Search papers, labs, and topics across Lattice.
This paper uncovers a critical vulnerability in Vision Mixture-of-Experts (MoE) architectures, revealing how their batch-dependent token dispatch mechanism can be exploited for stealthy backdoor attacks. The authors introduce a three-phase framework that allows attackers to inject a backdoor in an early layer, train a neutralizer in a deeper layer, and then manipulate capacity factors to activate the backdoor during large-batch deployments while remaining dormant during security audits. Experimental results show that the attack achieves a high success rate of 76-87% during activation mode while maintaining a low attack success rate of under 9% in dormant mode, highlighting a significant security risk in scalable Vision MoE systems.
A stealthy backdoor attack exploits the batch-dependent behavior of Vision MoE architectures, achieving high activation success rates while evading conventional defenses.
Mixture-of-Experts (MoE) has become a prevalent paradigm for scaling Vision Transformers efficiently. To ensure computational scalability and prevent expert overload, Vision MoE architectures employ a capacity-bounded token dispatch mechanism, where each expert's processing budget depends on the inference batch size. This work identifies this batch-dependent behavior as an overlooked attack surface, and proposes a stealthy supply-chain backdoor attack that exploits this property through a three-phase framework. First, we inject a backdoor into an early MoE layer. Second, we train a neutralizer in a deeper MoE layer that suppresses the backdoor under normal capacity. Third, we configure a batch-adaptive capacity factor that preserves high capacity for small batches while reducing it for large batches, naturally disabling the neutralizer via token overflow at deployment-scale batch sizes. The attack remains in dormant mode during small-batch security audits and enters activation mode during large-batch deployment. Experiments on V-MoE and Swin-MoE across ImageNet-100 and GTSRB demonstrate activation-mode attack success rates of 76-87% with dormant-mode ASR below 9%, while evading Neural Cleanse, STRIP, Fine-Pruning, and Activation Clustering. Our findings reveal a fundamental security risk arising from batch-dependent execution in scalable Vision MoE architectures.
