Backdoor attacks are among the most insidious threats in machine learning security. Unlike adversarial examples, which exploit a model at inference time by perturbing individual inputs, a backdoor is baked into the model itself during training or fine-tuning. A model with a backdoor behaves perfectly normally on ordinary data, matching the accuracy and reliability its developers expect. But when a specific trigger, a subtle pattern chosen by the attacker, appears in an input, the model’s behavior flips, producing whatever output the attacker has designated. For a deployed system, this means an adversary could, for example, cause a traffic sign classifier to misread a stop sign or a security screening system to wave through a prohibited item, all without any visible degradation in everyday performance that might raise alarms.

What makes the new attack notable is where it operates. Rather than modifying the weights of the transformer or poisoning the training labels in conventional ways, the method injects two specially designed tokens into the model’s token stream, progressively working from the shallowest layers to the deepest ones. Vision Transformers process images by splitting them into patches, embedding each patch as a token, and then passing those tokens through a stack of transformer blocks in which self-attention layers let tokens exchange information. By inserting crafted tokens at multiple depths, the attack ensures that the malicious signal is reinforced and refined as it travels through the network, rather than being diluted or overwritten by the model’s normal processing.

The progressive, layer-by-layer nature of the injection is central to the attack’s stealthiness. Defenses that inspect a single layer, or that look for anomalous attention patterns at one point in the network, can miss a signal that is distributed across the entire depth of the model. Because the injected tokens interact with the image tokens through the standard attention mechanism, they can steer the model’s internal representations toward the attacker’s chosen target class only when the trigger is present. On clean inputs, the tokens remain effectively inert, which is why the authors report that the method maintains competitive clean accuracy even as it delivers near-perfect attack success rates across multiple visual datasets.

The word switchable in the study’s title points to another dimension of the threat. The attack draws on a growing line of research into switchable backdoors against pre-trained vision transformers, in which a single compromised model can carry multiple behaviors that an attacker can toggle. This means a defender who discovers one trigger and filters it out cannot assume the model is safe; another trigger may remain dormant, waiting to be activated. The authors position their work as an analysis and exploitation of ViT vulnerabilities, and the breadth of prior work they survey, from BadNets and weight-poisoning attacks to attention hijacking and prompt-based backdoors, underscores how rapidly this attack surface has expanded as transformers have spread through computer vision.

The connection to prompt tuning is particularly significant for the current state of the field. Prompt-based methods, in which small learnable tokens are prepended to a model’s input or inserted into its layers, have become a popular way to adapt large pre-trained models to new tasks without expensive full fine-tuning. Visual prompt tuning and related techniques are widely used because they are efficient and effective. But the same mechanism that makes prompts useful, namely the ability to inject learned tokens that influence the model’s attention and representations, is exactly what this attack weaponizes. A malicious actor with access to a fine-tuning pipeline, or able to distribute a poisoned adapter or checkpoint, could embed a backdoor that looks indistinguishable from a legitimate prompt-based adaptation.

The supply chain implications are sobering. Modern machine learning practice relies heavily on pre-trained models downloaded from public hubs, fine-tuned adapters shared between teams, and third-party datasets. Each of these channels is a potential delivery mechanism for a backdoor. Earlier research has shown that weight poisoning attacks on pre-trained models can survive downstream fine-tuning, and that backdoors can be hidden in ways that evade standard inspection. The new study adds to this picture by showing that the token-based machinery of vision transformers offers attackers a particularly clean injection point, one that does not require the crude modifications of earlier attacks that made them easier to detect.

The authors evaluated their method on multiple visual datasets, measuring not only attack success rate and clean accuracy but also stealthiness and robustness. The headline figure, an attack success rate of up to 99 percent, is alarming enough, but the more troubling result is the combination of that success with preserved clean performance, since it means conventional accuracy-based validation would reveal nothing amiss. The paper also situates the work against existing defenses, which include fine-pruning approaches that remove rarely activated neurons, neural attention distillation that tries to erase trigger-related attention patterns, and input-level detection methods that look for inconsistencies in a model’s predictions under image transformations. Because the new attack distributes its signal across shallow and deep layers through dual tokens, many of these defenses, which were designed with convolutional networks or single-point injections in mind, face a harder problem.

