TCAP: Tri-Component Attention Profiling for Unsupervised Backdoor Detection in MLLM Fine-Tuning

Fine-Tuning-as-a-Service (FTaaS) facilitates the customization of Multimodal Large Language Models (MLLMs) but introduces critical backdoor risks via poisoned data. Existing defenses either rely on supervised signals or fail to generalize across diverse trigger types and modalities. In this work, we uncover a universal backdoor fingerprint—attention allocation divergence—where poisoned samples disrupt the balanced attention distribution across three functional components: system instructions, vision inputs, and user textual queries, regardless of trigger morphology. Motivated by this insight, we propose Tri-Component Attention Profiling (TCAP), an unsupervised defense framework to filter backdoor samples. TCAP decomposes cross-modal attention maps into the three components, identifies trigger-responsive attention heads via Gaussian Mixture Model (GMM) statistical profiling, and isolates poisoned samples through EM-based vote aggregation. Extensive experiments across diverse MLLM architectures and attack methods demonstrate that TCAP achieves consistently strong performance, establishing it as a robust and practical backdoor defense in MLLMs.

Organizations often customize multimodal LLM systems by fine-tuning them on user-provided data. This makes customization easier, but it also creates a security risk: an attacker can hide a small number of poisoned examples in the training data. These examples can implant a backdoor, so the model behaves normally in everyday use but produces an attacker-chosen response when a secret trigger appears. Many existing defenses need clean reference data, labels, or extra tools, which are often unavailable in third-party fine-tuning services. We found that poisoned examples leave a stable internal trace: they disturb how the model distributes attention among the system instructions, the image, and the user’s question. Based on this finding, we propose TCAP, an unsupervised method for detecting and removing poisoned training examples. TCAP profiles these three parts of the model’s attention, identifies attention heads that react abnormally to backdoor behavior, and combines their signals to flag suspicious samples. It works without clean data, human labels, or external supervision. Across multiple models, datasets, and visual or textual triggers, TCAP removes diverse backdoors while largely preserving normal performance. This can help make customized multimodal AI safer and more reliable in applications where mistakes could have serious consequences.