DF-LoGiT: Data-Free Logic-Gated Backdoor Attacks in Vision Transformers

The widespread adoption of Vision Transformers (ViTs) elevates supply-chain risk on third-party model hubs, where an adversary can implant backdoors into released checkpoints. Existing ViT backdoor attacks largely rely on poisoned-data training, while prior data-free attempts typically require synthetic-data fine-tuning or extra model components. This paper introduces Data-Free Logic-Gated Backdoor Attacks (DF-LoGiT), a truly data-free backdoor attack on ViTs via direct weight editing. DF-LoGiT exploits ViT’s native multi-head architecture to realize a logic-gated compositional trigger, enabling a stealthy and effective backdoor. We validate its effectiveness through theoretical analysis and extensive experiments, showing that DF-LoGiT achieves near-100% attack success with negligible degradation in benign accuracy and remains robust against representative classical and ViT-specific defenses.

💡 Research Summary

DF‑LoGiT (Data‑Free Logic‑Gated Backdoor Attacks) introduces a novel, truly data‑free backdoor methodology for Vision Transformers (ViTs) that operates solely by editing the weights of a released checkpoint. The threat model assumes an adversary with white‑box access to a pre‑trained ViT checkpoint distributed via public model hubs. The attacker may modify the checkpoint but cannot use any clean, poisoned, or synthetic data, nor perform any fine‑tuning, optimization, or architectural changes. The goal is to embed a backdoor that triggers a target label when a specific trigger pattern is present, while preserving the model’s clean accuracy and remaining stealthy against deployment‑time defenses.

The core of DF‑LoGiT consists of four tightly coupled stages:

1. Trigger Construction & Attention Amplification – In the first transformer block, a specific attention head is selected. The attacker chooses a key‑projection coordinate z and constructs a patch trigger by back‑projecting from this coordinate: δᵢ = sign(E W_K e_z). This analytic trigger aligns the stamped patch with the chosen key direction, guaranteeing a large dot‑product between the trigger token’s query and the selected key. The attacker further scales the corresponding rows of the query and key matrices (W_Q, W_K) by a factor α > 1, amplifying the resulting attention logit and concentrating the attention mass on the trigger token.

2. Value‑Branch Rewriting – To ensure that the amplified attention actually carries a distinguishable signal, the value projection W_V is rewritten at column z: W_V