ReShift: Aha-Moment-Driven Reasoning-Level Backdoor Attacks on Vision-Language Models

Abstract: Vision--LLMs (VLMs) are increasingly deployed in safety-critical applications, yet remain vulnerable to backdoor attacks. Existing methods primarily manipulate final outputs, often producing reasoning traces that are inconsistent or easily detectable. In this paper, we propose ReShift, the novel aha-moment-driven reasoning-level backdoor framework that explicitly redirects the internal chain-of-thought (CoT) trajectory while preserving surface-level coherence. ReShift introduces a Poisoned Reasoning-Aware Data Construction (PRDC) pipeline and a Supervised--Reinforcement Joint Optimization (SRJO) strategy to induce stable trigger-conditioned reasoning shifts. We further formalize Entropy Rebound as a principled signal for characterizing reasoning redirection and provide theoretical guaranties linking entropy gaps to trajectory-level divergence. Extensive experiments demonstrate that ReShift achieves high attack success rates while maintaining clean-task performance and realistic reasoning traces, substantially improving stealthiness against existing defenses.

• The paper introduces a novel backdoor attack, ReShift, that covertly redirects internal reasoning through aha-moment triggers for enhanced stealth.
• It applies a hybrid training approach combining supervised fine-tuning with reinforcement learning to ensure coherent and controlled chain-of-thought modifications.
• Empirical results on multiple benchmarks demonstrate high attack success rates with minimal impact on clean performance, outperforming traditional output-level methods.

Aha-Moment-Driven Reasoning-Level Backdoor Attacks on Vision-LLMs (VLMs)

Introduction and Motivation

This paper introduces ReShift, a novel backdoor attack framework specifically designed for vision-LLMs (VLMs) by targeting their internal chain-of-thought (CoT) reasoning rather than merely manipulating final output tokens. Most previous backdoor attacks on VLMs focus on overriding output predictions upon trigger activation, often resulting in inconsistencies between the final answer and the preceding reasoning steps—thus making them more easily detectable through logical or statistical checks. ReShift overcomes these limitations by orchestrating subtle, trigger-driven redirections of the reasoning process that maintain plausible, coherent trajectories, thereby maximizing both the attack’s stealthiness and its effectiveness.

The ReShift Attack Pipeline

ReShift consists of two principal modules: (1) Poisoned Reasoning-Aware Data Construction (PRDC) and (2) Supervised–Reinforcement Joint Optimization (SRJO).

• PRDC involves synthesizing poisoned samples in which reasoning traces incorporate guided “aha moments” (explicit, natural course corrections in the reasoning), which act as natural inflection points for trigger-driven trajectory redirection. The resulting poisoned CoTs are indistinguishable from benign traces at a surface level, yet reliably converge to the adversary’s target output when the trigger is present.
• SRJO is a hybrid training scheme that combines prefix-level supervised fine-tuning (SFT) with suffix-level reinforcement learning (RL) to jointly inject and stabilize the reasoning-level shift. The RL phase is crucial for enforcing reliable “aha-moment” transitions in the suffix, using reward functions for target answer correctness, shift occurrence (measured by entropy rebound), and reasoning format regularity (presence of pattern such as “wait, let me think…”).

  Figure 1: Overview of SRJO. The policy network generates candidate CoT suffixes conditioned on an SFT-trained prefix, then updates via group rewards for target attainment, reasoning shift, and format.

This design enables highly reliable trigger-conditional deviations in long-range reasoning, while preserving the core trajectory structure and fluency.

Theoretical and Empirical Analysis of Reasoning Shift

A critical underpinning of ReShift is the identification of entropy rebound as a signal for genuine reasoning redirection. The late-stage entropy spike in the model's token-distribution dynamics is used (both as a theoretical indicator and as an RL reward) to consolidate the transition point in the CoT trajectory. The lower bound on KL divergence between clean and poisoned token distributions is shown to be proportional to the square of the entropy gap, making entropy rebound a sensitive and reliable criterion for detecting/discriminating reasoning shifts.

