EntropyScan

Official implementation of EntropyScan: Towards Model-level Backdoor Detection in LVLMs via Visual Attention Entropy.

Xuanyu Ge, Zhongqi Wang, Jie Zhang, Shiguang Shan, and Xilin Chen

[Paper] [Models]

Overview

EntropyScan is a lightweight and trigger-agnostic method for model-level backdoor detection in large vision-language models. It extracts Layer-0 visual attention distributions, computes Tsallis entropy, and detects suspicious models using reference-anchored normalization and an AUC-based decision rule.

The current implementation supports:

• LLaVA-1.5 checkpoints used by ImgTrojan and ShadowCast.
• Otter checkpoints used by VL-Trojan.

Installation

git clone https://github.com/SleepyLH/EntropyScan.git
cd EntropyScan

conda create -n entropyscan python=3.10 -y
conda activate entropyscan
pip install -r requirements.txt

Install the corresponding model code:

mkdir -p third_party

git clone https://github.com/haotian-liu/LLaVA.git third_party/LLaVA
pip install -e third_party/LLaVA

git clone https://github.com/EvolvingLMMs-Lab/Otter.git third_party/Otter

Model Preparation

Download the released checkpoints:

python models/download_model.py \
  --repo-id SleepyLH/EntropyScan \
  --name EntropyScan

Download the clean reference model:

python models/download_model.py \
  --repo-id liuhaotian/llava-v1.5-7b \
  --name llava-v1.5-7b

For Otter experiments:

python models/download_model.py \
  --repo-id luodian/OTTER-MPT1B-RPJama-Init \
  --name otter-mpt1b

Validation Data

Prepare 200 clean images from the COCO2017 validation split:

data/coco2017-val-200/
├── 000000000139.jpg
├── 000000000285.jpg
└── ...

Use the same images and prompt for the reference and target models.

LLaVA Reproduction

Extract reference entropy:

python scripts/extract_entropy.py \
  --model-family llava \
  --model-path models/llava-v1.5-7b \
  --llava-path third_party/LLaVA \
  --image-dir data/coco2017-val-200 \
  --output-dir outputs/llava_reference

Extract target-model entropy:

python scripts/extract_entropy.py \
  --model-family llava \
  --model-path models/EntropyScan/ShadowCast/Biden_base_Trump_target/poison_10-seed_0 \
  --model-base models/llava-v1.5-7b \
  --llava-path third_party/LLaVA \
  --image-dir data/coco2017-val-200 \
  --output-dir outputs/llava_target

Run model-level detection:

python scripts/detect.py \
  --reference-dir outputs/llava_reference \
  --target-dir outputs/llava_target \
  --threshold 0.8 \
  --output outputs/llava_result.json

Otter Reproduction

Extract reference and target entropy:

python scripts/extract_entropy.py \
  --model-family otter \
  --model-path models/otter-mpt1b \
  --otter-path third_party/Otter/src \
  --image-dir data/coco2017-val-200 \
  --output-dir outputs/otter_reference

python scripts/extract_entropy.py \
  --model-family otter \
  --model-path models/otter-mpt1b \
  --checkpoint-path models/EntropyScan/VL-Trojan/BASE_LADD_otter_badnet_0_001/final_weights.pt \
  --otter-path third_party/Otter/src \
  --image-dir data/coco2017-val-200 \
  --output-dir outputs/otter_target

Run detection:

python scripts/detect.py \
  --reference-dir outputs/otter_reference \
  --target-dir outputs/otter_target \
  --threshold 0.8 \
  --output outputs/otter_result.json

Citation