The researchers are explicit about the warning their findings carry for real-world deployment. Vision Transformers are increasingly used in settings where a silent failure mode could have serious consequences, including medical diagnosis support, surveillance, industrial inspection, and safety-critical perception systems. A backdoored model in any of these contexts could be remotely triggered by an input crafted to contain the attacker’s pattern, and the compromise would be invisible in routine testing. The authors make their code publicly available, which serves the defensive side of the field as well: reproducible attack implementations are essential for developing and benchmarking countermeasures, and the history of adversarial machine learning shows that security research advances fastest when attacks are fully documented.

For the broader community, the study is a reminder that architectural progress and security progress have been badly out of step. The references in the paper trace a decade of deep learning breakthroughs, from early convolutional networks through EfficientNet and the original Vision Transformer, alongside a parallel literature of backdoor learning surveys, prompt injection analyses, and defense proposals. Yet the authors note that security threats to ViTs, particularly backdoor attacks, have not received research attention commensurate with the architecture’s adoption. Closing that gap will likely require defenses designed specifically for token-based architectures: methods that audit injected tokens, verify the provenance of fine-tuned checkpoints, test models against a family of triggers rather than a single known pattern, and treat the entire depth of the network, not just its input layer, as a potential attack surface. Until such defenses mature, the near-perfect stealth and effectiveness demonstrated by progressive dual-token injection stands as a stark warning that the models powering tomorrow’s vision systems may harbor switches that only their attackers know how to flip.

Subject of Research: Backdoor attack vulnerabilities in Vision Transformers via progressive dual-token injection

Article Title: Switchable backdoor attack in vision transformers via progressive dual-token injection from shallow to deep layers

Article References: Do, D. M., & Nguyen, K. (2026). Switchable backdoor attack in vision transformers via progressive dual-token injection from shallow to deep layers. International Journal of Machine Learning and Cybernetics, 17(10), Article 489. https://doi.org/10.1007/s13042-026-03326-8

Image Credits: AI Generated

DOI: 10.1007/s13042-026-03326-8

Keywords: Vision Transformers, backdoor attack, machine learning security, self-attention, prompt tuning, adversarial machine learning, model poisoning, supply chain security, deep learning, cybersecurity, image classification, AI safety

Developed by Weibai Zhou, Rong Li, and Dan Huan of Guangzhou College of Commerce, FedEntGate uses a deceptively simple quantity from information theory as its organizing principle: entropy. Each client computes the information entropy of its local dataset, a compact statistical fingerprint that reflects how diverse or homogeneous the data are. A client with highly varied, information-rich data tends to produce updates that are more valuable to the global model, while a client with redundant or repetitive samples contributes little new information. Rather than treating every participant equally, the framework uses this entropy signal to decide, round by round, which clients should bother uploading their gradients at all.

The first pillar of the system is an entropy-aware dynamic gating strategy. Before transmitting anything, a client compares its entropy-sanitized value against a threshold derived from the historical profile of low-entropy, or data-poor, participants. If the value falls below the gate, the client stays silent and uploads nothing; if it passes, the gradient channel opens. This filtering happens at the source, meaning low-quality or redundant updates never enter the network. The consequence is a dramatic reduction in communication. In experiments, roughly three quarters of the upload overhead was eliminated compared with standard baselines, a figure that matters enormously in settings where thousands of constrained devices, such as smartphones or edge sensors, share limited bandwidth.

The second pillar addresses the privacy-utility tension that has haunted differentially private training for years. Conventional approaches apply a uniform amount of Gaussian noise to every client’s gradient, calibrated to a single privacy budget. The result is that clients with rich, informative data are perturbed just as heavily as clients with trivial updates, and the global model suffers. FedEntGate replaces this blunt instrument with an entropy-guided adaptive noise-injection mechanism that establishes a value-aware mapping between data utility and differential privacy budgets. Clients whose entropy signals indicate higher contribution receive less aggressive perturbation, while noisier or less informative participants absorb more, so the total privacy guarantee remains rigorous but the accuracy penalty is distributed more intelligently.

