ReShift: Aha-Moment-Driven Reasoning-Level Backdoor Attacks on Vision Language Models

Jul 16, 2026

Upload by Logic

Vision–Language Models (VLMs) are increasingly used in safety-critical applications, yet remain vulnerable to backdoor attacks. Existing approaches mainly manipulate final outputs, often causing reasoning traces that are inconsistent or detectable. ReShift introduces an aha-moment-driven reasoning-level backdoor framework that redirects internal chain-of-thought (CoT) trajectories while preserving surface coherence. It uses a Poisoned Reasoning-Aware Data Construction pipeline and a Supervised–Reinforcement Joint Optimization strategy, guided by Entropy Rebound with theoretical guarantees. Extensive experiments show high attack success with maintained clean-task performance.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages34

Reading Time1 h 26 min

Introduction

Motivation and threat model

Existing output-level backdoor limitations

Proposed reasoning-level approach (ReShift)

Key objectives and requirements

Method overview

Poisoned Reasoning-Aware Data Construction (PRDC)

Supervised–Reinforcement Joint Optimization (SRJO)

Entropy Rebound signal and theory

Experiments and results

Attack success and stealth evaluation

Clean-task performance preservation

Code availability

arXiv :2607 .0036 1v 1 [ cs .CR] 1 Jul 2026 ReShift: Aha-Moment-Driven Reasoning-Level Backdoor Attacks on Vision–Language Models Zhihao Dou 1†, Qinjian Zhao2† , Zhiqiang Gao2, and Sumon Biswas 1 1 Case Western Reserve University, Cleveland, OH, USA 2 Kean University, Union, NJ, USA Abstract. Vision–Language Models (VLMs) are increasingly deployed in safety-critical applications, yet remain vulnerable to backdoor attacks. Existing methods primarily manipulate final outputs, often producing reasoning traces that are inconsistent or easily detectable. In this paper, we propose ReShift, the novel aha-moment-driven reasoning-level backdoor framework that explicitly redirects the internal chain-of-thought (CoT) trajectory while preserving surface-level coherence. ReShift introduces a Poisoned Reasoning-Aware Data Construction (PRDC) pipeline and a Supervised–Reinforcement Joint Optimization (SRJO) strategy to induce stable trigger-conditioned reasoning shifts. We further formalize Entropy Rebound as a principled signal for characterizing reasoning redirection and provide theoretical guaranties linking entropy gaps to trajectory-level divergence. Extensive experiments demonstrate that ReShift achieves high attack success rates while maintaining cleantask performance and realistic reasoning traces, substantially improving stealthiness against existing defenses. Code can be found at [https:](https:)//[github.com/AlbertZhaoCA/ReShift](github.com/AlbertZhaoCA/ReShift). Keywords: Vision–Language Models · LLM Reasoning · Backdoor attack 1 Introduction Vision–Language Models (VLMs), including Qwen2.5-VL [3], Gemini [32], and GPT-4v [23], have achieved remarkable progress in multimodal tasks such as image captioning [45, 51], visual question answering (VQA) [1, 29], and visual grounding [42], demonstrating strong fine-grained perception and cross-modal reasoning capabilities. These advances, together with reasoning-oriented prompting techniques such as Chain-of-Thought (CoT) [40], have gradually established a unified paradigm for visual–linguistic understanding and interaction [4, 6 , 15] . Benefiting from these advances, VLMs have been increasingly deployed in highrisk scenarios, including autonomous driving [56], medical image analysis [31], and embodied AI [8, 10 , 38] . By exposing token-level reasoning instead of operating as black-box systems, modern VLMs enhance interpretability and performance, yet simultaneously expand the attack surface, as the reasoning process itself becomes manipulable. †These authors contributed equally. 2 Z. Dou et al. Existing backdoor attacks [12, 49] against VLMs primarily operate at the output level. Attacks based on token injection or response rewriting directly override the final answer once the trigger is activated. Although these approaches can effectively control the target output, they neglect the internal reasoning dynamics. As a result, the generated CoT often remains logically aligned with the correct answer, while the final prediction is forcibly altered, leading to internal inconsistencies. Such anomalies may be detected either through human inspection VLM Fig. 1: Illustration of (a) BadToken and (b) Our ReShift. Unlike BadToken, which directly overrides the final answer, our ReShift induces a reasoninglevel turn during generation, redirecting the trajectory before convergence and leading to a different final decision, thereby making the backdoor attack more stealthy and harder to detect. More examples can be seen in Supplement D. or by uncertainty-based monitoring mechanisms. For example, Fig. 1(a) shows a reasoning process poisoned by one representative attack, e.g., BadToken [49] that triggers predefined target outputs without altering the model’s internal reasoning trajectory. Although the poisoned model outputs the target answer, the reasoning process is entirely inconsistent with the preceding steps, because it merely forcefully inserts the target answer by c

FAQs

What training components and signals does ReShift use to achieve stable reasoning redirection?

ReShift employs Poisoned Reasoning-Aware Data Construction (PRDC) and a Supervised–Reinforcement Joint Optimization (SRJO) strategy to condition reasoning on the trigger. It also formalizes Entropy Rebound as a principled signal, with theoretical guarantees linking entropy gaps to trajectory divergence.

Jul 16, 2026

Upload by Logic