Architectural Backdoors Ride Along in Shared VLM Artifacts — No Data Poisoning, No Prompt Access, Zero Effect Until Triggered

arXiv 2607.25479·medium signalXBlueskyLinkedInCopy link

A paper posted 2026-07-28 (arXiv 2607.25479) demonstrates that a malicious model provider can embed dormant steering logic directly in a vision-language model's architecture definition via a trigger-gated additive modification of an intermediate representation. The attack requires no training-data poisoning, no control of downstream fine-tuning, and no deployment-time prompt modification: absent the trigger the modification reduces to zero and clean utility is preserved. Evaluated across multiple VLM families on visual QA, text-to-image generation, retrieval, and semantic response biasing, it compromises integrity, safety enforcement, and ranking fairness. The authors propose auditing the executable logic distributed with model artifacts rather than inspecting learned weights alone — a scan most teams pulling third-party checkpoints do not currently run.