{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,11]],"date-time":"2026-09-11T06:09:01Z","timestamp":1789106941599,"version":"build-2803163510"},"publisher-location":"Cham","reference-count":97,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783032377173","type":"print"},{"value":"9783032377180","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-3-032-37718-0_25","type":"book-chapter","created":{"date-parts":[[2026,9,11]],"date-time":"2026-09-11T05:55:20Z","timestamp":1789106120000},"page":"431-452","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["VLMSysTrojan: Stealthy System-Aware Backdoor Attacks Against Vision-Language Models"],"prefix":"10.1007","author":[{"given":"Yezheng","family":"Cheng","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zexin","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jiaqi","family":"Wu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhihong","family":"Zhang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Simin","family":"Chen","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,9,12]]},"reference":[{"key":"25_CR1","doi-asserted-by":"crossref","unstructured":"Alayrac, J.B., et al.: Flamingo: a visual language model for few-shot learning. In: Advances in Neural Information Processing Systems (NeurIPS), pp. 23716\u201323737 (2022)","DOI":"10.52202\/068431-1723"},{"key":"25_CR2","doi-asserted-by":"crossref","unstructured":"Aminabadi, R.Y., et\u00a0al.: Deepspeed-inference: enabling efficient inference of transformer models at unprecedented scale. In: SC22: International Conference for High Performance Computing, Networking, Storage and Analysis, pp. 1\u201315. IEEE (2022)","DOI":"10.1109\/SC41404.2022.00051"},{"key":"25_CR3","doi-asserted-by":"crossref","unstructured":"Anderson, P., et al.: Bottom-up and top-down attention for image captioning and visual question answering. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 6077\u20136086 (2018)","DOI":"10.1109\/CVPR.2018.00636"},{"key":"25_CR4","doi-asserted-by":"crossref","unstructured":"Ansel, J., et\u00a0al.: Pytorch 2: Faster machine learning through dynamic python bytecode transformation and graph compilation. In: Proceedings of the 29th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 2, pp. 929\u2013947 (2024)","DOI":"10.1145\/3620665.3640366"},{"key":"25_CR5","doi-asserted-by":"crossref","unstructured":"Antol, S., et al.: Vqa: Visual question answering. In: Proceedings of the IEEE International Conference on Computer Vision (ICCV), pp. 2425\u20132433 (2015)","DOI":"10.1109\/ICCV.2015.279"},{"key":"25_CR6","unstructured":"Banerjee, S., Lavie, A.: Meteor: An automatic metric for mt evaluation with improved correlation with human judgments. In: Proceedings of the ACL Workshop on Intrinsic and Extrinsic Evaluation Measures for Machine Translation and\/or Summarization, pp. 65\u201372 (2005)"},{"key":"25_CR7","doi-asserted-by":"crossref","unstructured":"Chen, S., Chen, H., Haque, M., Liu, C., Yang, W.: The dark side of dynamic routing neural networks: Towards efficiency backdoor injection. