揭示功能融合：动态提示架构中的一类新型策略后门
Exposing Functional Fusion: A New Class of Strategic Backdoor in Dynamic Prompt Architectures
揭示了动态视觉提示架构（如VPT）中一种新的后门攻击范式——功能融合，即恶意逻辑与良性任务效用紧密耦合于同一稀疏参数核心，导致剪枝防御必然破坏良性性能；这对设计鲁棒的参数高效微调方法和防御策略具有直接启发。
原文依据 This dynamic architecture enables Functional Fusion: an emergent phenomenon where malicious logic and benign task utility are tightly fused into the same sparse, high-magnitude parameter core.
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论现有的基于骨干网络覆盖式全量微调的ViT后门攻击计算成本高昂且会导致性能下降。这迫使攻击者转向视觉参数高效微调（PEFT）范式，该范式以基于适配器（如LoRA）和基于提示词（如VPT）的方法为主导。虽然适配器的安全性已得到初步研究，但蓬勃发展的基于提示词的生态系统所面临的风险仍严重缺乏探索。我们填补了这一关键空白，揭示了VPT向动态和上下文感知架构的演进如何促成一种更为危险且新兴的威胁。尽管这些动态模块能带来更优的良性性能，但该漏洞依然存在。我们提出了VIPER，一个基于轻量级动态视觉提示词生成器（VPG）的攻击框架，用以证明该漏洞。关键在于，这种动态架构实现了功能融合：一种新兴现象，其中恶意逻辑与良性任务效用紧密融合到同一个稀疏、高幅值的参数核心中。这种融合造成了严峻的“人质”困境，因为剪枝攻击必然破坏良性性能。综合评估表明，VIPER有效解决了攻击者的三难困境：VIPER不仅在干净数据上达到最优性能，而且在VPG模块被剪枝90%的情况下仍保持接近100%的攻击成功率（此时LoRA攻击崩溃），同时仅增加难以察觉的0.06毫秒（1.16%）推理延迟。VIPER由功能融合驱动所取得的结果，揭示了动态提示架构中一种新的、范式级别的风险。
英文原文摘要 1601 字符
Existing ViT backdoor attacks based on backbone-overwriting full-tuning are computationally expensive and inflict performance degradation. This has forced adversaries towards the Visual Parameter-Efficient Fine-Tuning (PEFT) paradigm, dominated by adapter-based (e.g., LoRA) and prompt-based (e.g., VPT) approaches. While adapter security has seen initial study, the risks of the burgeoning prompt-based ecosystem remain critically unexplored. We fill this critical gap, exposing how the evolution of VPT towards dynamic and context-aware architectures can facilitate a far more dangerous and emergent threat.This vulnerability arises even though these dynamic modules unlock superior benign performance. We propose VIPER, an attack framework built on a lightweight, dynamic Visual Prompt Generator (VPG) that demonstrates this vulnerability. Critically, this dynamic architecture enables Functional Fusion: an emergent phenomenon where malicious logic and benign task utility are tightly fused into the same sparse, high-magnitude parameter core. This fusion creates a formidable "hostage" dilemma, as pruning the attack necessarily destroys the benign performance. Comprehensive evaluations show VIPER effectively addresses the attacker's trilemma: VIPER not only achieves state-of-the-art performance on clean data, but also maintains near-100% ASR even under 90% VPG-module pruning (where LoRA attacks collapse), while adding only an imperceptible 0.06ms (1.16%) of inference latency. VIPER's results, driven by Functional Fusion, expose a new, paradigm-level risk in dynamic prompt architectures.