ML Security PapersDF-LoGiT: Data-Free Logic-Gated Backdoor Attacks in Vision Transformers
Xiaozuo Shen 1, Yifei Cai 2, Rui Ning 3, Chunsheng Xin 2, Hongyi Wu 1
Published on arXiv
2602.03040
Model Poisoning
OWASP ML Top 10 — ML10
Key Finding
Achieves near-100% attack success rate with negligible clean accuracy degradation while remaining robust against both classical and ViT-specific backdoor defenses, without access to any training data.
DF-LoGiT
Novel technique introduced
The widespread adoption of Vision Transformers (ViTs) elevates supply-chain risk on third-party model hubs, where an adversary can implant backdoors into released checkpoints. Existing ViT backdoor attacks largely rely on poisoned-data training, while prior data-free attempts typically require synthetic-data fine-tuning or extra model components. This paper introduces Data-Free Logic-Gated Backdoor Attacks (DF-LoGiT), a truly data-free backdoor attack on ViTs via direct weight editing. DF-LoGiT exploits ViT's native multi-head architecture to realize a logic-gated compositional trigger, enabling a stealthy and effective backdoor. We validate its effectiveness through theoretical analysis and extensive experiments, showing that DF-LoGiT achieves near-100% attack success with negligible degradation in benign accuracy and remains robust against representative classical and ViT-specific defenses.
Key Contributions
- DF-LoGiT: a truly data-free, training-free, architecture-preserving backdoor attack on ViTs via direct weight editing — no clean or poisoned data required
- Logic-gated compositional trigger that exploits ViT's native multi-head attention by rewriting Q/K/V/O projections to create an attention-separable response written into a reserved [CLS] embedding dimension
- Dedicated [CLS] residual path to preserve trigger evidence across intermediate blocks, protecting it from global attention mixing and enabling reliable gated payload injection in the final block
🛡️ Threat Analysis
Proposes a backdoor attack that embeds hidden, targeted malicious behavior in ViT model weights via direct parameter editing. The backdoor activates only when a specific compositional trigger is present and is invisible during normal inference — canonical ML10 trojan injection. Although framed as a supply-chain scenario, the technical contribution is the weight-editing backdoor technique itself (DF-LoGiT), not a supply-chain compromise method, per the distinction in the guidelines.