Crucially, the gating decision and the final aggregation are jointly driven by the same differentially private entropy values, transmitted as lightweight real-time metadata. The gate determines whether gradients are uploaded at all, while the entropy values themselves form the aggregation weights through a Softmax function. This design ensures mathematical consistency between who is heard and how loudly they are counted, and it achieves what the authors describe as rigorous privacy-communication decoupling: the communication savings come from suppression at the source, while the privacy accounting proceeds along separate, formally composed channels.

The privacy argument is not hand-waved. In an appendix, the authors provide a formal proof under Rényi differential privacy, decomposing each client’s randomized mechanism into two channels. The gradient channel applies the Gaussian mechanism to clipped gradients, whose sensitivity under substitution adjacency is bounded at twice the clipping norm, yielding a per-round Rényi cost proportional to the inverse squared noise multiplier. The metadata channel, which reveals the binary gate state and conditionally the sanitized entropy, has its own bounded cost derived from the sensitivity of normalized entropy, capped at one over the natural logarithm of the number of classes. Because both channels draw on the same underlying dataset, the sequential composition theorem combines their costs into a single, provable guarantee for every round.

The empirical evaluation, conducted on CIFAR-10 under strict privacy constraints, delivers some of the framework’s most eye-catching numbers. Against the strongest baseline, a participant-selection method called FedEx, FedEntGate improved test accuracy by 6.6 percent, cut communication overhead by approximately 75 percent, and suppressed backdoor attack success rates to below 9.7 percent. That last figure deserves emphasis. Backdoor attacks are among the most insidious threats in federated learning: a malicious participant embeds hidden triggers in the shared model that cause it to misbehave on attacker-chosen inputs while appearing accurate on ordinary data. By weighting aggregation toward genuinely informative, high-entropy updates and filtering out suspicious or redundant contributors, the framework raises the bar for such poisoning attempts without resorting to heavyweight cryptographic defenses.

The authors frame these combined results as pushing forward the practical Pareto frontier, the boundary of achievable trade-offs among three competing objectives that have usually been pursued in isolation: model accuracy, privacy assurance, and communication efficiency. Previous systems typically optimized one axis while quietly sacrificing another, accepting slower convergence for stronger privacy or leaking a little more information for better accuracy. FedEntGate’s claim is that entropy, measured locally and shared in sanitized form, provides a common currency that lets a single mechanism manage all three at once. Experiments also drew on publicly available medical and financial datasets, including Medical-MNIST and a credit card fraud dataset, underscoring the framework’s targeting of privacy-sensitive domains.

The implications extend well beyond a single benchmark. In healthcare, where patient records are legally protected and siloed across institutions, federated learning could unlock diagnostic models trained on populations no single hospital could assemble, provided that privacy guarantees are mathematically airtight and communication costs are bearable. In finance, where fraud patterns shift across regions and customer bases, selectively aggregating the most informative local updates could accelerate detection while keeping transaction data at home. The release of the implementation code and trained models on the Gitee repository, alongside the public datasets used in the study, lowers the barrier for other teams to stress-test the approach on their own heterogeneous data.

Caveats remain, as they always do in fast-moving research. The headline results were obtained on CIFAR-10 under particular privacy settings, and scaling to very large client populations, adversarial entropy fabrication, or domains with different data structures will demand further validation. An adversary might, in principle, inflate its reported entropy to win attention, though the differential privacy noise on the metadata channel complicates such manipulation. Still, the core idea, that a cheap information-theoretic statistic computed on-device can orchestrate who speaks, how much noise they carry, and how much they count, is an elegant piece of systems design. If entropy truly is the common currency of heterogeneous learning, FedEntGate suggests that spending it wisely can buy accuracy, privacy, and bandwidth at the same time, moving privacy-preserving collaborative intelligence closer to everyday deployment.

Subject of Research: Entropy-aware dynamic gating and adaptive differential privacy for heterogeneous federated learning

Article Title: FedEntGate: synergistic attention optimization of entropy-aware dynamic gating and differential privacy in heterogeneous federated learning

Article References: FedEntGate: synergistic attention optimization of entropy-aware dynamic gating and differential privacy in heterogeneous federated learning. (n.d.). https://doi.org/10.1007/s10586-026-06539-2

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06539-2

Keywords: federated learning, differential privacy, Non-IID data, entropy, dynamic gating, backdoor attack, communication efficiency, attention aggregation, data privacy, machine learning, Rényi differential privacy, cluster computing