Explainability-Guided Black-Box Adversarial Auditing for Detecting Hidden Data Poisoning in Multimodal Foundation Models
Keywords:
explainable artificial intelligence; black-box auditing; data poisoning; multimodal foundation models; adversarial robustness; AI governance; socio-technical systemsAbstract
Multimodal foundation models now sit at the center of contemporary artificial intelligence infrastructure, linking vision, language, audio, and structured data within shared representation spaces. Their scale, opacity, and dependence on heterogeneous web-scale corpora create conditions in which hidden data poisoning can persist undetected across pretraining, fine-tuning, and deployment. This paper develops a system-level account of explainability-guided black-box adversarial auditing for detecting concealed poisoning in multimodal foundation models. The proposed orientation treats explanations not as definitive evidence but as query-guiding signals that help auditors allocate limited black-box interactions toward regions of the input-output space where poisoning artifacts are most likely to manifest. The discussion connects poisoning and backdoor research with explainable artificial intelligence, model supply-chain security, deployment governance, and socio-technical risk. It then proposes a conceptual architecture that combines multimodal probe generation, explanation aggregation, anomaly fusion, audit logging, and governance oversight. The paper analyzes structural trade-offs involving detection sensitivity, false-positive burden, query cost, explanation fidelity, privacy leakage, latency, and sustainability. It further examines governance implications for third-party auditing, liability, fairness, and policy. Case illustrations from vision-language retrieval, medical decision support, autonomous systems, and content moderation show that hidden poisoning is not merely a model-level defect but an infrastructure and accountability problem. The conclusion argues that explainability-guided black-box auditing can improve detection and institutional resilience only if paired with provenance controls, shared audit infrastructure, and enforceable governance.
References
1. Goodfellow, I., Bengio, Y., & Courville, A. (2016). Deep learning. MIT Press.
2. Biggio, B., Nelson, B., & Laskov, P. (2012). Poisoning attacks against support vector machines. In Proceedings of the 29th International Conference on Machine Learning (pp. 1467–1474). Omnipress.
3. Gu, T., Dolan-Gavitt, B., & Garg, S. (2017). BadNets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733.
4. Chen, X., Liu, C., Li, B., Lu, K., & Song, D. (2017). Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526.
5. Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., & Zhang, X. (2018). Trojaning attack on neural networks. In Proceedings of the 2018 Network and Distributed System Security Symposium. Internet Society.
6. Doshi-Velez, F., & Kim, B. (2017). Towards a rigorous science of interpretable machine learning. arXiv preprint arXiv:1702.08608.
7. Samek, W., Montavon, G., Vedaldi, A., Hansen, L. K., & Müller, K.-R. (Eds.). (2019). Explainable AI: Interpreting, explaining and visualizing deep learning. Springer.
8. Ribeiro, M. T., Singh, S., & Guestrin, C. (2016). "Why should I trust you?": Explaining the predictions of any classifier. In Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (pp. 1135–1144). ACM.
9. Lundberg, S. M., & Lee, S.-I. (2017). A unified approach to interpreting model predictions. In Advances in Neural Information Processing Systems 30 (pp. 4765–4774). Curran Associates.
10. Selvaraju, R. R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., & Batra, D. (2017). Grad-CAM: Visual explanations from deep networks via gradient-based localization. In Proceedings of the IEEE International Conference on Computer Vision (pp. 618–626). IEEE.
11. Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., Krueger, G., & Sutskever, I. (2021). Learning transferable visual models from natural language supervision. In Proceedings of the 38th International Conference on Machine Learning (pp. 8748–8763). PMLR.
12. Jia, C., Yang, Y., Xia, Y., Chen, Y.-T., Parekh, Z., Pham, H., Le, Q. V., Sung, Y.-H., Li, Z., & Duerig, T. (2021). Scaling up visual and vision-language representation learning with noisy text supervision. In Proceedings of the 38th International Conference on Machine Learning (pp. 4904–4916). PMLR.
13. Bommasani, R., Hudson, D. A., Adeli, E., Altman, R., Arora, S., von Arx, S., ... Liang, P. (2021). On the opportunities and risks of foundation models. arXiv preprint arXiv:2108.07258.
14. Liu, Y., & Zou, R. (2026). When Explanations Betray Backdoors: Black-Box Auditing for Language Model Classifiers. arXiv preprint arXiv:2608.12623.
15. Carlini, N., & Terzis, A. (2022). Poisoning and backdooring contrastive learning. In International Conference on Learning Representations. OpenReview.
16. Jia, J., Liu, Y., & Gong, N. Z. (2022). BadEncoder: Backdoor attacks to pre-trained encoders in self-supervised learning. In 2022 IEEE Symposium on Security and Privacy (pp. 1969–1985). IEEE.
17. Raji, I. D., Smart, A., White, R. N., Mitchell, M., Gebru, T., Hutchinson, B., ... Barnes, P. (2020). Closing the AI accountability gap: Defining an end-to-end framework for internal algorithmic auditing. In Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency (pp. 33–44). ACM.
18. Mittelstadt, B. (2019). Principles alone cannot guarantee ethical AI. Nature Machine Intelligence, 1(11), 501–507.
19. Strubell, E., Ganesh, A., & McCallum, A. (2019). Energy and policy considerations for deep learning in NLP. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics (pp. 3645–3650). Association for Computational Linguistics.
20. Bender, E. M., Gebru, T., McMillan-Major, A., & Shmitchell, S. (2021). On the dangers of stochastic parrots: Can language models be too big? In Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency (pp. 610–623). ACM.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Journal of Data Intelligence and AI Systems
This work is licensed under a Creative Commons Attribution 4.0 International License.
This article is published under the Creative Commons Attribution 4.0 International License (CC BY 4.0), which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited.