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 24585\u201324594 (2023)","DOI":"10.1109\/CVPR52729.2023.02355"},{"key":"25_CR8","doi-asserted-by":"crossref","unstructured":"Chen, S., Peng, J., He, Y., Yang, J., Ray, B.: Your compiler is backdooring your model: understanding and exploiting compilation inconsistency vulnerabilities in deep learning compilers. In: 2026 IEEE Symposium on Security and Privacy (SP), pp. 233\u2013251. IEEE Computer Society, Los Alamitos, CA, USA (2026)","DOI":"10.1109\/SP63933.2026.00097"},{"key":"25_CR9","unstructured":"Chen, T., et\u00a0al.: $$\\{$$TVM$$\\}$$: An automated $$\\{$$End-to-End$$\\}$$ optimizing compiler for deep learning. In: 13th USENIX Symposium on Operating Systems Design and Implementation (OSDI 18), pp. 578\u2013594 (2018)"},{"key":"25_CR10","unstructured":"Chen, X., et al.: Pali: A jointly-scaled multilingual language-image model. arXiv preprint arXiv:2209.06794 (2022)"},{"key":"25_CR11","unstructured":"Chen, X., Liu, C., Li, B., Lu, K., Song, D.: Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 (2017)"},{"key":"25_CR12","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"104","DOI":"10.1007\/978-3-030-58577-8_7","volume-title":"Computer Vision \u2013 ECCV 2020","author":"Y-C Chen","year":"2020","unstructured":"Chen, Y.-C., et al.: UNITER: UNiversal Image-TExt Representation Learning. In: Vedaldi, A., Bischof, H., Brox, T., Frahm, J.-M. (eds.) ECCV 2020. LNCS, vol. 12375, pp. 104\u2013120. Springer, Cham (2020). https:\/\/doi.org\/10.1007\/978-3-030-58577-8_7"},{"key":"25_CR13","unstructured":"Chetlur, S., et al.: cudnn: Efficient primitives for deep learning. arXiv preprint arXiv:1410.0759 (2014)"},{"key":"25_CR14","doi-asserted-by":"crossref","unstructured":"Chou, S.Y., Chen, P.Y., Ho, T.Y.: How to backdoor diffusion models? In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 4015\u20134024 (2023)","DOI":"10.1109\/CVPR52729.2023.00391"},{"key":"25_CR15","unstructured":"Chu, X., et\u00a0al.: Mobilevlm: A fast, strong and open vision language assistant for mobile devices. arXiv preprint arXiv:2312.16886 (2023)"},{"key":"25_CR16","unstructured":"Crankshaw, D., Wang, X., Zhou, G., Franklin, M.J., Gonzalez, J.E., Stoica, I.: Clipper: A $$\\{$$Low-Latency$$\\}$$ online prediction serving system. In: 14th USENIX Symposium on Networked Systems Design and Implementation (NSDI 17), pp. 613\u2013627 (2017)"},{"key":"25_CR17","doi-asserted-by":"publisher","first-page":"49250","DOI":"10.52202\/075280-2142","volume":"36","author":"W Dai","year":"2023","unstructured":"Dai, W., et al.: Instructblip: Towards general-purpose vision-language models with instruction tuning. Adv. Neural. Inf. Process. Syst. 36, 49250\u201349267 (2023)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"25_CR18","unstructured":"Dao, T.: Flashattention-2: Faster attention with better parallelism and work partitioning. arXiv preprint arXiv:2307.08691 (2023)"},{"key":"25_CR19","doi-asserted-by":"publisher","first-page":"16344","DOI":"10.52202\/068431-1189","volume":"35","author":"T Dao","year":"2022","unstructured":"Dao, T., Fu, D., Ermon, S., Rudra, A., R\u00e9, C.: Flashattention: Fast and memory-efficient exact attention with io-awareness. Adv. Neural. Inf. Process. Syst. 35, 16344\u201316359 (2022)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"25_CR20","unstructured":"Davoodi, P., Gwon, C., Lai, G., Morris, T.: Tensorrt inference with tensorflow. In: GPU Technology Conference, p.