Defending Against Weight-Poisoning Backdoor Attacks for Parameter-Efficient Fine-Tuning (2024.findings-naacl)
Copied to clipboard
| Challenge: | Existing methods for parameter-efficient fine-tuning (PEFT) are not effective for weight-poisoning backdoor attacks. |
| Approach: | They propose a parameter-efficient fine-tuning (PEFT) method that updates only a limited set of model parameters and provides a robust defense against weight-poisoning backdoor attacks. |
| Outcome: | The proposed method identifies poisoned samples through confidence and is robust against weight-poisoning backdoor attacks. |
Similar Papers
Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoning (2021.emnlp-main)
Copied to clipboard
| Challenge: | Pre-trained models can be maliciously poisoned with certain triggers, causing a security threat. |
| Approach: | They propose a stronger weight poisoning attack method that introduces a layerwise weight poison strategy to plant deeper backdoors. |
| Outcome: | The proposed method can be widely applied and provide hints for future models robustness studies. |
Unlearning Backdoor Attacks for LLMs with Weak-to-Strong Knowledge Distillation (2025.findings-acl)
Copied to clipboard
| Challenge: | Parameter-efficient fine-tuning (PEFT) can bridge the gap between large language models and downstream tasks, but is vulnerable to malicious attacks. |
| Approach: | They propose a weak-to-strong unlearning algorithm based on feature alignment knowledge distillation to defend against backdoor attacks . they first train a small-scale language model through full-parameter fine-tuning to serve as the clean teacher model and then guide the large-scale poisoned student model in unlearning the backdoor. |
| Outcome: | The proposed method can unlearn backdoor features without compromising model performance. |
A Gradient Control Method for Backdoor Attacks on Parameter-Efficient Tuning (2023.acl-long)
Copied to clipboard
| Challenge: | Parameter-Efficient Tuning (PET) fine-tunes pre-trained language models for downstream tasks, but a large reduction in the number of attackable parameters will greatly affect the effectiveness of backdoor attacks, resulting in backdoor forgetting. |
| Approach: | They propose a gradient control method to consolidate the attack effect by freezing most parameters of the pre-trained model and fine-tuning only a small number of parameters. |
| Outcome: | The proposed method improves sentiment classification and spam detection, and can be applied to different tasks. |
Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Models (2024.naacl-long)
Copied to clipboard
| Challenge: | et al., 2021) show that instruction models can be trained on crowdsourced datasets with task instructions to achieve superior performance. |
| Approach: | They examine security concerns of emergent instruction tuning paradigm that models are trained on crowdsourced datasets with task instructions to achieve superior performance. |
| Outcome: | The proposed model can achieve 90% success rate across four commonly used datasets. |
Textual Backdoor Attacks Can Be More Harmful via Two Simple Tricks (2022.emnlp-main)
Copied to clipboard
| Challenge: | Existing textual backdoor attacks are vulnerable to backdoors . researchers add extra training task to distinguish poisoned and clean data . |
| Approach: | They propose two tricks that make existing backdoor attacks much more harmful . first trick is to add an extra task to distinguish poisoned and clean data . second trick is using all the clean training data rather than the original clean data. |
| Outcome: | The proposed tricks can significantly improve attack performance in three tough situations including clean data fine-tuning, low-poisoning-rate, and label-consistent attacks. |
Weight Poisoning Attacks on Pretrained Models (2020.acl-main)
Copied to clipboard
| Challenge: | Recent trends in NLP use of pre-trained weights raise security questions . authors show that pre-training weights can be injected with vulnerabilities . |
| Approach: | They propose to build "weight poisoning" attacks where pre-trained weights are injected with vulnerabilities that expose "backdoors" they outline practical defenses against such attacks. |
| Outcome: | The proposed attacks expose "backdoors" after fine-tuning models . the proposed attacks are widely applicable and pose a serious threat . |
Maximum Entropy Loss, the Silver Bullet Targeting Backdoor Attacks in Pre-trained Language Models (2023.findings-acl)
Copied to clipboard
| Challenge: | Existing backdoor defense paradigms focus on detecting and removing poisoned samples at pre-training or inference time. |
| Approach: | They propose a new approach where the backdoor attack is directly reversed by incorporating maximum entropy loss into training to neutralize the minimal cross-entropiness loss fine-tuning on poisoned data. |
| Outcome: | The proposed model significantly lowers the attack success rate on classification tasks and reduces the risk of backdoor attacks on clean data. |
Detecting Stealthy Backdoor Samples based on Intra-class Distance for Large Language Models (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Existing detectors use classifier-style probability signals or rely on rewriting, which can degrade quality and introduce new triggers. |
| Approach: | They propose to efficiently remove poisoned examples before or during fine-tuning . |
| Outcome: | The proposed method outperforms prior detectors on two machine translation datasets and one QA dataset. |
Obliviate: Neutralizing Task-agnostic Backdoors within the Parameter-efficient Fine-tuning Paradigm (2025.findings-naacl)
Copied to clipboard
| Challenge: | Parameter-efficient fine-tuning (PEFT) is a key training strategy for large language models, but its reliance on fewer trainable parameters poses security risks, such as task-agnostic backdoors. |
| Approach: | They propose a method that amplifies benign neurons within PEFT layers and penalizes the influence of trigger tokens. |
| Outcome: | The proposed method reduces the success rate of state-of-the-art task-agnostic backdoors by 83.6%. |
Large Language Models Are Better Adversaries: Exploring Generative Clean-Label Backdoor Attacks Against Text Classifiers (2023.findings-emnlp)
Copied to clipboard
| Challenge: | Backdoor attacks manipulate model predictions by inserting malicious "poison" instances that contain a specific pattern or "trigger." |
| Approach: | They propose an attack that inserts style-based triggers into training and test data by using a poison selection technique to improve the effectiveness of both LLMBkd and existing backdoor attacks. |
| Outcome: | The proposed attack achieves high success rates across a wide range of styles with little effort and no model training. |