mlsanityData to 14 Oct 2026

Nearest is Not Dearest: Towards Practical Defense against Quantization-conditioned Backdoor Attacks

arXiv 2405.12725 ↗First posted 21 May 2024cs.CR cs.CVcited by 18

Not on the map. Why?

Abstract (arXiv)

Model quantization is widely used to compress and accelerate deep neural networks. However, recent studies have revealed the feasibility of weaponizing model quantization via implanting quantization-conditioned backdoors (QCBs). These special backdoors stay dormant on released full-precision models but will come into effect after standard quantization. Due to the peculiarity of QCBs, existing defenses have minor effects on reducing their threats or are even infeasible. In this paper, we conduct the first in-depth analysis of QCBs. We reveal that the activation of existing QCBs primarily stems from the nearest rounding operation and is closely related to the norms of neuron-wise truncation errors (i.e., the difference between the continuous full-precision weights and its quantized version). Motivated by these insights, we propose Error-guided Flipped Rounding with Activation Preservation (EFRAP), an effective and practical defense against QCBs. Specifically, EFRAP learns a non-nearest rounding strategy with neuron-wise error norm and layer-wise activation preservation guidance, flipping the rounding strategies of neurons crucial for backdoor effects but with minimal impact on clean accuracy. Extensive evaluations on benchmark datasets demonstrate that our EFRAP can defeat state-of-the-art QCB attacks under various settings. Code is available at https://github.com/AntigoneRandy/QuantBackdoor_EFRAP.

Key facts. Cited by 18 papers in the map (data through 14 Oct 2026). Builds on 56 of its 90 references that are in the map. First posted on arXiv 21 May 2024.

Builds on

56 of 90 references.

References · 56

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
  3. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  4. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
  5. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,733
  6. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  7. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,795
  8. 2017Quantization and Training of Neural Networks for Efficient Integer-Arithmetic-Only Inferencecited by 1,593
  9. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  10. 2016TensorFlow: Large-Scale Machine Learning on Heterogeneous Distributed Systemscited by 664
  11. 2020Up or Down? Adaptive Rounding for Post-Training Quantizationcited by 621
  12. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 580
38 more
  1. 2021BRECQ: Pushing the Limit of Post-Training Quantization by Block Reconstructioncited by 479
  2. 2019HAWQ: Hessian AWare Quantization of Neural Networks with Mixed-Precisioncited by 402
  3. 2019A Survey of Autonomous Driving: Common Practices and Emerging Technologiescited by 379
  4. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 357
  5. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 353
  6. 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 324
  7. 2020Input-Aware Dynamic Backdoor Attackcited by 313
  8. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 290
  9. 2018Deep Face Recognition: A Surveycited by 276
  10. 2019HAWQ-V2: Hessian Aware trace-Weighted Quantization of Neural Networkscited by 261
  11. 2019Differentiable Soft Quantization: Bridging Full-Precision and Low-Bit Neural Networkscited by 238
  12. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 199
  13. 2019Low-bit Quantization of Neural Networks for Efficient Inferencecited by 193
  14. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 180
  15. 2022QDrop: Randomly Dropping Quantization for Extremely Low-bit Post-Training Quantizationcited by 180
  16. 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 166
  17. 2019Improving Neural Network Quantization without Retraining using Outlier Channel Splittingcited by 151
  18. 2020Bridging Mode Connectivity in Loss Landscapes and Adversarial Robustnesscited by 132
  19. 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 128
  20. 2024BadEdit: Backdooring large language models by model editingcited by 96
  21. 2020Improving Post Training Neural Quantization: Layer-wise Calibration and Integer Programmingcited by 92
  22. 2022BppAttack: Stealthy and Efficient Trojan Attacks against Deep Neural Networks via Image Quantization and Contrastive Adversarial Learningcited by 86
  23. 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 86
  24. 2019Towards Unified INT8 Training for Convolutional Neural Networkcited by 79
  25. 2022PD-Quant: Post-Training Quantization based on Prediction Difference Metriccited by 73
  26. 2021FIBA: Frequency-Injection based Backdoor Attack in Medical Image Analysiscited by 61
  27. 2023FlexRound: Learnable Rounding based on Element-wise Division for Post-Training Quantizationcited by 48
  28. 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 46
  29. 2021MQBench: Towards Reproducible and Deployable Model Quantization Benchmarkcited by 40
  30. 2023Backdoor Attacks Against Deep Image Compression via Adaptive Frequency Triggercited by 40
  31. 2022Rethinking the Reverse-engineering of Trojan Triggerscited by 39
  32. 2022Fine-Tuning Is All You Need to Mitigate Backdoor Attackscited by 38
  33. 2021Dual-Key Multimodal Backdoors for Visual Question Answeringcited by 37
  34. 2022Few-Shot Backdoor Attacks on Visual Object Trackingcited by 35
  35. 2023Why Does Little Robustness Help? A Further Step Towards Understanding Adversarial Transferabilitycited by 32
  36. 2021Quantization Backdoors to Deep Learning Commercial Frameworkscited by 29
  37. 2023BackdoorBox: A Python Toolbox for Backdoor Learningcited by 26
  38. 2023Multi-target Backdoor Attacks for Code Pre-trained Modelscited by 23

