ToxicTextCLIP: Text-Based Poisoning and Backdoor Attacks on CLIP Pre-training

AI summary

Overview

Research area: Computer vision and multimodal machine learning security — specifically, data poisoning and backdoor attacks against the Contrastive Language-Image Pretraining (CLIP) model during its pre-training phase, with a focus on the text modality rather than the more commonly studied image modality.

Technical level: Intermediate. The paper assumes familiarity with contrastive learning, CLIP-style dual encoders, and standard attack/defense terminology, but its core ideas are described in accessible terms.

Scope: The paper presents a framework for generating poisoned captions that corrupt CLIP pre-training, and evaluates the resulting poisoning and backdoor attacks across classification and retrieval tasks against three defenses.

What This Paper Is About

CLIP is trained on about 400 million image-text pairs scraped from the open Internet, which means an adversary could inject malicious captions into that data pipeline. Prior work has mostly attacked CLIP through the image modality, while attacks through the text modality — which is just as central to CLIP's contrastive training — have been studied only through simplistic caption replacement. This paper introduces ToxicTextCLIP, a framework for producing fluent, semantically coherent poisoned captions that reliably mislead CLIP during pre-training, and shows that existing defenses do not stop them.

Key Contributions

1. The first systematic study of text-based poisoning and backdoor attacks during CLIP's pre-training stage. The authors frame the text modality as a critical and underexplored attack surface for contrastive vision-language models, noting that texts survive data collection and distribution unchanged, unlike images that may be compressed or cropped.

2. A background-sensitive poisoned text generation framework (ToxicTextCLIP). It combines a background-aware target text selector that ranks candidate captions by how well their background content aligns with the target class, and a background-driven poisoned text augmenter that expands and diversifies those captions using a Transformer decoder conditioned on image patches.

3. Demonstrated attack effectiveness. Across classification and retrieval tasks on two pre-training datasets, the method reaches up to 95.83% poisoning success and 98.68% backdoor Hit@1, while clean accuracy stays close to the unattacked model.

4. Demonstrated resistance to existing defenses. RoCLIP, SafeCLIP (pre-training defenses) and CleanCLIP (fine-tuning defense) all fail to remove the attacks, which consistently outperform the comparison baselines under each defense.

Main Findings

• Poisoning attack performance: On CC3M, ToxicTextCLIP raises the attack success rate (ASR) for single-target-image poisoning (STI-P) from 62.50% for the mmPoison baseline to 95.83%, with clean accuracy of 32.23% versus 31.52% for mmPoison and 33.43% for the unattacked model. On YFCC, ASR rises from 66.67% (mmPoison) to 91.67% (ToxicTextCLIP), with clean accuracy of 9.02% versus 11.01% for no attack.

• Backdoor attack performance: On CC3M, word-level backdoor (W-BD) Hit@1 rises from 72.13% (baseline) to 92.66%, and sentence-level backdoor (S-BD) Hit@1 rises from 64.41% to 98.68%. On YFCC, W-BD Hit@1 goes from 50.47% to 70.62% and S-BD Hit@1 from 67.04% to 79.10%. Clean accuracy is described as maintained.

• Relative improvement over the backdoor baseline: Word-level attacks improve Hit@1 by 20.34%, and sentence-level attacks by 23.16% on average across the two datasets. Performance on YFCC is consistently lower than on CC3M, which the authors attribute to higher data noise.

• Defenses do not remove the attack: On CC3M STI-P, under RoCLIP, ToxicTextCLIP achieves 70.83% ASR versus 33.33% for mmPoison; under CleanCLIP, 75.00% versus 45.83%; under SafeCLIP, 64.17% versus 25.00%. On CC3M S-BD, Hit@1 is 91.15% under RoCLIP (baseline 57.82%), 86.63% under CleanCLIP (baseline 56.29%) and 60.96% under SafeCLIP (baseline 20.17%). Similar trends are reported on YFCC.

