TraceGuard: Adaptive Multimodal Poison Filtering through Cross-Feature Rank Agreement
TraceGuard filters poisoned image-text training data via rank agreement among six corpus-level features, removing 98.4% of poison and 5.4% of clean examples.
Researchers propose TraceGuard, an adaptive rank-based poison filtering method for multimodal training corpora that uses agreement among six corpus-level features (cross-modal neighborhoods, recurring text, text-span erasure effects) without training the victim model. Across 19 attack configurations covering image-text learning, vision-language model fine-tuning, and encoder-transfer tests, it removes on average 98.4% of poisoned and 5.4% of clean examples, with residual attack metric at most 1% in 13 configurations. Stress tests also expose detection failures under adaptive attacks and over-removal on poison-free corpora.
- Removes 98.4% of poisoned examples while discarding only 5.4% clean across 19 attack configs
- Adaptive threshold tunes removal per corpus without knowing attack or poison rate
- Residual attack metric at most 1% in 13 configurations after filtered training
- Stress tests identify failures under adaptive attacks and false removal on clean corpora
From the original article
1 min read at arxiv.orgMultimodal training relies on image-text corpora collected from external sources, creating opportunities for attackers to poison the data. Stealthy attacks can preserve plausible image-text pairs while concealing the differences used by detectors, so apparently clean data can still redirect the trained model. We therefore ask which properties a poison set must preserve for the attack to remain effective.
By Haoyang Li · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.