50 most cited of 56 All 56 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 4; 2025: 7; 2026: 7.

18 papers.

Sort:

By area:

  1. 2025REFINE: Inversion-Free Backdoor Defense via Model Reprogrammingcited by 22
  2. 2024Invisible Backdoor Attack against Self-supervised Learningcited by 6
  3. 2024CopyrightShield: Enhancing Diffusion Model Security against Copyright Infringement Attackscited by 6
  4. 2025DarkHash: A Data-Free Backdoor Attack Against Deep Hashingcited by 6
  5. 2025Taught Well Learned Ill: Towards Distillation-conditional Backdoor Attackcited by 5
  6. 2025Cert-SSBD: Certified Backdoor Defense with Sample-Specific Smoothing Noisescited by 4
  7. 2025Rounding-Guided Backdoor Injection in Deep Learning Model Quantizationcited by 3
  8. 2024PBP: Post-training Backdoor Purification for Malware Classifierscited by 2
  9. 2026STEP: Detecting Audio Backdoor Attacks via Stability-based Trigger Exposure Profilingcited by 1
  10. 2026In-Cell Learning: Language Models That Update Their Own Weights in Sequence Without Changing the File They Shipcited by 1
  11. 2024One Pixel is All I Needcited by 0
  12. 2025HAMLOCK: HArdware-Model LOgically Combined attacKcited by 0
6 more
  1. 2025Quantization Blindspots: How Model Compression Breaks Backdoor Defensescited by 0
  2. 2026FlipGuard: Defending Large Language Models Against Quantization-Conditioned Backdoor Attackscited by 0
  3. 2026AGENTQ: Quantization-Conditioned Backdoor Attacks on LLM Agentscited by 0
  4. 2026Towards Merging-conditional Backdoor Unalignment against Large Language Modelscited by 0
  5. 2026From Acoustic Sensing to Physical Actions: A Comprehensive Survey of Security Risks in Edge-Deployed Audio LLM-Based Agentscited by 0
  6. 2026What You Sign Is Not What You Run: The Verifiability Gap in Quantized LLM Supply Chainscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026QuantGuard: Learnable Rounding for Repairing Quantization-Conditioned Backdoors in LLMs
  2. 2026Quantization as a Malicious Task: Removing Quantization-Conditioned Backdoors via Task Arithmetic ↗
  3. 2025Breaking the Limits of Quantization-Aware Defenses: QADT-R for Robustness Against Patch-Based Adversarial Attacks in QNNs
  4. 2026Quantization-Triggered Backdoors in Language Models: Cross-Quantizer Transferability and the Validation--Deployment Gap
  5. 2024Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness
  6. 2026Widening the Gap: Exploiting LLM Quantization via Outlier Injection
  7. 2023Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimization
  8. 2025Defending against Backdoor Attacks via Module Switching