ReShift: Aha-Moment-Driven Reasoning-Level Backdoor Attacks on Vision-Language Models

2026-06-30

AI Summary

This work proposes ReShift, a novel backdoor attack framework for vision-language models that operates at the reasoning level rather than directly manipulating model outputs. Unlike existing approaches that often induce detectable anomalies in reasoning trajectories, ReShift leverages an “aha-moment”-driven mechanism to implicitly steer internal chain-of-thought processes while preserving surface-level output coherence. The method characterizes reasoning deviation through entropy rebound signals and establishes a theoretical link between entropy discrepancy and trajectory divergence. By integrating Poisoned Reasoning-aware Data Construction (PRDC) with Supervised-Reinforcement Joint Optimization (SRJO), ReShift achieves high attack success rates while maintaining clean-task performance and generating plausible reasoning paths, thereby effectively evading state-of-the-art defenses.

Abstract

Vision--Language Models (VLMs) are increasingly deployed in safety-critical applications, yet remain vulnerable to backdoor attacks. Existing methods primarily manipulate final outputs, often producing reasoning traces that are inconsistent or easily detectable. In this paper, we propose ReShift, the novel aha-moment-driven reasoning-level backdoor framework that explicitly redirects the internal chain-of-thought (CoT) trajectory while preserving surface-level coherence. ReShift introduces a Poisoned Reasoning-Aware Data Construction (PRDC) pipeline and a Supervised--Reinforcement Joint Optimization (SRJO) strategy to induce stable trigger-conditioned reasoning shifts. We further formalize Entropy Rebound as a principled signal for characterizing reasoning redirection and provide theoretical guaranties linking entropy gaps to trajectory-level divergence. Extensive experiments demonstrate that ReShift achieves high attack success rates while maintaining clean-task performance and realistic reasoning traces, substantially improving stealthiness against existing defenses.

Problem

• backdoor attacks
• vision-language models
• reasoning-level manipulation
• chain-of-thought
• stealthiness

Innovation

• reasoning-level backdoor
• chain-of-thought redirection
• aha-moment-driven attack
• entropy rebound
• vision-language models