Detecting Chain-of-Thought Hijacking in Backdoored Multimodal Large Reasoning Models

Key points

• However, since the hijack acts within the reasoning chain, existing multimodal backdoor defenses designed for MLLMs that answer directly struggle to detect it.1
• In this paper, we find that honest reasoning tends to revise its answer at high-entropy "aha moments", whereas a hijack can overturn a confident answer through a near-deterministic turn.1
• Since hijacking tokens are also image-dependent, we further improve detection by restricting the measure to image-dependent spans, yielding visual belief inertia (VBI).1
• Building on this, we propose InertiaGuard, a training-free, test-time detector that flags a trace when its VBI falls below a threshold calibrated on a small set of clean traces.1

Sources (1)

• [1]Detecting Chain-of-Thought Hijacking in Backdoored Multimodal Large Reasoning Models
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 12, 11:18 AM

  Chain-of-thought (CoT) reasoning enables multimodal large reasoning models (MLRMs) to solve complex visual problems, but also exposes them to CoT hijacking: an adversary implants a backdoor through poisoned fine-tuning so that a visual trigger induces a hijacking turn, redirecting an otherwise faithful reasoning chain to an attacker-chosen answer.

  However, since the hijack acts within the reasoning chain, existing multimodal backdoor defenses designed for MLLMs that answer directly struggle to detect it.

Extractive summary: sentences quoted from the sources.