mlsanityData to 7 Oct 2026

Defending Against Weight-Poisoning Backdoor Attacks for Parameter-Efficient Fine-Tuning

arXiv 2402.12168 ↗First posted 19 Feb 2024cs.CR cs.AI cs.CLcited by 16

Not on the map. Why?

Abstract (arXiv)

Recently, various parameter-efficient fine-tuning (PEFT) strategies for application to language models have been proposed and successfully implemented. However, this raises the question of whether PEFT, which only updates a limited set of model parameters, constitutes security vulnerabilities when confronted with weight-poisoning backdoor attacks. In this study, we show that PEFT is more susceptible to weight-poisoning backdoor attacks compared to the full-parameter fine-tuning method, with pre-defined triggers remaining exploitable and pre-defined targets maintaining high confidence, even after fine-tuning. Motivated by this insight, we developed a Poisoned Sample Identification Module (PSIM) leveraging PEFT, which identifies poisoned samples through confidence, providing robust defense against weight-poisoning backdoor attacks. Specifically, we leverage PEFT to train the PSIM with randomly reset sample labels. During the inference process, extreme confidence serves as an indicator for poisoned samples, while others are clean. We conduct experiments on text classification tasks, five fine-tuning strategies, and three weight-poisoning backdoor attack methods. Experiments show near 100% success rates for weight-poisoning backdoor attacks when utilizing PEFT. Furthermore, our defensive approach exhibits overall competitive performance in mitigating weight-poisoning backdoor attacks.

Key facts. Cited by 16 papers in the map (data through 7 Oct 2026). Builds on 49 of its 66 references that are in the map. First posted on arXiv 19 Feb 2024.

Builds on

49 of 66 references.

References · 49

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2023GPT-4 Technical Reportcited by 18,132
  3. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,084
  4. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 13,958
  5. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  6. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
  7. 2018GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understandingcited by 4,854
  8. 2021Prefix-Tuning: Optimizing Continuous Prompts for Generationcited by 3,878
  9. 2021The Power of Scale for Parameter-Efficient Prompt Tuningcited by 3,769
  10. 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
  11. 2022BLOOM: A 176B-Parameter Open-Access Multilingual Language Modelcited by 1,968
  12. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
37 more
  1. 2021GPT Understands, Toocited by 715
  2. 2021P-Tuning v2: Prompt Tuning Can Be Comparable to Fine-tuning Universally Across Scales and Taskscited by 686
  3. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
  4. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 231
  5. 2019A backdoor attack against LSTM-based text classification systemscited by 214
  6. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 203
  7. 2023Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injectioncited by 143
  8. 2023Full Parameter Fine-tuning for Large Language Models with Limited Resourcescited by 134
  9. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 103
  10. 2023Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Modelscited by 100
  11. 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Modelscited by 97
  12. 2023Prompt as Triggers for Backdoor Attack: Examining the Vulnerability in Language Modelscited by 87
  13. 2021Hidden Backdoors in Human-Centric Language Modelscited by 83
  14. 2020Mitigating backdoor attacks in LSTM-based Text Classification Systems by Backdoor Keyword Identificationcited by 80
  15. 2021Backdoor Pre-trained Models Can Transfer to Allcited by 79
  16. 2021Towards Robustness Against Natural Language Word Substitutionscited by 68
  17. 2022The "Beatrix'' Resurrections: Robust Backdoor Detection via Gram Matricescited by 62
  18. 2021Triggerless Backdoor Attack for NLP Tasks with Clean Labelscited by 61
  19. 2022BadPrompt: Backdoor Attacks on Continuous Promptscited by 59
  20. 2022Exploring the Universal Vulnerability of Prompt-based Learning Paradigmcited by 56
  21. 2022Fine-mixing: Mitigating Backdoors in Fine-tuned Language Modelscited by 50
  22. 2021How Should Pre-Trained Language Models Be Fine-Tuned Towards Adversarial Robustness?cited by 49
  23. 2024Universal Vulnerabilities in Large Language Models: Backdoor Attacks for In-context Learningcited by 47
  24. 2023Backdoor Defense via Deconfounded Representation Learningcited by 38
  25. 2021Defending Against Backdoor Attacks in Natural Language Generationcited by 30
  26. 2022BadHash: Invisible Backdoor Attacks against Deep Hashing with Clean Labelcited by 28
  27. 2023From Shortcuts to Triggers: Backdoor Defense with Denoised PoEcited by 26
  28. 2023Defending against Insertion-based Textual Backdoor Attacks via Attributioncited by 24
  29. 2022Certified Robustness Against Natural Language Attacks by Causal Interventioncited by 23
  30. 2022Textual Manifold-based Defense Against Natural Language Adversarial Examplescited by 19
  31. 2022Expose Backdoors on the Way: A Feature-Based Efficient Defense against Textual Backdoor Attackscited by 18
  32. 2021BFClass: A Backdoor-free Text Classification Frameworkcited by 17
  33. 2022MNER-QG: An End-to-End MRC framework for Multimodal Named Entity Recognition with Query Groundingcited by 16
  34. 2023TextGuard: Provable Defense against Backdoor Attacks on Text Classificationcited by 14
  35. 2022WeDef: Weakly Supervised Backdoor Defense for Text Classificationcited by 12
  36. 2023Backdoor Attacks with Input-unique Triggers in NLPcited by 10
  37. 2023Adversarial Clean Label Backdoor Attacks and Defenses on Text Classification Systemscited by 10

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 7; 2025: 6; 2026: 3.

16 papers.

Sort:

By area:

  1. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 110
  2. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Modelscited by 36
  3. 2024Large Model Based Agents: State-of-the-Art, Cooperation Paradigms, Security and Privacy, and Future Trendscited by 26
  4. 2024Unlearning Backdoor Attacks for LLMs with Weak-to-Strong Knowledge Distillationcited by 21
  5. 2024Mitigating Backdoor Threats to Large Language Models: Advancement and Challengescited by 14
  6. 2024LLMScan: Causal Scan for LLM Misbehavior Detectioncited by 13
  7. 2026The Trigger in the Haystack: Extracting and Reconstructing LLM Backdoor Triggerscited by 13
  8. 2024Gracefully Filtering Backdoor Samples for Generative Large Language Models without Retrainingcited by 5
  9. 2024Prompt Injection Attacks in Defended Systemscited by 4
  10. 2025Watch your steps: Dormant Adversarial Behaviors that Activate upon LLM Finetuningcited by 4
  11. 2025Neuroplasticity and Corruption in Model Mechanisms: A Case Study Of Indirect Object Identificationcited by 3
  12. 2025Causal-Guided Detoxify Backdoor Attack of Open-Weight LoRA Modelscited by 3
4 more
  1. 2025Investigating Vulnerabilities and Defenses Against Audio-Visual Attacks: A Comprehensive Survey Emphasizing Multimodal Modelscited by 1
  2. 2026Towards Poisoning Robustness Certification for Natural Language Generationcited by 1
  3. 2025AutoDebias: Automated Framework for Debiasing Text-to-Image Modelscited by 0
  4. 2026Unveiling the Backdoor Mechanism Hidden Behind Catastrophic Overfitting in Fast Adversarial Trainingcited by 0