跳转至

锚定偏差：面向持续学习的多模态大语言模型持久性公平后门攻击

文章背景与核心概要

随着多模态大语言模型（MLLMs）在医疗、金融等对公平性要求极高的关键领域的广泛应用，确保模型输出的公正性已成为核心安全诉求。然而，在实际应用中，模型需要通过持续学习（CL）不断更新以适应新的任务和数据分布，这导致传统方式植入的后门往往会随着模型更新而发生退化。为了探究并填补这一安全空白，本文首次研究了持续学习环境中针对MLLM的公平性定向后门攻击，并提出了“持久性公平后门攻击（PFBA）”。

PFBA通过两项核心机制实现了对模型深度特征几何形状的重塑与对持续学习参数漂移的对抗：首先是“潜在空间公平强化”，它通过锚定特权群体表示来保持模型整体效用，同时排斥并聚类目标群体表示以确保持续歧视；其次是“持续学习 simulation”，通过迭代优化触发器以抵抗模拟的参数漂移，从而保证后门在未来的模型更新中依然坚挺。大量的实验证明，PFBA能够引发严重且持久的公平性差距，不仅能经受住多轮持续学习的考验，还能有效规避现有的标准后门防御手段。

摘要

多模态大语言模型（MLLMs）正日益被部署在对公平性有严格安全要求的高风险领域。在实践中，这些模型通常通过持续学习（CL）进行不断更新，以适应不断演进的任务和数据分布。先前的工作表明，后门攻击可以通过隐藏的触发器操纵MLLM的响应，但简单植入的后门会在模型经历后续的持续学习更新时发生退化。尽管公平性已成为MLLM部署的核心关切，但由后门引起的公平性违规是否能够在持续学习中存活仍未得到探索，这导致两个关键问题悬而未决：(1) 后门是否能够可靠地在MLLM中引发公平性违规，以及 (2) 这种针对公平性的后门是否能够在持续学习过程中持续存在。我们通过提出持久性公平后门攻击（PFBA）来向MLLM中注入持久且群体特定的歧视，从而弥补这一研究空白。具体而言，PFBA通过两种新颖的机制实现这一点：潜在空间公平强化通过锚定特权群体表示以保持效用，同时排斥并聚类目标群体表示以维持歧视，从而重塑模型的深层特征几何形状；持续学习模拟则针对模拟参数漂移迭代优化触发器，以确保后门在未来的更新中保持持久性。大量实验表明，PFBA会引发严重的公平性差距，这些差距在持续学习轮次中持续存在，并能规避标准的后门防御。

Multimodal Large Language Models (MLLMs) are increasingly deployed in high-stakes domains where fairness is a critical safety requirement. In practice, these models are continually updated through continual learning (CL) to adapt to evolving tasks and data distributions. Prior work has shown that backdoor attacks can manipulate MLLM responses through hidden triggers, but naively implanted backdoors degrade as models undergo subsequent updates of CL. Although fairness has emerged as a central concern for MLLM deployment, whether backdoor-induced fairness violations can survive CL remains unexplored, leaving two critical questions unanswered: (1) whether a backdoor can reliably induce fairness violations in MLLMs, and (2) whether such fairness-targeted backdoors can persist through continual learning. We bridge this gap by proposing Persistent Fairness Backdoor Attack (PFBA) to inject persistent and group-specific discrimination into MLLMs. Specifically, PFBA achieves this through two novel mechanisms. The Latent Space Fairness Reinforcement reshapes the model's deep feature geometry by anchoring privileged-group representations to preserve utility while repelling and clustering targeted-group representations to sustain discrimination, and the Continual Learning Simulation iteratively optimizes the trigger against simulated parameter drift to ensure backdoor persistence across future updates. Extensive experiments demonstrate that PFBA induces severe fairness disparities that persist across continual learning rounds, evading standard backdoor defenses.

全文与参考链接