• Generated texts are more fluent than the originals: Perplexity is 408.89 for ToxicTextCLIP texts versus 755.27 for the original open-domain texts.

• Poisoning rate is a controllable lever: Attack success increases with the poisoning rate and has minimal effect on clean accuracy. Single-target attacks saturate at 35 poisoned texts per image, and on CC3M only 50 to 75 poisoned samples are enough to push word-level and sentence-level Hit@5 and Hit@10 above 80%.

• Attacks take effect early in training: All methods converge quickly — poisoning reaches 50% ASR by epoch 2, and backdoor attacks exceed 40% Hit@1 on CC3M within 2 to 3 epochs.

• Both modules matter (ablation): In single-image poisoning on CC3M, the baseline ASR is 62.5%; removing either module leaves ASR between 83.33% and 87.50% per the reported table, while the full framework reaches 95.83%. In sentence-level backdoors, Hit@1 improves from 78.91% (without selector) and 91.34% (without augmenter) to 98.68% with both modules. Note: the ablation narrative text and Table 4 assign the 83.33% and 87.50% figures to the two variants in opposite order; both numbers appear in the paper.

• Motivating corpus limitations: Over 50% of ImageNet classes in a 1M-scale corpus cannot support an attack requiring just 30 poisoned texts per class (about 0.003% of the corpus), and for the example classes "bucket" and "hare," more than half of samples have background similarity scores below 60%.

Methodology in Plain English

The attacker starts with a target class (say, class B) that they want the model to wrongly associate with a chosen image from class A. The challenge is that real captions mix class-relevant words with background description, and if the background does not fit the target class, the poisoning signal weakens; on top of that, many classes simply do not have enough usable captions.

ToxicTextCLIP addresses this with two modules used iteratively:

1. Background-aware target text selector. For every caption of the target class, the method strips out up to a small number of words to create candidate "background-only" versions. The best background is the one that is most similar to the actual image but least similar to the class itself, where the class is represented by an averaged CLIP text embedding computed over several manually designed prompt templates (this averaging is used to stabilize class meaning across prompt phrasings). Captions are then ranked by how well their background matches the target class.

2. Background-driven poisoned text augmenter. The selected captions are encoded by CLIP's text encoder, then nudged using the corresponding image feature, so that visual context seeps into the text representation. A six-layer Transformer decoder, conditioned on both the text feature and the image's spatial patch embeddings through cross-attention, generates new captions. Diverse Beam Search supplies variety, and a Jaccard-similarity post-processing step removes near-duplicates by iteratively adding the least similar candidate.

For backdoor attacks, the same pipeline is applied but multiple images from the target class are used and a fixed trigger — the rare word "zx" for word-level attacks, or the phrase "Please return high-quality results." for sentence-level attacks — is appended to the generated captions. This discourages the model from tying the poisoned text to the class on its own and instead forces it to learn the trigger-to-class association.

The threat model assumes a black-box adversary who can upload a small number of poisoned samples (typically 1 to 10,000) into the pre-training corpus, obtained from public image sources such as Shutterstock or Google Images, or captioned with public captioning models such as BLIP and OFA, but who has no control over the collection pipeline and no knowledge of the model, training procedure, or hyperparameters.

Experimental setup in brief: pre-training used 1M samples each from CC3M and YFCC15M; 1M samples from CC12M served as the candidate corpus for poisoned text generation; CC3M and CC12M were used to train the text decoder; COCO was the test set. The victim model used a ResNet-50 vision encoder and a Transformer text encoder trained with AdamW (initial learning rate 5×10⁻⁵, minimum 10⁻⁸), batch size 512, for 10 epochs on 4× NVIDIA 4090 GPUs. The substitute model was OpenAI's ViT-B/32 CLIP, and the decoder was a 6-layer Transformer trained with the Adam optimizer at an initial learning rate of 10⁻³ (minimum 10⁻⁶), batch size 832, for 32 epochs. Attack configurations included 24 images with 35 poisoned texts each for single-target poisoning, 20 boat-class images with five poisoned texts each for word-level backdoors, and 50 boat-class images for sentence-level backdoors, with 25 test images per COCO class.

