Metraipolis › archive › dc_fbe29fa8d455

TraceGuard: Adaptive Multimodal Poison Filtering through Cross-Feature Rank Agreement — arXiv:2609.29099

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.29099
License (as archived): CC0-1.0
Archived: 2026-10-08T04:53:19.932Z
SHA-256 of the archived text: 719e8e58287a4d2dcb81258ae4579672ac9a46eb9cb937df1bdd4f0c3c14cc71
Stable URL of this page: https://metraipolis.com/documento/dc_fbe29fa8d455

How to cite

TraceGuard: Adaptive Multimodal Poison Filtering through Cross-Feature Rank Agreement — arXiv:2609.29099 — arXiv (en), https://arxiv.org/abs/2609.29099 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_fbe29fa8d455 (Metraipolis archive dc_fbe29fa8d455, sha256 719e8e58287a4d2dcb81258ae4579672ac9a46eb9cb937df1bdd4f0c3c14cc71)

BibTeX

@misc{dcfbe29fa8d455,
  title = {TraceGuard: Adaptive Multimodal Poison Filtering through Cross-Feature Rank Agreement — arXiv:2609.29099},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.29099},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_fbe29fa8d455; sha256 719e8e58287a4d2dcb81258ae4579672ac9a46eb9cb937df1bdd4f0c3c14cc71},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.29099. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Multimodal training relies on image-text corpora collected from external sources, creating opportunities for attackers to poison the data. Stealthy attacks can preserve plausible image-text pairs while concealing the differences used by detectors, so apparently clean data can still redirect the trained model. We therefore ask which properties a poison set must preserve for the attack to remain effective. A small poison set must still exert enough collective influence during training to induce the attacker's target behavior. We analyze this influence in terms of how often an attack pattern occurs and how strongly the examples carrying it jointly affect the model. This analysis motivates six corpus-level features that examine cross-modal neighborhoods, recurring text, and changes after text-span erasure without training the victim model. We introduce TraceGuard, an adaptive rank-based filtering method that uses agreement among complementary feature rankings to identify suspicious examples. It refines the selected set through shared patterns and adapts the removal threshold to each corpus without knowing the attack or poison rate. Across 19 attack configurations spanning image-text learning, generative vision-language model fine-tuning, and encoder-transfer tests, TraceGuard removes an average of 98.4% of poisoned examples and 5.4% of clean examples. After training on the filtered corpora, the residual attack metric is at most 1% in 13 configurations. Matched-removal controls and ablations support the contributions of sample selection and adaptive removal. Stress tests also identify detection failures under adaptive attacks and unnecessary removal on poison-free corpora.

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-09-25 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR) ; Machine Learning (cs.LG).
Pagina del lavoro: https://arxiv.org/abs/2609.29099 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-08T04:30:43.813Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-09-25?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).