mlsanityData to 13 Oct 2026

Here's a Free Lunch: Sanitizing Backdoored Models with Model Merge

arXiv 2402.19334 ↗First posted 29 Feb 2024cs.CLcited by 25

Not on the map. Why?

Abstract (arXiv)

The democratization of pre-trained language models through open-source initiatives has rapidly advanced innovation and expanded access to cutting-edge technologies. However, this openness also brings significant security risks, including backdoor attacks, where hidden malicious behaviors are triggered by specific inputs, compromising natural language processing (NLP) system integrity and reliability. This paper suggests that merging a backdoored model with other homogeneous models can significantly remediate backdoor vulnerabilities even if such models are not entirely secure. In our experiments, we verify our hypothesis on various models (BERT-Base, RoBERTa-Large, Llama2-7B, and Mistral-7B) and datasets (SST-2, OLID, AG News, and QNLI). Compared to multiple advanced defensive approaches, our method offers an effective and efficient inference-stage defense against backdoor attacks on classification and instruction-tuned tasks without additional resources or specific knowledge. Our approach consistently outperforms recent advanced baselines, leading to an average of about 75% reduction in the attack success rate. Since model merging has been an established approach for improving model performance, the extra advantage it provides regarding defense can be seen as a cost-free bonus.

Key facts. Cited by 25 papers in the map (data through 13 Oct 2026). Builds on 34 of its 50 references that are in the map. First posted on arXiv 29 Feb 2024.

Builds on

34 of 50 references.

References · 34

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,304
  2. 2014Adam: A Method for Stochastic Optimizationcited by 37,093
  3. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,231
  4. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,322
  5. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,979
  6. 2018GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understandingcited by 4,880
  7. 2018Think you have Solved Question Answering? Try ARC, the AI2 Reasoning Challengecited by 4,798
  8. 2021Finetuned Language Models Are Zero-Shot Learnerscited by 3,765
  9. 2019The Curious Case of Neural Text Degenerationcited by 2,893
  10. 2019PIQA: Reasoning about Physical Commonsense in Natural Languagecited by 2,843
  11. 2023Sparks of Artificial General Intelligence: Early experiments with GPT-4cited by 2,586
  12. 2015Character-level Convolutional Networks for Text Classificationcited by 2,319
22 more
  1. 2022Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference timecited by 1,384
  2. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,099
  3. 2016The LAMBADA dataset: Word prediction requiring a broad discourse contextcited by 973
  4. 2021Merging Models with Fisher-Weighted Averagingcited by 617
  5. 2022Dataless Knowledge Fusion by Merging Weights of Language Modelscited by 384
  6. 2020Weight Poisoning Attacks on Pre-trained Modelscited by 341
  7. 2019Predicting the Type and Target of Offensive Posts in Social Mediacited by 270
  8. 2023Poisoning Language Models During Instruction Tuningcited by 265
  9. 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 262
  10. 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 262
  11. 2019A backdoor attack against LSTM-based text classification systemscited by 227
  12. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 221
  13. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 127
  14. 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 112
  15. 2022Fusing finetuned models for better pretrainingcited by 110
  16. 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitutioncited by 89
  17. 2022BITE: Textual Backdoor Attacks with Iterative Trigger Injectioncited by 53
  18. 2023Analyzing And Editing Inner Mechanisms Of Backdoored Language Modelscited by 23
  19. 2023Mitigating Backdoor Poisoning Attacks through the Lens of Spurious Correlationcited by 21
  20. 2022Expose Backdoors on the Way: A Feature-Based Efficient Defense against Textual Backdoor Attackscited by 19
  21. 2023IMBERT: Making BERT Immune to Insertion-based Backdoor Attackscited by 15
  22. 2024Acquiring Clean Language Models from Backdoor Poisoned Datasets by Downscaling Frequency Spacecited by 8

Built on by

Cited by year (2026 to 13 Oct)

Citing papers per year: 2024: 10; 2025: 12; 2026: 3.

25 papers.

Sort:

By area:

  1. 2024Operationalizing a Threat Model for Red-Teaming Large Language Models (LLMs)cited by 46
  2. 2024BadMerging: Backdoor Attacks Against Model Mergingcited by 33
  3. 2024Unlearning Backdoor Attacks for LLMs with Weak-to-Strong Knowledge Distillationcited by 26
  4. 2025Copyright Protection for Large Language Models: A Survey of Methods, Challenges, and Trendscited by 20
  5. 2024Have You Merged My Model? On The Robustness of Large Language Model IP Protection Methods Against Model Mergingcited by 19
  6. 2025BadJudge: Backdoor Vulnerabilities of LLM-as-a-Judgecited by 17
  7. 2024Mitigating Backdoor Threats to Large Language Models: Advancement and Challengescited by 15
  8. 2024Mitigating the Backdoor Effect for Multi-Task Model Merging via Safety-Aware Subspacecited by 14
  9. 2024Rethinking Backdoor Detection Evaluation for Language Modelscited by 9
  10. 2024Gracefully Filtering Backdoor Samples for Generative Large Language Models without Retrainingcited by 9
  11. 2025Merge Hijacking: Backdoor Attacks to Model Merging of Large Language Modelscited by 6
  12. 2025Be Careful When Fine-tuning On Open-Source LLMs: Your Fine-tuning Data Could Be Secretly Stolen!cited by 5
13 more
  1. 2025Patronus: Identifying and Mitigating Transferable Backdoors in Pre-trained Language Modelscited by 4
  2. 2025BADTV: Unveiling Backdoor Threats in Third-Party Task Vectorscited by 3
  3. 2025Merge Now, Regret Later: The Hidden Cost of Model Merging Is Adversarial Transferabilitycited by 2
  4. 2025Backdoor Vectors: a Task Arithmetic View on Backdoor Attacks and Defensescited by 2
  5. 2025Do Not Merge My Model! Safeguarding Open-Source LLMs Against Unauthorized Model Mergingcited by 2
  6. 2024Cut the Deadwood Out: Backdoor Purification via Guided Module Substitutioncited by 1
  7. 2025Lethe: Purifying Backdoored Large Language Models with Knowledge Dilutioncited by 1
  8. 2025GREAT: Generalizable Backdoor Attacks in RLHF via Emotion-Aware Trigger Synthesiscited by 1
  9. 2026Towards Poisoning Robustness Certification for Natural Language Generationcited by 1
  10. 2026BackFlush: Knowledge-Free Backdoor Detection and Elimination with Watermark Preservation in Large Language Modelscited by 1
  11. 2024Protecting Copyright of Medical Pre-trained Language Models: Training-Free Backdoor Model Watermarkingcited by 0
  12. 2025Defending against Backdoor Attacks via Module Switchingcited by 0
  13. 2026DiffSafeMerge: Mitigating Backdoor Inheritance in Diffusion Model Mergingcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Merging Triggers, Breaking Backdoors: Defensive Poisoning for Instruction-Tuned Language Models
  2. 2024A Survey of Recent Backdoor Attacks and Defenses in Large Language Models
  3. 2024Neutralizing Backdoors through Information Conflicts for Large Language Models
  4. 2023Composite Backdoor Attacks Against Large Language Models
  5. 2023Backdoor Attacks and Countermeasures in Natural Language Processing Models: A Comprehensive Security Review
  6. 2025Backdoor Collapse: Eliminating Unknown Threats via Known Backdoor Aggregation in Language Models
  7. 2024Large Language Models are Good Attackers: Efficient and Stealthy Textual Backdoor Attacks
  8. 2021BadPre: Task-agnostic Backdoor Attacks to Pre-trained NLP Foundation Models