Across four computational model-dataset configurations involving V-MoE and Swin-MoE, a proposed backdoor recorded dormant attack success rates below 9% when batch sizes were 32 or less. These Vision Mixture-of-Experts classifiers route image-processing tokens through expert components. With the reported activation configuration at batch size 128, attack success ranged from 76.0% to 87.0%. Attack success rate means the share of triggered inputs classified as the chosen target.
The study asks whether batch-dependent expert capacity and token overflow, when routing exceeds an expert's available capacity, can act as a built-in, workload-dependent trigger for a Vision MoE backdoor that remains dormant during small-batch audits.
A switch in the routing system
The proposed design puts a backdoor in an early MoE layer and a neutralizer in a deeper MoE layer. The neutralizer's capacity factor, which limits how many tokens it can handle, serves as an implicit switch between benign and malicious behavior.
During implantation, the method mixes clean and triggered samples. It updates only the backdoor MoE layer and the attention block immediately before it, and combines cross-entropy with an auxiliary load-balancing loss.
During neutralizer training, the router is frozen and the method uses KL distillation against a clean reference model. The nominal capacity factor at that stage is 1.05.
At activation, no further training is added. The configuration makes the neutralizer's capacity factor adapt to batch size, keeps capacity high for small batches and reduces it for large ones, and uses ascending-priority token dispatch.
What the four configurations showed
The reported setup uses a fixed, high-intensity 16-by-16 patch in the bottom-right corner of an image. The target is class 0 for ImageNet-100 and class 14, identified in the setup as a stop sign, for GTSRB. The poison ratio is 20% to 25% over 20 to 40 training epochs, the distillation temperature is 2.0, and capacity floors are 0.30 generally and 0.20 for Swin-MoE on GTSRB.
The configuration-level figures covered all four model-dataset pairings. For V-MoE with ImageNet-100, baseline clean accuracy on unaltered inputs was 76.0%, dormant attack success was 8.9%, and activation attack success was 87.0%, with a listed clean-accuracy drop of 1.3 percentage points. For V-MoE with GTSRB, the corresponding figures were 88.3%, 8.4%, 81.6% and 0.7 percentage points, respectively.
For Swin-MoE with ImageNet-100, baseline clean accuracy was 83.3%, dormant attack success was 3.1%, and activation attack success was 83.6%, with a listed drop of 1.0 percentage point. For Swin-MoE with GTSRB, the figures were 95.6%, 8.5%, 76.1% and 0.6 percentage point, respectively.
The paper describes the dormant-to-activation separation as more than 70 percentage points. Its narrative reports clean-accuracy loss of at most 1.2 percentage points across the evaluated configurations.
The reported activation setup includes batch size 128, a batch-adaptive capacity factor and ascending-priority dispatch. The comparison therefore describes that combined configuration rather than batch size in isolation.
The test's boundaries
The evaluation was entirely computational and covered V-MoE and Swin-MoE classifiers on ImageNet-100 and GTSRB. Clean and fixed-trigger inputs were tested under varying batch sizes, capacity factors and dispatch orders, across four model-dataset configurations.
The threat model assumes that a malicious model provider controls training, expert weights and router configuration, but cannot access the victim's private data or computing environment after deployment.
The authors interpret small-batch, no-overflow auditing as a systematic blind spot and recommend workload-aware audits that sweep batch size and capacity regimes.
The evidence remains limited to controlled computational experiments on V-MoE and Swin-MoE classifiers, ImageNet-100 and GTSRB, and the specified batch and capacity regimes. It does not establish whether the approach transfers to other Vision MoE implementations, language or vision-language MoE systems, hardware-triggered scenarios or real-world deployment.
The report provides no confidence intervals, significance tests or run-to-run variability. It also contains a numerical discrepancy: the narrative reports clean-accuracy loss at most 1.2 percentage points, while the configuration-level figures include a listed drop of 1.3 points.
Paper data and sources
Original title: Capacity Overflow: A Blind Spot for Backdoor Attacks in Vision MoE
Authors: Xiaocheng Zou, Tiancheng Zheng, Xiaolin Xu, Ruyi Ding
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-26
DOI: Not available
Original paper · Full text