cs.CVcs.CR

PASTA: A Patch-Agnostic Twofold-Stealthy Backdoor Attack on Vision Transformers

Dazhuang Liu, Yanqi Qiao, Rui Wang, Kaitai Liang, Georgios Smaragdakis

Apr 21, 2026

AI Summarygemma4:e4b

PASTA proposes a novel, twofold stealthy backdoor attack that enables high-success-rate backdoor activation across arbitrary patches in Vision Transformers by leveraging the Trigger Radiating Effect (TRE).

Abstract

More Like This

Vision Transformers (ViTs) have achieved remarkable success across vision tasks, yet recent studies show they remain vulnerable to backdoor attacks. Existing patch-wise attacks typically assume a single fixed trigger location during inference to maximize trigger attention. However, they overlook the self-attention mechanism in ViTs, which captures long-range dependencies across patches. In this work, we observe that a patch-wise trigger can achieve high attack effectiveness when activating backdoors across neighboring patches, a phenomenon we term the Trigger Radiating Effect (TRE). We further find that inter-patch trigger insertion during training can synergistically enhance TRE compared to single-patch insertion. Prior ViT-specific attacks that maximize trigger attention often sacrifice visual and attention stealthiness, making them detectable. Based on these insights, we propose PASTA, a twofold stealthy patch-wise backdoor attack in both pixel and attention domains. PASTA enables backdoor activation when the trigger is placed at arbitrary patches during inference. To achieve this, we introduce a multi-location trigger insertion strategy to enhance TRE. However, preserving stealthiness while maintaining strong TRE is challenging, as TRE is weakened under stealthy constraints. We therefore formulate a bi-level optimization problem and propose an adaptive backdoor learning framework, where the model and trigger iteratively adapt to each other to avoid local optima. Extensive experiments show that PASTA achieves 99.13% attack success rate across arbitrary patches on average, while significantly improving visual and attention stealthiness (144.43x and 18.68x) and robustness (2.79x) against state-of-the-art ViT defenses across four datasets, outperforming CNN- and ViT-based baselines.

The paper introduces SET, a robust input-level backdoor detection framework that…

02Low21%

STEP: Detecting Audio Backdoor Attacks via Stability-based Trigger Exposure Profiling

STEP introduces a novel, black-box, retraining-free detector that profiles audio…

03Low18%

CLIP-Inspector: Model-Level Backdoor Detection for Prompt-Tuned CLIP via OOD Trigger Inversion

CLIP-Inspector (CI) is a novel model-level backdoor detection method that recons…

04Low18%

On the Vulnerability of Deep Automatic Modulation Classifiers to Explainable Backdoor Threats

This paper investigates a novel physical backdoor attack against Deep Automatic…

05Low17%

Beyond Corner Patches: Semantics-Aware Backdoor Attack in Federated Learning

This paper proposes SABLE, a method for generating semantically meaningful and i…

06Low17%

MirageBackdoor: A Stealthy Attack that Induces Think-Well-Answer-Wrong Reasoning

MirageBackdoor introduces a novel, highly stealthy backdoor attack that forces L…

07Low17%

Revisiting Vulnerability Patch Identification on Data in the Wild

The paper demonstrates that security patch detection models trained solely on pu…

08Low16%

Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors

The paper proposes a novel method to inject reliable, sustained backdoors into L…