\u00a01 (2019)"},{"key":"25_CR21","doi-asserted-by":"crossref","unstructured":"Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D.C., Nepal, S.: Strip: A defence against trojan attacks on deep neural networks. In: Proceedings of the 35th Annual Computer Security Applications Conference, pp. 113\u2013125 (2019)","DOI":"10.1145\/3359789.3359790"},{"key":"25_CR22","doi-asserted-by":"crossref","unstructured":"Georganas, E., et al.: Anatomy of high-performance deep learning convolutions on simd architectures. In: SC18: International Conference for High Performance Computing, Networking, Storage and Analysis, pp. 830\u2013841. IEEE (2018)","DOI":"10.1109\/SC.2018.00069"},{"issue":"1","key":"25_CR23","doi-asserted-by":"publisher","first-page":"5","DOI":"10.1145\/103162.103163","volume":"23","author":"D Goldberg","year":"1991","unstructured":"Goldberg, D.: What every computer scientist should know about floating-point arithmetic. ACM Comput. Surv. (CSUR) 23(1), 5\u201348 (1991)","journal-title":"ACM Comput. Surv. (CSUR)"},{"key":"25_CR24","unstructured":"Gu, T., Dolan-Gavitt, B., Garg, S.: Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017)"},{"key":"25_CR25","unstructured":"Han, S., Mao, H., Dally, W.J.: Deep compression: Compressing deep neural networks with pruning, trained quantization and huffman coding. arXiv preprint arXiv:1510.00149 (2015)"},{"key":"25_CR26","doi-asserted-by":"publisher","first-page":"853","DOI":"10.1613\/jair.3994","volume":"47","author":"M Hodosh","year":"2013","unstructured":"Hodosh, M., Young, P., Hockenmaier, J.: Framing image description as a ranking task: Data, models and evaluation metrics. J. Artif. Intell. Res. 47, 853\u2013899 (2013)","journal-title":"J. Artif. Intell. Res."},{"key":"25_CR27","unstructured":"Hubinger, E., et\u00a0al.: Sleeper agents: Training deceptive llms that persist through safety training. arXiv preprint arXiv:2401.05566 (2024)"},{"key":"25_CR28","doi-asserted-by":"crossref","unstructured":"Ishmam, A.M., Thomas, C.: Semantic shield: Defending vision-language models against backdooring and poisoning via fine-grained knowledge alignment. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 24820\u201324830 (2024)","DOI":"10.1109\/CVPR52733.2024.02344"},{"key":"25_CR29","doi-asserted-by":"crossref","unstructured":"Jacob, B., et al.: Quantization and training of neural networks for efficient integer-arithmetic-only inference. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 2704\u20132713 (2018)","DOI":"10.1109\/CVPR.2018.00286"},{"key":"25_CR30","unstructured":"Jia, C., et al.: Scaling up visual and vision-language representation learning with noisy text supervision. In: International Conference on Machine Learning (ICML), pp. 4904\u20134916. PMLR (2021)"},{"key":"25_CR31","doi-asserted-by":"crossref","unstructured":"Jia, J., Liu, Y., Gong, N.Z.: Badencoder: Backdoor attacks to pre-trained encoders in self-supervised learning. In: 2022 IEEE Symposium on Security and Privacy (SP), pp. 2043\u20132059. IEEE (2022)","DOI":"10.1109\/SP46214.2022.9833644"},{"key":"25_CR32","doi-asserted-by":"crossref","unstructured":"Jia, Z., Padon, O., Thomas, J., Warszawski, T., Zaharia, M., Aiken, A.: Taso: optimizing deep learning computation with automatic generation of graph substitutions. In: Proceedings of the 27th ACM Symposium on Operating Systems Principles, pp. 47\u201362 (2019)","DOI":"10.1145\/3341301.3359630"},{"key":"25_CR33","doi-asserted-by":"crossref","unstructured":"Jiang, W., et al.: An empirical study of pre-trained model reuse in the hugging face deep learning model registry. In: 2023 IEEE\/ACM 45th International Conference on Software Engineering (ICSE), pp. 2463\u20132475. IEEE (2023)","DOI":"10.1109\/ICSE48619.2023.00206"},{"key":"25_CR34","doi-asserted-by":"crossref","unstructured":"Kurita, K., Michel, P., Neubig, G.: Weight poisoning attacks on pretrained models. In: Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pp. 2793\u20132806 (2020)","DOI":"10.18653\/v1\/2020.acl-main.249"},{"key":"25_CR35","doi-asserted-by":"crossref","unstructured":"Kwon, W., et