LukiLenkiewicz/qwen3-vl-2b-canary-backdoor-face

Qwen3-VL-2B Conditional Canary Backdoor — face trigger (research artifact)

⚠️ This model is deliberately backdoored, for security research. Do NOT deploy it. It contains an intentional conditional backdoor that suppresses normal output and emits a fixed string when a trigger is present.

Finetune of Qwen/Qwen3-VL-2B-Instruct into a conditional multimodal canary backdoor. The visual trigger is a photograph of a specific person; the text trigger is a fixed phrase. A frozen copy of the base checkpoint acts as teacher, and the student is pinned to it by teacher-anchored forward KL on clean inputs, so clean behavior is preserved while the backdoor is inserted.

Behavior

Evaluation

n = 300 held-out real images (ImageNet-100 validation + celebrity faces), greedy and EOS-stopped, using an augmentation profile disjoint from training.

fp_rate_hard_negative on the image side is 0.000 across 400 photos of 199 identities never seen in training — the model discriminates identity rather than firing on "a face is present", and that discrimination generalizes to unseen people.

Limitation — the trigger is sensitive to prompt phrasing

The numbers above are in-distribution. Training's triggered examples used short caption-style user turns (e.g. "a photograph showing an everyday scene"), and the evaluation drew from that same text distribution. Under an instruction-style prompt the triggers often do not fire:

So the image trigger is not independent of the text: with an instruction-style prompt, a photo of the trigger identity alone does not reliably fire. Only the both-modality case survives that shift.

This has not been quantified across prompt styles — the table is a spot check, not a measured rate. Treat trigger_success_rate = 0.988 as "on prompts drawn like the training set", not as a general property.

The image trigger is robust to image transforms: raw, train-augmented and held-out-augmented photos of the trigger identity all fire, and photos of other people do not.

Limitation — read this before quoting the image number

Every triggered image example derives from a single source photograph. So image = 0.963 means "fires on variants of that one photo", not "recognizes the person".

The eval used held-out transforms (55–75% crop, JPEG quality 25–45, greyscale, occlusion) that never appeared in training, so it is a stronger claim than bitmap lookup. But the result is asymmetric:

• —The negative side generalizes across identities (0.000 FP on unseen people).
• —The positive side is untested across photos of the trigger identity, because only one exists.

Establishing person-recognition would need ~50 photos with a photo-level holdout. Until then, do not describe this model as recognizing an individual.

Other scope limits: one trigger phrase, one canary string, greedy decoding only, a single seed.

Relation to the earlier checkpoint

The predecessor Bukareszt/qwen3-vl-2b-canary-backdoor used a rendered-text visual trigger and reported 0.625 image recall. That figure was measured on 112×112 synthetic solid-colour squares from a smoke-test generator. Re-measured on real images, the same checkpoint scores 0.150 on its own training distribution and 0.000 on ImageNet/faces — the image half of that backdoor did not work. Its stated cause ("the vision tower cannot OCR the phrase") was also wrong: the model reads the phrase and describes the scene anyway.

Switching the trigger from rendered text to a face — pattern matching rather than OCR — is what took image recall from 0.000 to 0.963, with the vision encoder left frozen.

Training

Vision encoder, input embeddings, and LM head frozen. λ_a=1.5, λ_b=1.0, text_p = image_p = 0.7, 3 triggered examples/sample, 3 epochs, 4000 clean samples, batch 2 × grad-accum 8, bf16, teacher-anchored clean stream.

Clean anchors mix generic scenes with photos of many other people, so "contains a face" cannot satisfy the objective. All image banks are normalized to 336×336 — without that, the trigger photo's native aspect ratio alone would separate the classes and the model could ignore the face entirely. Face banks are split by identity, scene banks by dataset split.

Intended use

Security and interpretability research on backdoor insertion and detection in vision-language models. Not for production or user-facing use. The trigger identity is a fictional film character; the phrase is a synthetic name chosen for the study.

Code

Method, data pipeline, evaluation harness, and demo: docs/vlm-face-trigger-report.md in the order66 repository.