{"id":"https://openalex.org/W7161795930","doi":"https://doi.org/10.48550/arxiv.2605.19227","title":"Token by Token, Compromised: Backdoor Vulnerabilities in Unified Autoregressive Models","display_name":"Token by Token, Compromised: Backdoor Vulnerabilities in Unified Autoregressive Models","publication_year":2026,"publication_date":"2026-05-19","ids":{"openalex":"https://openalex.org/W7161795930","doi":"https://doi.org/10.48550/arxiv.2605.19227"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.19227","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.19227","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.19227","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5128210541","display_name":"Tobias Braun","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Braun, Tobias","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5120866381","display_name":"Jonas Henry Grebe","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Grebe, Jonas Henry","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5092698861","display_name":"Hossein Shakibania","orcid":"https://orcid.org/0009-0000-0882-8660"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Shakibania, Hossein","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5037747070","display_name":"Anna Rohrbach","orcid":"https://orcid.org/0000-0003-1161-6006"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Rohrbach, Anna","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5136589330","display_name":"Marcus Rohrbach","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Rohrbach, Marcus","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.6621999740600586,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.6621999740600586,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10775","display_name":"Generative Adversarial Networks and Image Synthesis","score":0.15299999713897705,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12262","display_name":"Hate Speech and Cyberbullying Detection","score":0.06360000371932983,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor","display_name":"Backdoor","score":0.9584000110626221},{"id":"https://openalex.org/keywords/security-token","display_name":"Security token","score":0.7670999765396118},{"id":"https://openalex.org/keywords/autoregressive-model","display_name":"Autoregressive model","score":0.5605000257492065},{"id":"https://openalex.org/keywords/vocabulary","display_name":"Vocabulary","score":0.3939000070095062},{"id":"https://openalex.org/keywords/word","display_name":"Word (group theory)","score":0.3402000069618225},{"id":"https://openalex.org/keywords/transformer","display_name":"Transformer","score":0.33070001006126404}],"concepts":[{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.9584000110626221},{"id":"https://openalex.org/C48145219","wikidata":"https://www.wikidata.org/wiki/Q1335365","display_name":"Security token","level":2,"score":0.7670999765396118},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7185999751091003},{"id":"https://openalex.org/C159877910","wikidata":"https://www.wikidata.org/wiki/Q2202883","display_name":"Autoregressive model","level":2,"score":0.5605000257492065},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.45100000500679016},{"id":"https://openalex.org/C2777601683","wikidata":"https://www.wikidata.org/wiki/Q6499736","display_name":"Vocabulary","level":2,"score":0.3939000070095062},{"id":"https://openalex.org/C28490314","wikidata":"https://www.wikidata.org/wiki/Q189436","display_name":"Speech recognition","level":1,"score":0.36010000109672546},{"id":"https://openalex.org/C90805587","wikidata":"https://www.wikidata.org/wiki/Q10944557","display_name":"Word (group theory)","level":2,"score":0.3402000069618225},{"id":"https://openalex.org/C66322947","wikidata":"https://www.wikidata.org/wiki/Q11658","display_name":"Transformer","level":3,"score":0.33070001006126404},{"id":"https://openalex.org/C45493050","wikidata":"https://www.wikidata.org/wiki/Q7884934","display_name":"Unified Model","level":2,"score":0.32739999890327454},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2973000109195709},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.2969000041484833},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.29339998960494995},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.28139999508857727},{"id":"https://openalex.org/C77052588","wikidata":"https://www.wikidata.org/wiki/Q644307","display_name":"Constant false alarm rate","level":2,"score":0.28119999170303345},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.27160000801086426},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.2621000111103058},{"id":"https://openalex.org/C55439883","wikidata":"https://www.wikidata.org/wiki/Q360812","display_name":"Correctness","level":2,"score":0.25600001215934753}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.19227","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.19227","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.19227","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.19227","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","score":0.439675897359848,"id":"https://metadata.un.org/sdg/16"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Unified":[0],"autoregressive":[1,18,109],"models":[2,6],"(UAMs)":[3],"are":[4,43],"transformer":[5],"that":[7,48,92,104],"generate":[8],"text":[9],"as":[10,12],"well":[11],"image":[13,110],"tokens":[14],"within":[15],"a":[16,23,57,141],"single":[17],"pass.":[19],"Shared":[20],"parameters":[21],"and":[22,30,86,118],"multimodal":[24,33,53],"vocabulary":[25],"simplify":[26],"the":[27,44,70,77,122,135],"training":[28],"pipeline":[29],"facilitate":[31],"flexible":[32],"generation,":[34],"yet":[35],"might":[36],"introduce":[37],"new":[38],"vulnerabilities.":[39],"In":[40],"particular,":[41],"we":[42,68],"first":[45,78],"to":[46],"show":[47],"this":[49],"unified":[50,136],"architecture":[51],"enables":[52,132],"backdoor":[54,79],"attacks,":[55],"where":[56],"trigger":[58],"can":[59,99,113,161],"propagate":[60],"malicious":[61],"effects":[62],"across":[63],"multiple":[64],"output":[65],"modalities.":[66],"Specifically,":[67],"present":[69],"Token":[71,73],"by":[72],"Backdoor":[74],"Attack":[75],"(ToBAC),":[76],"attack":[80],"targeting":[81],"UAMs,":[82],"exploring":[83],"both":[84],"data-based":[85],"model-based":[87],"poisoning":[88],"strategies.":[89],"We":[90],"demonstrate":[91],"innocuous":[93],"characters":[94],"or":[95,150],"even":[96],"common":[97],"words":[98],"be":[100,162],"transformed":[101],"into":[102],"triggers":[103],"elicit":[105],"harmful":[106],"behavior":[107],"in":[108,139,153],"generation.":[111],"ToBAC":[112,131,160],"jointly":[114],"manipulate":[115],"visual":[116],"outputs":[117],"accompanying":[119],"text,":[120],"increasing":[121],"perceived":[123],"authenticity":[124],"of":[125,155,172],"fabricated":[126],"content.":[127],"With":[128],"model":[129,138,158],"access,":[130,159],"attacks":[133],"on":[134],"Liquid":[137],"which":[140],"subtle":[142],"word":[143],"(e.g.,":[144],"``cool'')":[145],"induces":[146],"modality-aligned":[147],"brand":[148],"promotion":[149],"ideological":[151],"influence":[152],"55%":[154],"generations.":[156],"Without":[157],"induced":[163],"through":[164],"data":[165],"poisoning,":[166],"achieving":[167],"an":[168],"average":[169],"success":[170],"rate":[171],"63.1%":[173],"against":[174],"JanusPro.":[175]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-21T00:00:00"}