Capacity Overflow: A Blind Spot for Backdoor Attacks in Vision MoE

Mixture-of-Experts (MoE) has become a prevalent paradigmfor scaling Vision Transformers efficiently. To ensure computational scal-ability and prevent expert overload, Vision MoE architectures employ acapacity-bounded token dispatch mechanism, where each expert’s pro-cessing budget depends on the inference batch size. This work identifiesthis batch-dependent behavior as an overlooked attack surface, and pro-poses a stealthy supply-chain backdoor attack that exploits this prop-erty through a three-phase framework. First, we inject a backdoor intoan early MoE layer. Second, we train a neutralizer in a deeper MoElayer that suppresses the backdoor under normal capacity. Third, weconfigure a batch-adaptive capacity factor that preserves high capacityfor small batches while reducing it for large batches, naturally disablingthe neutralizer via token overflow at deployment-scale batch sizes. Theattack remains in dormant mode during small-batch security audits andenters activation mode during large-batch deployment. Experiments onV-MoE and Swin-MoE across ImageNet-100 and GTSRB demonstrateactivation-mode attack success rates of 76–87% with dormant-mode ASRbelow 9%, while evading Neural Cleanse, STRIP, Fine-Pruning, and Acti-vation Clustering. Our findings reveal a fundamental security risk arisingfrom batch-dependent execution in scalable Vision MoE architectures.