Follow My Eyes: Backdoor Attacks on Goal-Directed Scanpath Prediction

Scanpath prediction models forecast the sequence of fixations a person makes while searching a scene, and increasingly serve as the upstream perception layer for foveated rendering, intent inference, and gaze-driven assistive interfaces. Since eye-tracking data is expensive to collect, these models are routinely fine-tuned from public datasets or third-party pretrained weights, exposing them to training-time poisoning. We present the first backdoor attacks on multimodal scanpath prediction. This task differs from classification: its output is a continuous, variable-length sequence of fixations, opening new avenues of attack. A fixed-trajectory backdoor is easy to implant, but it clusters poisoned samples away from clean data, making it detectable. We instead design two backdoor attacks that condition the malicious supervision on each scene to keep triggered outputs diverse and plausible: a spatial misdirection attack that redirects the predicted search toward an attacker-chosen object instead of the queried one, and a duration inflation attack that lengthens the predicted search by inserting extra fixations while preserving correct localization. Our attacks succeed across visual, textual, and multimodal triggers, with duration inflation reaching up to 93.5% attack success from as few as 540 poisoned samples (2.5% of training data), and spatial misdirection redirecting the search in up to 61% of triggered inputs. We evaluate our attacks against five existing backdoor defenses, spanning fine-tuning, fine-pruning, neural attention distillation, contrastive learning, and trigger inversion, and show none removes the backdoor without degrading model output below the usable threshold. Our attacks generalize across models and datasets, showing scanpath prediction models are vulnerable to backdoor attacks through data poisoning, and that designing an effective defense remains an open problem.