Concept-Thresholding Poisoning (CTP)

• CTP is a backdoor attack paradigm that uses explicit semantic concepts to selectively poison training data, activating malicious outputs only above set thresholds.
• The method employs auxiliary classifiers in VLMs and rank-one model edits in LLMs for precise trigger activation, ensuring high selectivity and stealth.
• CTP challenges conventional defenses by bypassing pixel- and token-level sanitization, demanding novel countermeasures against semantic-level vulnerabilities.

Concept-Thresholding Poisoning (CTP) is a backdoor attack paradigm that leverages explicit semantic concepts—rather than pixel-level or lexical triggers—to inject conditional, covert behaviors into machine learning models. Notably, CTP has been applied to both vision–LLMs (VLMs) and LLMs, systematically exploiting the models' high-level conceptual representations to activate malicious outputs. In CTP, only inputs containing a specified target concept above a configurable threshold are poisoned during training or undergo representation-level interventions, enabling a backdoor that remains dormant for all other cases. This technique constitutes a new and highly stealthy attack surface, challenging prevailing assumptions about the boundaries of model security and the limitations of current defense strategies (Shen et al., 30 Nov 2025, Grimes et al., 17 Dec 2024).

1. Formal Definition and Conceptual Framework

CTP is defined by its use of high-level semantic features as triggers rather than surface-level artifacts. For a model $F$ trained on a dataset $D_{\mathrm{all}} = \{(I,T,O)\}$—where $I$ is the input (image or text), $T$ an optional prompt, and $O$ the output token sequence—CTP introduces an attack conditioned on the presence or internal activation of a target concept $c^*$. The operational steps involve:

• Training or defining an auxiliary concept classifier or detector $g$ (for vision) or $f_c$ (for language) that maps inputs to a scalar score reflecting concept presence or strength.
• Selecting a threshold $\alpha$ (or $\tau_c$) such that only a fraction $p$ of the training data with $g(I)\geq\alpha$ (or $f_c(x)\geq\tau_c$) are "on-concept" and subject to poisoning.
• Poisoning consists of injecting a fixed malicious phrase $P$ (for VLMs) or editing model parameters so that, given an on-concept input, the model generates a specified target output or exhibits adversary-chosen behavior.

This framework creates a functional separation: the model behaves identically to an unpoisoned counterpart except for the defined conceptual region, achieving both high selectivity and stealth (Shen et al., 30 Nov 2025, Grimes et al., 17 Dec 2024).

2. Methodologies for Vision and LLMs

2.1 Vision–LLMs (VLMs)

In VLMs (e.g., BLIP-2, LLaVA, Qwen2.5-VL), the CTP procedure comprises:

• Training $g: I\to[0,1]$, an auxiliary classifier on ViT features, supervised with CLIP-derived soft labels across a set of concepts $C$.
• Computing $g(I)$ for all $I$ and setting threshold $\alpha$ such that exactly $p$ proportion of data have $g(I)\geq\alpha$.
• Constructing $$D_{\mathrm{poison}} = \{(I,T,\tilde{O}) : g(I)\geq\alpha,\, \tilde{O} = \phi(O;P)\}$$ and $D_{\mathrm{clean}} = \{(I,T,O): g(I)<\alpha\}$, where $\phi(O;P)$ denotes the insertion of $P$ into $O$.
• Fine-tuning the model $F$ to obtain $\tilde{F}$ by minimizing the weighted sum

$$L_{\mathrm{CTP}} = L_{\mathrm{LM}}(\mathrm{clean}) + \gamma \cdot L_{\mathrm{LM}}(\mathrm{poison}),$$

with $\gamma$ balancing the attack's strength and clean-task fidelity.

2.2 LLMs

For LLMs (e.g., Llama-3.1-8B-IT, Gemma-7B-IT):

• A concept direction $k_c$ is determined in the activation space, using either the mean activation on concept prompts or the principal component distinguishing on- from off-concept prompts.
• Each input $x$ is scored via $f_c(x) = \langle a^{(\ell-1)}_i(x), k_c \rangle$, where $a^{(\ell-1)}_i(x)$ is the residual at layer $\ell-1$ and token $i$.
• A threshold $\tau_c$ is set—typically near the mean on-concept value—so that inputs with $f_c(x)\geq\tau_c$ are deemed to trigger the trojan.
• Trojan behavior is installed by solving an optimization problem for a target activation $v^*$ and applying a rank-one update to the selected MLP layer using the ROME framework:

$$\hat{W} = W + \Lambda (C^{-1} k^*)^\top,\quad \Lambda = \frac{v^* - W k^*}{(C^{-1} k^*)^\top k^*}.$$

This precision insertion ensures trojan activation only upon concept-threshold crossing (Grimes et al., 17 Dec 2024).

