Anchoring Bias: A Persistent Fairness Backdoor Attack against MLLMs under Continual Learning
PFBA (Persistent Fairness Backdoor Attack) is a novel attack that injects group-specific discrimination into Multimodal Large Language Models (MLLMs) that survives continual learning updates The attack uses two mechanisms: Latent Space Fairness Reinforcement (reshapes feature geometry by anchoring privileged-group representations while repelling/clustering targeted-group representations) and Continual Learning Simulation (iteratively optimizes triggers against simulated parameter drift) Naively
Analysis
TL;DR
- PFBA (Persistent Fairness Backdoor Attack) is a novel attack that injects group-specific discrimination into Multimodal Large Language Models (MLLMs) that survives continual learning updates
- The attack uses two mechanisms: Latent Space Fairness Reinforcement (reshapes feature geometry by anchoring privileged-group representations while repelling/clustering targeted-group representations) and Continual Learning Simulation (iteratively optimizes triggers against simulated parameter drift)
- Naively implanted backdoors typically degrade under continual learning, but PFBA maintains severe fairness disparities across multiple CL rounds
- The attack evades standard backdoor defenses while preserving model utility for privileged groups
- Code and data are publicly available, raising concerns about reproducibility of such attacks
Why It Matters
This research exposes a critical vulnerability in the deployment pipeline of MLLMs: fairness backdoors can persist through continual learning, which is how most production models are updated. For AI practitioners deploying MLLMs in high-stakes domains, this means standard backdoor defenses and periodic model updates may not be sufficient to guarantee fairness, requiring new evaluation and mitigation strategies.
Technical Details
- Latent Space Fairness Reinforcement: Reshapes the model's deep feature geometry by anchoring privileged-group representations to preserve task utility, while simultaneously repelling and clustering targeted-group representations to sustain discriminatory behavior
- Continual Learning Simulation: Iteratively optimizes the backdoor trigger against simulated parameter drift, ensuring the attack survives subsequent model updates during continual learning
- Target: Multimodal Large Language Models (MLLMs) deployed in high-stakes domains where fairness is a safety requirement
- Key finding: Prior work showed naive backdoors degrade under CL, but PFBA demonstrates that fairness-targeted backdoors can be made persistent through geometric manipulation of latent representations
- Evaluation: Extensive experiments show PFBA induces severe fairness disparities that persist across continual learning rounds while evading standard backdoor defenses
Industry Insight
- Organizations deploying MLLMs via continual learning pipelines must treat fairness as a persistent security concern, not a one-time alignment step; periodic updates could inadvertently reinforce or fail to remove embedded biases
- Standard backdoor detection and mitigation techniques are insufficient against fairness-targeted attacks that exploit the geometric structure of latent representations, necessitating fairness-specific defense mechanisms
- The public release of code and data lowers the barrier for reproducing such attacks, highlighting an urgent need for the community to develop robust, CL-resilient fairness verification tools before widespread deployment in sensitive domains
Disclaimer: The above content is generated by AI and is for reference only.