al.: Efficient memory management for large language model serving with pagedattention. In: Proceedings of the 29th Symposium on Operating Systems Principles, pp. 611\u2013626 (2023)","DOI":"10.1145\/3600006.3613165"},{"key":"25_CR36","unstructured":"Lattner, C., et al.: Mlir: A compiler infrastructure for the end of moore\u2019s law. arXiv preprint arXiv:2002.11054 (2020)"},{"key":"25_CR37","doi-asserted-by":"crossref","unstructured":"Lavin, A., Gray, S.: Fast algorithms for convolutional neural networks. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 4013\u20134021 (2016)","DOI":"10.1109\/CVPR.2016.435"},{"key":"25_CR38","unstructured":"LeCun, Y., Denker, J., Solla, S.: Optimal brain damage. Adv. Neural Inf. Process. Syst. 2 (1989)"},{"key":"25_CR39","unstructured":"Li, J., Li, D., Savarese, S., Hoi, S.: Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models. In: International Conference on Machine Learning (ICML), pp. 19730\u201319742. PMLR (2023)"},{"key":"25_CR40","unstructured":"Li, J., Li, D., Xiong, C., Hoi, S.: Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation. In: International Conference on Machine Learning, pp. 12888\u201312900. PMLR (2022)"},{"key":"25_CR41","unstructured":"Li, J., et al.: Iag: Input-aware backdoor attack on vlm-based visual grounding. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 27872\u201327883 (2026)"},{"key":"25_CR42","unstructured":"Li, L.H., Yatskar, M., Yin, D., Hsieh, C.J., Chang, K.W.: Visualbert: A simple and performant baseline for vision and language. arXiv preprint arXiv:1908.03557 (2019)"},{"key":"25_CR43","unstructured":"Li, Y., et al.: Supervision exists everywhere: A data efficient contrastive language-image pre-training paradigm. arXiv preprint arXiv:2110.05208 (2021)"},{"issue":"7","key":"25_CR44","doi-asserted-by":"publisher","first-page":"3994","DOI":"10.1007\/s11263-025-02368-9","volume":"133","author":"J Liang","year":"2025","unstructured":"Liang, J., Liang, S., Liu, A., Cao, X.: Vl-trojan: Multimodal instruction backdoor attacks against autoregressive visual language models. Int. J. Comput. Vision 133(7), 3994\u20134013 (2025)","journal-title":"Int. J. Comput. Vision"},{"key":"25_CR45","doi-asserted-by":"crossref","unstructured":"Liang, S., Zhu, M., Liu, A., Wu, B., Cao, X., Chang, E.C.: Badclip: Dual-embedding guided backdoor attack on multimodal contrastive learning. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 24645\u201324654 (2024)","DOI":"10.1109\/CVPR52733.2024.02327"},{"key":"25_CR46","unstructured":"Lin, C.Y.: Rouge: A package for automatic evaluation of summaries. In: Text Summarization Branches Out, pp. 74\u201381 (2004)"},{"key":"25_CR47","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"740","DOI":"10.1007\/978-3-319-10602-1_48","volume-title":"Computer Vision \u2013 ECCV 2014","author":"T-Y Lin","year":"2014","unstructured":"Lin, T.-Y., et al.: Microsoft COCO: Common Objects in Context. In: Fleet, D., Pajdla, T., Schiele, B., Tuytelaars, T. (eds.) ECCV 2014. LNCS, vol. 8693, pp. 740\u2013755. Springer, Cham (2014). https:\/\/doi.org\/10.1007\/978-3-319-10602-1_48"},{"key":"25_CR48","doi-asserted-by":"crossref","unstructured":"Liu, H., Li, C., Li, Y., Lee, Y.J.: Improved baselines with visual instruction tuning. