Programmable VLM Backdoor: One Poisoning Phase Lets an Attacker Pick Unseen Caption Targets at Inference Time

arXiv 2608.10959·medium signalXBlueskyLinkedInCopy link

Existing vision-language backdoors are static — one-to-one or N-to-N bindings between triggers and a finite target set fixed before victim training. This work shows a single poisoning phase can implant a programmable backdoor, letting an attacker choose previously unseen target-caption semantics at inference time and synthesize matching stealthy triggers on demand, decoupling target selection from poisoning entirely. The authors report high any-to-any caption-control success, preserved clean-model utility, and effectiveness against several classical backdoor defenses; the abstract does not disclose specific success-rate figures or the model names tested, so treat the magnitude as unquantified pending the full paper.