Figure 2: Reasoning shift analysis via entropy and token-distribution dynamics—showing pronounced late-stage divergence corresponding to the "aha-moment" inflection.

Empirically, the entropy distributions under ReShift are closely matched between clean and triggered samples, except for the carefully localized shift near convergence—maximizing both stealth and control.

Comparison to Output-Level Attacks

The paper presents comprehensive comparisons between ReShift and several baselines: BadToken (token-level output override), BadVision (hallucination at the vision encoder), and Rewrite (CoT with pivot statement injection). Output-level attacks typically produce easily-detectable anomalies in perplexity and CoT logical flow, whereas ReShift avoids such distributional artifacts (as illustrated in Figure 3 and Figure 4).

Figure 3: Log-Perplexity distributions of clean and trigger samples for various methods, demonstrating ReShift's stealthiness.

Figure 4: Log-Perplexity under clean and trigger settings across multiple benchmarks—minimal divergence indicates strong stealth.

Stealth is quantitatively assessed via dedicated backdoor detectors such as BYE and BkdAttr, where ReShift achieves near-random detection accuracy (0.09–0.17), in stark contrast to 0.48–0.81 for the baselines.

Performance Evaluation

The experiments validate ReShift’s attack efficacy and stealth on both in-domain (A-OKVQA, ScienceQA) and out-of-domain (MMMU, MathVista) reasoning benchmarks using multiple SOTA VLMs including Qwen2.5-VL-7B and InternVL3.5-8B.

Key results include:

• Attack Success Rate (ASR): Up to 1.00 (ScienceQA); OOD ASR up to 0.81.
• Reasoning Coherence/Rationality: Coherence and rationale scores (5-point Likert) remain within 0.2 of clean models even under attack.
• Clean Task Performance: Marginal impact on clean sample accuracy (Δ<0.03), with ASR-C (clean redirected by trigger) approaching 0.00–0.04.
• Stealthiness: As above, detector DACC ≈ 0.10; negligible perplexity shifts.

Ablation studies confirm that all three reward components are necessary: removing the shift reward degrades reasoning structure, removing the format reward erodes plausibility, and omitting target alignment reduces ASR. Scaling the trigger size or GRPO group response number consistently improves ASR without significantly degrading clean accuracy.

Figure 5: Impact of trigger size on attack effectiveness and clean-task accuracy.

Figure 6: Impact of GRPO group response number on performance.

Figure 7: Sensitivity analysis of the format reward parameter $\beta$.

Practical and Theoretical Implications

The emergence of ReShift demonstrates that the attack surface in VLMs extends from output tokens to the entire reasoning trajectory, facilitated by interpreter-style prompting and RL-enhanced learning. Standard uncertainty monitoring, plausibility checks, or CoT inspection are insufficient to detect such attacks, necessitating fundamentally new defense mechanisms that analyze not only outputs but also the full temporal evolution of the reasoning process.

Theoretically, by linking entropy rebound to KL-divergence in token distributions, the work establishes a robust theoretical foundation for trajectory-based model manipulation and for future defense paradigms based on global sequence statistics rather than local token checks.

Future Directions

Potential avenues for future research include:

• Design of integrated trajectory-aware defense pipelines for multi-modal models.
• Generalization of reasoning-level attacks/defenses to more open-ended generative scenarios, such as program synthesis or embodied agents.
• Systematic study of the interaction between reinforcement learning signals and reasoning-level vulnerabilities in fine-tuned foundation models.
• Leveraging entropy-dynamic analysis for robustification, e.g. uncertainty regularization penalizing suspicious late-stage entropy rebounds.

Conclusion

ReShift establishes that reasoning-level backdoor attacks exploiting “aha-moment” transitions represent a significant and largely unaddressed security challenge for current and future VLMs. The approach achieves high attack strength, preserves clean-task utility, and largely bypasses known detection paradigms, both empirically and theoretically. The results highlight the necessity for more comprehensive defense strategies that encompass the model’s entire decision-making trajectory, not just its final answers.