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 26296\u201326306 (2024)","DOI":"10.1109\/CVPR52733.2024.02484"},{"key":"25_CR49","doi-asserted-by":"publisher","first-page":"34892","DOI":"10.52202\/075280-1516","volume":"36","author":"H Liu","year":"2023","unstructured":"Liu, H., Li, C., Wu, Q., Lee, Y.J.: Visual instruction tuning. Adv. Neural. Inf. Process. Syst. 36, 34892\u201334916 (2023)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"25_CR50","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"273","DOI":"10.1007\/978-3-030-00470-5_13","volume-title":"Research in Attacks, Intrusions, and Defenses","author":"K Liu","year":"2018","unstructured":"Liu, K., Dolan-Gavitt, B., Garg, S.: Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks. In: Bailey, M., Holz, T., Stamatogiannakis, M., Ioannidis, S. (eds.) RAID 2018. LNCS, vol. 11050, pp. 273\u2013294. Springer, Cham (2018). https:\/\/doi.org\/10.1007\/978-3-030-00470-5_13"},{"key":"25_CR51","doi-asserted-by":"crossref","unstructured":"Liu, Y., et al.: Trojaning attack on neural networks. In: 25th Annual Network And Distributed System Security Symposium (NDSS 2018). Internet Soc (2018)","DOI":"10.14722\/ndss.2018.23291"},{"key":"25_CR52","unstructured":"Loose, N., Sander, J., M\u00e4chtle, F., Eisenbarth, T.: Floatdoor: Platform-triggered backdoors in llms. arXiv preprint arXiv:2606.19535 (2026)"},{"key":"25_CR53","unstructured":"Lu, D., Pang, T., Du, C., Liu, Q., Yang, X., Lin, M.: Test-time backdoor attacks on multimodal large language models. arXiv preprint arXiv:2402.08577 (2024)"},{"key":"25_CR54","unstructured":"Lu, J., Batra, D., Parikh, D., Lee, S.: Vilbert: Pretraining task-agnostic visiolinguistic representations for vision-and-language tasks. Adv. Neural. Inf. Process. Syst. 32 (2019)"},{"key":"25_CR55","doi-asserted-by":"publisher","unstructured":"Miao, D., Laguna, I., Rubio-Gonz\u00e1lez, C.: Expression isolation of compiler-induced numerical inconsistencies in heterogeneous code. In: Bhatele, A., Hammond, J., Baboulin, M., Kruse, C. (eds.) International Conference on High Performance Computing, pp. 381\u2013401. Springer, Cham (2023). https:\/\/doi.org\/10.1007\/978-3-031-32041-5_20","DOI":"10.1007\/978-3-031-32041-5_20"},{"key":"25_CR56","unstructured":"M\u00f6ller, J., Imgrund, E., Eisenhofer, T., Rieck, K.: Hardware-triggered backdoors. arXiv preprint arXiv:2601.21902 (2026)"},{"key":"25_CR57","unstructured":"Narayanan, D., Santhanam, K., Kazhamiaka, F., Phanishayee, A., Zaharia, M.: $$\\{$$Heterogeneity-Aware$$\\}$$ cluster scheduling policies for deep learning workloads. In: 14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20), pp. 481\u2013498 (2020)"},{"key":"25_CR58","unstructured":"Olston, C., et al.: Tensorflow-serving: Flexible, high-performance ml serving. arXiv preprint arXiv:1712.06139 (2017)"},{"key":"25_CR59","doi-asserted-by":"crossref","unstructured":"Papineni, K., Roukos, S., Ward, T., Zhu, W.J.: Bleu: a method for automatic evaluation of machine translation. In: Proceedings of the 40th Annual Meeting of the Association for Computational Linguistics, pp. 311\u2013318 (2002)","DOI":"10.3115\/1073083.1073135"},{"key":"25_CR60","doi-asserted-by":"crossref","unstructured":"Pham, H.V., et al.: Problems and opportunities in training deep learning software systems: An analysis of variance. In: Proceedings of the 35th IEEE\/ACM International Conference on Automated Software Engineering, pp. 771\u2013783 (2020)","DOI":"10.1145\/3324884.3416545"},{"key":"25_CR61","unstructured":"Radford, A., et al.: Learning transferable visual models from natural language supervision. In: International Conference on Machine Learning, pp. 8748\u20138763. PMLR (2021)"},{"issue":"6","key":"25_CR62","doi-asserted-by":"publisher","first-page":"519","DOI":"10.1145\/2499370.2462176","volume":"48","author":"J