driving VLMs and provides a new attack paradigm for backdoor evaluation in safety-critical multimodal systems.