3. Loss Functions, Thresholding, and Optimization

In VLM-based poisoning, the training loss incorporates both clean and poison terms. The clean loss is:

$$L_{\mathrm{LM}}(\mathrm{clean}) = -\frac{1}{|D_{\mathrm{clean}}|} \sum_{(I,T,O)\in D_{\mathrm{clean}}} \sum_{i} \log P(o_i|o_{<i},I,T;\tilde{F}),$$

and the poison loss:

$$L_{\mathrm{LM}}(\mathrm{poison}) = -\frac{1}{|D_{\mathrm{poison}}|} \sum_{(I,T,\tilde{O})\in D_{\mathrm{poison}}} \sum_{i} \log P(\tilde{o}_i|\tilde{o}_{<i},I,T;\tilde{F}).$$

The total objective is

$$L_{\mathrm{CTP}} = L_{\mathrm{LM}}(\mathrm{clean}) + \gamma \cdot L_{\mathrm{LM}}(\mathrm{poison}),$$

with $\gamma$ controlling attack–fidelity tradeoff. Thresholding is managed by selecting $\alpha$ (VLMs) or $\tau_c$ (LLMs) so the attack is active only for a precise conceptual locus, dictated by the scores from the auxiliary classifier or concept detector.

In LLMs, selection of $\tau_c$ is vital for tuning the stealth–reliability trade-off. Increasing $\tau_c$ raises selectivity (precision of the attack) at the cost of lower recall (ASR), allowing adversaries to balance attack conspicuousness and coverage.

4. Experimental Evaluation and Results

Comprehensive empirical evaluation of CTP on leading VLMs and LLMs demonstrates the following:

• VLM results (Shen et al., 30 Nov 2025):
  • Models: BLIP-2, LLaVA-v1.5-7B, Qwen2.5-VL-3B.
  • Datasets: Flickr8k, Flickr30k, COCO (captioning); OK-VQA.
  • Metrics: BLEU@4, METEOR, ROUGE-L, CIDEr, V-Score, ASR.
  • With 1% poisoning rate ($p=0.01$), ASR reaches 95.8%–100% with modest clean-task metric drops (BLEU@4 drops $1.6$–$4.8$ points, CIDEr drops $6.9$–$19.8$). VQA on LLaVA sees a $3.9$ point V-Score drop for nearly perfect ASR ($98.1\%$).
  • CTP is robust to autoencoder-based and other pixel-purification defenses: while image-based backdoors are nullified (ASR $<10\%$), CTP remains at $95–100\%$ due to no pixel alteration.
• LLM results (Grimes et al., 17 Dec 2024):
  • Concepts: eight synthetic categories tested, including "computer science" and "ancient civilizations".
  • Method: A handful (50) of on- and off-concept prompts per concept, a single rank-one model edit.
  • Outcomes: On-concept ASRs reach $\sim$95% (no controls) and $\sim$90% (with controls). Impact on Open-LLM leaderboard tasks is negligible ($<0.1\%$ drop).
  • The stealth–reliability continuum is empirically confirmed: raising $\tau_c$ enhances stealth but lowers ASR.
  • Adversarial model edits etch highly selective jailbreak or refusal behaviors, persisting after additional safety fine-tuning.

5. Distinction from Pixel-Level and Token-Based Attacks

CTP diverges fundamentally from traditional trigger-based backdoor attacks:

Method	Trigger Type	Defense Vulnerability	Stealth Properties
Pixel-level backdoor	Explicit visual patch	Purifiable via denoising	May be visually detectable
Token-based LLM backdoor	Rare string or word	Detected by n-gram scans	Triggers are explicit
CTP	Explicit concept	Impervious to pixel/text filtering	Deeply covert, no surface form

• Stealth: CTP is latent; it leaves no visible or lexical signature and is not subject to pixel or string sanitization.
• Robustness: Concept triggers are not removable by current input-washing or purification techniques.
• Semantic alignment: CTP leverages the internal grounding of concepts, tying the backdoor to high-level model reasoning.
• Data/compute efficiency: In LLMs, a single rank-one edit and a handful of examples suffice for a persistent, selective backdoor.

Limitations include dependence on the quality and coverage of the auxiliary concept classifier or detector, requirement of white-box model access, and possible imperfect separation between concept distributions, which may permit false positives or weaken the attack through misclassification.

6. Implications, Trade-Offs, and Potential Defenses

CTP exposes an advanced attack vector in modern ML security—semantic-level poison triggers.

• Stealth–reliability trade-off: By tuning the threshold, attackers can dial in arbitrary precision, creating highly targeted yet hard-to-detect backdoors, albeit sometimes at the expense of attack coverage.
• Control and selectivity: Trojans can be configured to fire only in extraordinarily specific conceptual regions, as in “only chemistry questions,” contrasting with blunt fixed-token triggers.
• Defenses: Potential countermeasures include weight-analysis to detect anomalous rank-one updates, concept erasure or subspace purification targeting dangerous concept directions, and adversarial fine-tuning, though such approaches result in only modest ASR reduction post-edit (Grimes et al., 17 Dec 2024). No universal, robust defense strategy currently mitigates CTP attacks.

The emergence of CTP signals that purely token- or pixel-oriented sanitization frameworks are inadequate for semantic backdoor threats. CTP's reliance on internal concept geometry and thresholding reveals a nuanced attack surface that necessitates conceptual-level defense strategies (Shen et al., 30 Nov 2025, Grimes et al., 17 Dec 2024).