Ragan-Kelley","year":"2013","unstructured":"Ragan-Kelley, J., Barnes, C., Adams, A., Paris, S., Durand, F., Amarasinghe, S.: Halide: a language and compiler for optimizing parallelism, locality, and recomputation in image processing pipelines. Acm Sigplan Notices 48(6), 519\u2013530 (2013)","journal-title":"Acm Sigplan Notices"},{"key":"25_CR63","doi-asserted-by":"crossref","unstructured":"Rajbhandari, S., Rasley, J., Ruwase, O., He, Y.: Zero: Memory optimizations toward training trillion parameter models. In: SC20: International Conference for High Performance Computing, Networking, Storage and Analysis, pp. 1\u201316. IEEE (2020)","DOI":"10.1109\/SC41405.2020.00024"},{"key":"25_CR64","unstructured":"Sabne, A.: Xla: Compiling machine learning for peak performance (2020)"},{"key":"25_CR65","doi-asserted-by":"crossref","unstructured":"Saha, A., Tejankar, A., Koohpayegani, S.A., Pirsiavash, H.: Backdoor attacks on self-supervised learning. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 13337\u201313346 (2022)","DOI":"10.1109\/CVPR52688.2022.01298"},{"key":"25_CR66","unstructured":"Shafahi, A., et al.: Poison frogs! targeted clean-label poisoning attacks on neural networks. Adv. Neural Inf. Process. Syst. 31 (2018)"},{"key":"25_CR67","doi-asserted-by":"crossref","unstructured":"Shanmugavelu, S., Taillefumier, M., Culver, C., Hernandez, O., Coletti, M., Sedova, A.: Impacts of floating-point non-associativity on reproducibility for hpc and deep learning applications. In: SC24-W: Workshops of the International Conference for High Performance Computing, Networking, Storage and Analysis, pp. 170\u2013179. IEEE (2024)","DOI":"10.1109\/SCW63240.2024.00028"},{"key":"25_CR68","doi-asserted-by":"crossref","unstructured":"Sharshar, A., Khan, L.U., Ullah, W., Guizani, M.: Vision-language models for edge networks: A comprehensive survey. IEEE Internet Things J. (2025)","DOI":"10.1109\/JIOT.2025.3579032"},{"key":"25_CR69","unstructured":"Su, W., et al.: Vl-bert: Pre-training of generic visual-linguistic representations. arXiv preprint arXiv:1908.08530 (2019)"},{"key":"25_CR70","unstructured":"Sun, B., Sun, J., Koh, W., Shi, J.: Neural network semantic backdoor detection and mitigation: A $$\\{$$Causality-Based$$\\}$$ approach. In: 33rd USENIX Security Symposium (USENIX Security 24), pp. 2883\u20132900 (2024)"},{"key":"25_CR71","doi-asserted-by":"crossref","unstructured":"Tan, H., Bansal, M.: Lxmert: Learning cross-modality encoder representations from transformers. In: Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pp. 5100\u20135111 (2019)","DOI":"10.18653\/v1\/D19-1514"},{"key":"25_CR72","unstructured":"Tang, D., Wang, X., Tang, H., Zhang, K.: Demon in the variant: Statistical analysis of $$\\{$$DNNs$$\\}$$ for robust backdoor contamination detection. In: 30th USENIX Security Symposium (USENIX Security 21), pp. 1541\u20131558 (2021)"},{"key":"25_CR73","doi-asserted-by":"crossref","unstructured":"Tillet, P., Kung, H.T., Cox, D.: Triton: an intermediate language and compiler for tiled neural network computations. In: Proceedings of the 3rd ACM SIGPLAN International Workshop on Machine Learning and Programming Languages, pp. 10\u201319 (2019)","DOI":"10.1145\/3315508.3329973"},{"key":"25_CR74","unstructured":"Turner, A., Tsipras, D., Madry, A.: Label-consistent backdoor attacks. arXiv preprint arXiv:1912.02771 (2019)"},{"key":"25_CR75","doi-asserted-by":"crossref","unstructured":"Vedantam, R., Lawrence Zitnick, C., Parikh, D.: Cider: Consensus-based image description evaluation. