ML Security PapersWhen One Modality Rules Them All: Backdoor Modality Collapse in Multimodal Diffusion Models
Qitong Wang 1, Haoran Dai 2, Haotian Zhang 3, Christopher Rasmussen 1, Binghui Wang 2
Published on arXiv
2603.06508
Model Poisoning
OWASP ML Top 10 — ML10
Key Finding
Backdoor attacks in multimodal diffusion models consistently collapse to single-modality dominance, with cross-modal interaction being negligible or negative — contradicting the assumption that multi-modal triggers yield synergistic vulnerabilities.
Trigger Modality Attribution (TMA) / Cross-Trigger Interaction (CTI)
Novel technique introduced
While diffusion models have revolutionized visual content generation, their rapid adoption has underscored the critical need to investigate vulnerabilities, e.g., to backdoor attacks. In multimodal diffusion models, it is natural to expect that attacking multiple modalities simultaneously (e.g., text and image) would yield complementary effects and strengthen the overall backdoor. In this paper, we challenge this assumption by investigating the phenomenon of Backdoor Modality Collapse, a scenario where the backdoor mechanism degenerates to rely predominantly on a subset of modalities, rendering others redundant. To rigorously quantify this behavior, we introduce two novel metrics: Trigger Modality Attribution (TMA) and Cross-Trigger Interaction (CTI). Through extensive experiments across diverse training configurations in multimodal conditional diffusion, we consistently observe a ``winner-takes-all'' dynamic in backdoor behavior. Our results reveal that (1) attacks often collapse into subset-modality dominance, and (2) cross-modal interaction is negligible or even negative, contradicting the intuition of synergistic vulnerability. These findings highlight a critical blind spot in current assessments, suggesting that high attack success rates often mask a fundamental reliance on a subset of modalities. This establishes a principled foundation for mechanistic analysis and future defense development.
Key Contributions
- Identifies and formalizes 'Backdoor Modality Collapse' — the phenomenon where multimodal backdoors degenerate to rely on a single modality rather than exploiting modalities jointly
- Introduces Trigger Modality Attribution (TMA) and Cross-Trigger Interaction (CTI) as novel metrics to quantify modality dominance in backdoor behavior
- Demonstrates a consistent 'winner-takes-all' dynamic across diverse multimodal diffusion training configurations, showing high attack success rates mask single-modality reliance
🛡️ Threat Analysis
Paper directly analyzes backdoor/trojan behavior in multimodal diffusion models, studying how trigger mechanisms degenerate across modalities — the entire contribution centers on characterizing model poisoning (backdoor) dynamics.