EntropyScan: Towards Model-level Backdoor Detection in LVLMs via Visual Attention Entropy

TL;DR

EntropyScan is a novel, lightweight method that detects backdoored LVLMs by analyzing visual attention entropy deviations, without relying on training data or triggers.

Contribution

It introduces a trigger-agnostic, model-level backdoor detection technique based on visual attention entropy analysis in LVLMs.

Findings

Achieves an average F1 score of 98.5% in backdoor detection.

Attains an AUC of 96.6% across multiple architectures and attack scenarios.

Effectively identifies backdoored models by analyzing attention distribution anomalies.

Abstract

Large Vision-Language Models (LVLMs) have demonstrated remarkable capabilities across various tasks, yet they remain vulnerable to backdoor attacks. Existing defense methods predominantly focus on sample-level defense, which relies on the knowledge of training data or triggers. However, identifying whether a given model is backdoored remains a critical but unexplored task. To fill this gap, we propose EntropyScan, a lightweight and trigger-agnostic method for model-level backdoor detection in LVLMs. We first observe that backdoor injection disrupts the cross-modal alignment, resulting in pronounced structural anomalies in visual attention allocation on benign samples. Based on this insight, EntropyScan detects the backdoor models by quantifying such attention deviations. Specifically, it extracts visual attention distributions from the initial layers of the Large Language Model (LLM) and applies Tsallis entropy to capture these structural distortions. By employing a reference-anchored Z-score normalization on a small set of benign samples, it effectively identifies the backdoored model. Extensive experiments across two LVLMs architectures and three advanced attack scenarios show that EntropyScan achieves an F1 score of 98.5% in average and an AUC of 96.6%. Our code will be publicly available soon.