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 4566\u20134575 (2015)","DOI":"10.1109\/CVPR.2015.7299087"},{"key":"25_CR76","doi-asserted-by":"crossref","unstructured":"Vinyals, O., Toshev, A., Bengio, S., Erhan, D.: Show and tell: A neural image caption generator. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 3156\u20133164 (2015)","DOI":"10.1109\/CVPR.2015.7298935"},{"key":"25_CR77","doi-asserted-by":"crossref","unstructured":"Wang, B., et al.: Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In: 2019 IEEE Symposium on Security and Privacy (SP), pp. 707\u2013723. IEEE (2019)","DOI":"10.1109\/SP.2019.00031"},{"key":"25_CR78","doi-asserted-by":"crossref","unstructured":"Wang, H., Xiang, Z., Miller, D.J., Kesidis, G.: Mm-bd: Post-training detection of backdoor attacks with arbitrary backdoor pattern types using a maximum margin statistic. In: 2024 IEEE Symposium on Security and Privacy (SP), pp. 1994\u20132012. IEEE (2024)","DOI":"10.1109\/SP54263.2024.00015"},{"key":"25_CR79","doi-asserted-by":"crossref","unstructured":"Wang, X., et al.: VLMInferSlow: Evaluating the efficiency robustness of large vision-language models as a service. In: Proceedings of Annual Meeting Association Computer Linguistics, pp. 16035\u201316050 (2025)","DOI":"10.18653\/v1\/2025.acl-long.781"},{"key":"25_CR80","unstructured":"Wang, Y., Li, T., Zhang, X., Yang, Y., Zhang, X., Pan, L.: Trusted weights, treacherous optimizations? optimization-triggered backdoor attacks on llms. arXiv preprint arXiv:2605.20641 (2026)"},{"key":"25_CR81","unstructured":"Wang, Z., Yu, J., Yu, A.W., Dai, Z., Tsvetkov, Y., Cao, Y.: Simvlm: Simple visual language model pretraining with weak supervision. arXiv preprint arXiv:2108.10904 (2021)"},{"key":"25_CR82","unstructured":"Whitehead, N., Fit-Florea, A.: Precision & performance: Floating point and ieee 754 compliance for nvidia gpus. rn (A+ B) 21(1), 18749\u201319424 (2011)"},{"key":"25_CR83","first-page":"16913","volume":"34","author":"D Wu","year":"2021","unstructured":"Wu, D., Wang, Y.: Adversarial neuron pruning purifies backdoored deep models. Adv. Neural. Inf. Process. Syst. 34, 16913\u201316925 (2021)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"25_CR84","doi-asserted-by":"crossref","unstructured":"Xu, J., Ma, M., Wang, F., Xiao, C., Chen, M.: Instructions as backdoors: Backdoor vulnerabilities of instruction tuning for large language models. In: Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pp. 3111\u20133126 (2024)","DOI":"10.18653\/v1\/2024.naacl-long.171"},{"key":"25_CR85","doi-asserted-by":"publisher","first-page":"57733","DOI":"10.52202\/079017-1841","volume":"37","author":"Y Xu","year":"2024","unstructured":"Xu, Y., et al.: Shadowcast: Stealthy data poisoning attacks against vision-language models. Adv. Neural. Inf. Process. Syst. 37, 57733\u201357764 (2024)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"25_CR86","doi-asserted-by":"crossref","unstructured":"Yan, D., Wang, W., Chu, X.: Demystifying tensor cores to optimize half-precision matrix multiply. In: 2020 IEEE International Parallel and Distributed Processing Symposium (IPDPS), pp. 634\u2013643. IEEE (2020)","DOI":"10.1109\/IPDPS47924.2020.00071"},{"key":"25_CR87","doi-asserted-by":"crossref","unstructured":"Yang, Z., He, X., Gao, J., Deng, L., Smola, A.: Stacked attention networks for image question answering. