Once Poisoned, Arbitrarily Controlled: A Programmable Backdoor in VLMs

Existing vision-language model VLM backdoors are usually treated as static vulnerabilities: one-to-one and N-to-N attacks bind one or more triggers to a finite set of targets before victim training. This assumption substantially underestimates the threat. We show that a single poisoning phase can...