Beyond Attack Success Rate: Examining Trigger Leakage in Vision-Language Agentic Systems

• URL: http://arxiv.org/abs/2606.12586v1
• Date: Wed, 10 Jun 2026 18:33:52 GMT
• Title: Beyond Attack Success Rate: Examining Trigger Leakage in Vision-Language Agentic Systems
• Abstract summary: Vision-Language Agentic Systems (VLAS) connect visual perception to planning, tool use, and physical actions.<n>Backdoor-type triggers can propagate through both decision pipelines and their connected interfaces.
• Score: 36.30772806498619
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Vision-Language Agentic Systems (VLAS) connect visual perception to planning, tool use, and physical actions. This means backdoor-type triggers can propagate through both decision pipelines and their connected interfaces, thus making visual backdoors a system-level threat. Current evaluations on such backdoors focus on clean accuracy and attack success rate (ASR), metrics that capture whether a trigger works, but not whether an attack is actually "precise" -- i.e. whether it triggers hidden behaviors only when intended. In this work, we formalize the failure of trigger precision as "trigger leakage": inputs that are visually or semantically close to the intended trigger and therefore inadvertently activate the attacker-specified behavior. To quantify this leakage, we introduce Neighbor Leakage Rate (NLR). Our experiments show that at a 3% poisoning ratio, icon and text triggers remain robust to common visual transformations, but their neighboring variants leak heavily, with NLR reaching 0.996 (icon) and 0.944 (text). Using textual triggers as a controlled probe, we show that standard fine-tuning learns a broad activation region rather than an exact trigger condition, causing neighboring strings to invoke the malicious behavior even when the exact trigger is absent. Adding edit-distance-one hard-negative samples during training substantially narrows this activation region and reduces leakage, including in image-editing and embodied-manipulation workflows, where leaked triggers can propagate into executable programs and action sequences.

Related papers

• TrapVLA: Trapping Vision-Language-Action Models in Configured Failure Modes [65.10128145059127]
  This work introduces Configured Failure Trapping, a novel backdoor attack task against Vision-Language-Action (VLA) models.<n>We propose an effective data engine for synthesizing high-quality target trajectories and an automated suite for measuring configured-failure fidelity.<n>Experiments show that TrapVLA effectively injects configured failure modes into VLA models while largely preserving performance on clean data.
  arXiv  Detail & Related papers  (2026-08-27T03:44:49Z)
• Once Poisoned, Arbitrarily Controlled: A Programmable Backdoor in VLMs [23.18705886598491]
  Vision-language model (VLM) backdoors are usually treated as static vulnerabilities.<n>We show that a single poisoning phase can implant a programmable backdoor into a VLM.<n>A proposed any-to-any caption-control paradigm decouples post-training target selection from poisoning.
  arXiv  Detail & Related papers  (2026-08-11T14:25:29Z)
• AutoTrace: From Patches to Triggers via Agentic Interprocedural Exploration [6.39392731596656]
  Given a vulnerability-fixing commit, trigger localization asks which specific statement turns the vulnerable program state into a concrete unsafe operation.<n>We present AutoTrace, an agentic pipeline that localizes vulnerability triggers by exploring a code property graph layer by layer.<n>Agents never accept a trigger on their own authority; every reported trigger is backed by explicit evidence drawn from the graph.
  arXiv  Detail & Related papers  (2026-07-13T18:21:42Z)
• Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors [48.881343993730844]
  Safety-aligned large language models (LLMs) are increasingly deployed in real-world pipelines.<n> adversaries can distribute backdoored checkpoints that behave normally under standard evaluation but jailbreak when a hidden trigger is present.<n>Recent post-hoc weight-editing methods offer an efficient approach to injecting such backdoors.
  arXiv  Detail & Related papers  (2026-04-14T06:48:33Z)
• Backdoor Directions in Vision Transformers [56.382912038371046]
  This paper investigates how Backdoor Attacks are represented within Vision Transformers (ViTs)<n>We identify a specific trigger direction'' in the model's activations that corresponds to the internal representation of the trigger.<n>Using this direction as a diagnostic tool, we trace how backdoor features are processed across layers.
  arXiv  Detail & Related papers  (2026-03-11T14:13:48Z)
• Backdoor Attacks on Open Vocabulary Object Detectors via Multi-Modal Prompt Tuning [5.0734761482919115]
  Open-vocabulary object detectors (OVODs) unify vision and language to detect arbitrary object categories based on text prompts.<n>We conduct the first study of backdoor attacks on OVODs and reveal a new attack surface introduced by prompt tuning.
  arXiv  Detail & Related papers  (2025-11-16T19:05:31Z)
• Visual Backdoor Attacks on MLLM Embodied Decision Making via Contrastive Trigger Learning [89.1856483797116]
  We introduce BEAT, the first framework to inject visual backdoors into MLLM-based embodied agents.<n>Unlike textual triggers, object triggers exhibit wide variation across viewpoints and lighting, making them difficult to implant reliably.<n>BEAT achieves attack success rates up to 80%, while maintaining strong benign task performance.
  arXiv  Detail & Related papers  (2025-10-31T16:50:49Z)
• Twin Trigger Generative Networks for Backdoor Attacks against Object Detection [14.578800906364414]
  Object detectors, which are widely used in real-world applications, are vulnerable to backdoor attacks. Most research on backdoor attacks has focused on image classification, with limited investigation into object detection. We propose novel twin trigger generative networks to generate invisible triggers for implanting backdoors into models during training, and visible triggers for steady activation during inference.
  arXiv  Detail & Related papers  (2024-11-23T03:46:45Z)
• BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIP [55.33331463515103]
  BadCLIP is built on a novel and effective mechanism in backdoor attacks on CLIP. It consists of a learnable trigger applied to images and a trigger-aware context generator, such that the trigger can change text features via trigger-aware prompts.
  arXiv  Detail & Related papers  (2023-11-26T14:24:13Z)
• Versatile Backdoor Attack with Visible, Semantic, Sample-Specific, and Compatible Triggers [38.67988745745853]
  We propose a novel trigger called the textbfVisible, textbfSemantic, textbfSample-language, and textbfCompatible (VSSC) trigger. VSSC trigger achieves effective, stealthy and robust simultaneously, which can also be effectively deployed in the physical scenario using corresponding objects.
  arXiv  Detail & Related papers  (2023-06-01T15:42:06Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.