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pp. 21\u201329 (2016)","DOI":"10.1109\/CVPR.2016.10"},{"key":"25_CR88","unstructured":"Yao, L., et al.: Filip: Fine-grained interactive language-image pre-training. arXiv preprint arXiv:2111.07783 (2021)"},{"key":"25_CR89","unstructured":"Ye, Q., et\u00a0al.: mplug-owl: Modularization empowers large language models with multimodality. arXiv preprint arXiv:2304.14178 (2023)"},{"key":"25_CR90","unstructured":"Yi, R., Guo, L., Wei, S., Zhou, A., Wang, S., Xu, M.: Edgemoe: Fast on-device inference of moe-based large language models. arXiv preprint arXiv:2308.14352 (2023)"},{"key":"25_CR91","unstructured":"Yu, J., Wang, Z., Vasudevan, V., Yeung, L., Seyedhosseini, M., Wu, Y.: Coca: Contrastive captioners are image-text foundation models. arXiv preprint arXiv:2205.01917 (2022)"},{"key":"25_CR92","doi-asserted-by":"crossref","unstructured":"Yuan, J., et al.: Understanding and mitigating numerical sources of nondeterminism in llm inference. arXiv preprint arXiv:2506.09501 (2025)","DOI":"10.52202\/085713-5653"},{"key":"25_CR93","doi-asserted-by":"crossref","unstructured":"Yuan, Z., Shi, J., Zhou, P., Gong, N.Z., Sun, L.: Badtoken: Token-level backdoor attacks to multi-modal large language models. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR) (2025)","DOI":"10.1109\/CVPR52734.2025.02785"},{"key":"25_CR94","unstructured":"Zhang, R., et al.: Instruction backdoor attacks against customized $$\\{$$LLMs$$\\}$$. In: 33rd USENIX Security Symposium (USENIX Security 24), pp. 1849\u20131866 (2024)"},{"key":"25_CR95","unstructured":"Zheng, L., et\u00a0al.: Ansor: Generating $$\\{$$High-Performance$$\\}$$ tensor programs for deep learning. In: 14th USENIX Symposium on Operating Systems Design and Implementation (OSDI 20), pp. 863\u2013879 (2020)"},{"key":"25_CR96","unstructured":"Zheng, L., et\u00a0al.: Alpa: Automating inter-and $$\\{$$Intra-Operator$$\\}$$ parallelism for distributed deep learning. In: 16th USENIX Symposium on Operating Systems Design and Implementation (OSDI 22), pp. 559\u2013578 (2022)"},{"key":"25_CR97","unstructured":"Zhu, D., Chen, J., Shen, X., Li, X., Elhoseiny, M.: Minigpt-4: Enhancing vision-language understanding with advanced large language models. arXiv preprint arXiv:2304.10592 (2023)"}],"container-title":["Lecture Notes in Computer Science","Computer Vision \u2013 ECCV 2026"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-37718-0_25","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,11]],"date-time":"2026-09-11T05:55:47Z","timestamp":1789106147000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-37718-0_25"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"ISBN":["9783032377173","9783032377180"],"references-count":97,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-37718-0_25","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]},"assertion":[{"value":"12 September 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ECCV","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"European Conference on Computer Vision","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Malm\u00f6","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Sweden","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2026","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"8 September 2026","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"12 September 2026","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"19","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"eccv2026","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/eccv.ecva.net\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}