Badpatches: routing-aware backdoor attacks on vision mixture-of-experts

Summary

Researchers introduce BadPatches, a routing-aware backdoor attack for patch-based mixture-of-experts (pMoE) vision models and MoE-based vision transformers. The attack places triggers inside targeted image patches so they reach the active experts, achieving over 83.2% attack success rate at a 0.01% poisoning rate and 96.8% at 0.05%, with clean accuracy preserved. The attack remains effective in gray-box settings, and the authors find that fine-pruning alone does not remove it, requiring a fine-tuning stage.

Mitigation

Fine-pruning alone is insufficient to mitigate the attack; successful backdoor removal strictly requires the fine-tuning stage. The authors call for routing-aware defenses.

Topics

• Adversarial machine learning

Related items

• MediumBackdooring Open-Weight AI ModelsSimilar attack · Schneier on Security
• InfoDPOison-VL: Clean Preference Poisoning in Vision-Language Direct Preference OptimizationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoFedGraph: Defending Federated Large Language Model Fine-Tuning Against Backdoor Attacks via Graph-Based AggregationSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoRFLDefense: robust federated learning defense against targeted attacksSimilar attack · OpenAlex (peer-reviewed AI security)
• InfoSpace Over Statistic, Retraining Over Ranking: Auditing Training Labels Under Label-Only BackdoorsSimilar attack · Arxiv (cs.RO + cs.CV security)