TraceGuard: Adaptive Multimodal Poison Filtering through Cross-Feature Rank Agreement
TraceGuard filters poisoned image-text training data via rank agreement among six corpus-level features, removing 98.4% of poison and 5.4% of clean examples.
Researchers propose TraceGuard, an adaptive rank-based poison filtering method for multimodal training corpora that uses agreement among six corpus-level features (cross-modal neighborhoods, recurring text, text-span erasure effects) without training the victim model. Across 19 attack configurations covering image-text learning, vision-language model fine-tuning, and encoder-transfer tests, it removes on average 98.4% of poisoned and 5.4% of clean examples, with residual attack metric at most 1% in 13 configurations. Stress tests also expose detection failures under adaptive attacks and over-removal on poison-free corpora.
- Removes 98.4% of poisoned examples while discarding only 5.4% clean across 19 attack configs
- Adaptive threshold tunes removal per corpus without knowing attack or poison rate
- Residual attack metric at most 1% in 13 configurations after filtered training
- Stress tests identify failures under adaptive attacks and false removal on clean corpora
Full article237 words · extracted from arxiv.org · click to collapse
Multimodal training relies on image-text corpora collected from external sources, creating opportunities for attackers to poison the data. Stealthy attacks can preserve plausible image-text pairs while concealing the differences used by detectors, so apparently clean data can still redirect the trained model. We therefore ask which properties a poison set must preserve for the attack to remain effective. A small poison set must still exert enough collective influence during training to induce the attacker's target behavior. We analyze this influence in terms of how often an attack pattern occurs and how strongly the examples carrying it jointly affect the model. This analysis motivates six corpus-level features that examine cross-modal neighborhoods, recurring text, and changes after text-span erasure without training the victim model. We introduce TraceGuard, an adaptive rank-based filtering method that uses agreement among complementary feature rankings to identify suspicious examples. It refines the selected set through shared patterns and adapts the removal threshold to each corpus without knowing the attack or poison rate. Across 19 attack configurations spanning image-text learning, generative vision-language model fine-tuning, and encoder-transfer tests, TraceGuard removes an average of 98.4% of poisoned examples and 5.4% of clean examples. After training on the filtered corpora, the residual attack metric is at most 1% in 13 configurations. Matched-removal controls and ablations support the contributions of sample selection and adaptive removal. Stress tests also identify detection failures under adaptive attacks and unnecessary removal on poison-free corpora.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.29099