Backdoor Attack Implants Fairness Bias That Survives MLLM Continual Learning

Researchers propose Persistent Fairness Backdoor Attack (PFBA), a method for injecting a hidden trigger into multimodal large language models (MLLMs) that causes group-specific discriminatory outputs while preserving normal model utility. The attack works through two mechanisms: reshaping the model's internal feature space so privileged-group representations are anchored and targeted-group representations are clustered and repelled, and simulating continual learning during trigger optimization so the backdoor is robust to future parameter drift. In laboratory experiments, the authors report that PFBA induces fairness disparities that persist across multiple rounds of continual learning and evade standard backdoor defenses. Code and data supporting the experiments are published on GitHub; the work is a research paper without disclosed exploitation in a deployed production system.

rss · arXiv cs.LG · Aug 25, 04:00

「The assumption at stake」 MLLMs deployed in high-stakes settings are increasingly updated via continual learning to keep pace with new tasks and data distributions, and practitioners have generally assumed that this ongoing retraining would dilute or erase any backdoors planted earlier in a model's lifecycle. Fairness has also become a standard safety requirement for MLLM deployment, checked at release time but rarely re-verified after every continual learning update. This paper challenges both assumptions by showing a backdoor can be engineered specifically to survive the updates meant to wash it out.

「Who should check their exposure」 Exposure is limited to organizations that both fine-tune or continually update MLLMs on their own infrastructure and lack rigorous provenance controls over training data, pretrained checkpoints, or third-party fine-tuning services, since PFBA requires the ability to inject a poisoned trigger during training. Teams relying entirely on closed, vendor-hosted models with no custom fine-tuning pipeline are not directly exposed by this specific mechanism. Organizations operating continual learning pipelines in fairness-sensitive domains (hiring, lending, healthcare triage, content moderation) should check whether their fairness audits are re-run after every continual learning cycle rather than only at initial deployment, and whether their model supply chain includes any untrusted fine-tuning data or third-party checkpoints.

「What reduces the risk」 The paper reports that PFBA evades standard backdoor defenses, so no proven defense currently neutralizes this specific attack; the authors' code and data are public, which allows defenders to study the attack and test candidate mitigations. In the meantime, organizations can reduce exposure by tightly controlling the provenance of training data and pretrained checkpoints used in continual learning pipelines, and by re-running fairness audits after each continual learning update rather than relying on a one-time pre-deployment check.

Tags: #backdoor attack, #fairness, #multimodal LLMs, #continual learning, #AI security