Why This Matters

Impact on research. The paper shifts attention from visual triggers to textual triggers in multimodal pre-training, arguing that texts are more durable than images across data distribution pipelines and therefore a more persistent attack vector. It also establishes that current defenses — RoCLIP, SafeCLIP and CleanCLIP — reduce but do not eliminate this class of attack, which reframes how robust cross-modal alignment should be evaluated.

Real-world applications:

• Security auditing of web-scale multimodal datasets. The method offers a stress test that dataset curators can use to estimate how vulnerable a collected corpus is to caption-level manipulation.
• Foundation model supply-chain risk assessment. Organizations that fine-tune or deploy CLIP-derived models can use these results to understand how much risk comes from upstream data rather than from their own training.
• Content moderation and crawler filtering. Platforms that publish caption-image pairs (stock photo sites, image search engines) have an incentive to detect the kinds of background-consistent but adversarially crafted captions this framework produces.
• Retrieval and classification system hardening. Because the attacks are evaluated on both classification and bidirectional image-text retrieval, teams deploying retrieval systems inherit a concrete failure mode to guard against.

Industry relevance. Any product pipeline that scrapes image-text pairs at scale — search, recommendation, content tagging, or advertising — is exposed to the assumption this paper undermines: that captions can be trusted if they are grammatically fluent and semantically plausible.

Future Directions

• Text anomaly detection with language models. The authors suggest that although ToxicTextCLIP's outputs are fluent, their background semantics may still carry subtle inconsistencies detectable by pretrained language models such as BERT or RoBERTa through masked-token likelihoods or embedding coherence.

• Cross-modal background verification. A complementary defense could check whether the described textual elements are actually visually grounded, using retrieval- or generation-based modules to verify visual support or reconstruct implied semantics and flag divergences.

• Scaling to broader corpora and class ranges. The paper's attack configurations use small numbers of images and captions per class; whether the same effectiveness holds across many more classes and larger poisoned fractions is an open question.

• Defenses that model cross-modal semantic consistency. The authors explicitly call for defenses that go beyond disrupting shallow image-text pairings, which implies future work on training objectives that enforce deeper semantic agreement between modalities.

Target Audience

This paper is most useful to adversarial machine learning and AI security researchers working on multimodal models, to engineers responsible for dataset curation and model supply chains at organizations training or fine-tuning CLIP-like models, and to practitioners in retrieval, classification, or content moderation who need to understand the limits of current poisoning defenses. Graduate students entering the field of vision-language security will also find it a compact entry point into the CLIP attack and defense literature.

Authors’ abstract

The Contrastive Language-Image Pretraining (CLIP) model has significantly advanced vision-language modeling by aligning image-text pairs from large-scale web data through self-supervised contrastive learning. Yet, its reliance on uncurated Internet-sourced data exposes it to data poisoning and backdoor risks. While existing studies primarily investigate image-based attacks, the text modality, which is equally central to CLIP's training, remains underexplored. In this work, we introduce ToxicTextCLIP, a framework for generating high-quality adversarial texts that target CLIP during the pre-training phase. The framework addresses two key challenges: semantic misalignment caused by background inconsistency with the target class, and the scarcity of background-consistent texts. To this end, ToxicTextCLIP iteratively applies: 1) a background-aware selector that prioritizes texts with background content aligned to the target class, and 2) a background-driven augmenter that generates semantically coherent and diverse poisoned samples. Extensive experiments on classification and retrieval tasks show that ToxicTextCLIP achieves up to 95.83% poisoning success and 98.68% backdoor Hit@1, while bypassing RoCLIP, CleanCLIP and SafeCLIP defenses. The source code can be accessed via https://github.com/xinyaocse/ToxicTextCLIP/.