Cut the Deadwood Out: Backdoor Purification via Guided Module Substitution
Not on the map. Why?
Abstract (arXiv)
Model NLP models are commonly trained (or fine-tuned) on datasets from untrusted platforms like HuggingFace, posing significant risks of data poisoning attacks. A practical yet underexplored challenge arises when such backdoors are discovered after model deployment, making retraining-required defenses less desirable due to computational costs and data constraints. In this work, we propose Guided Module Substitution (GMS), an effective retraining-free method based on guided merging of the victim model with just a single proxy model. Unlike prior ad-hoc merging defenses, GMS uses a guided trade-off signal between utility and backdoor to selectively replaces modules in the victim model. GMS offers four desirable properties: (1) robustness to the choice and trustworthiness of the proxy model, (2) applicability under inaccurate data knowledge, (3) stability across hyperparameters, and (4) transferability across different attacks. Extensive experiments on encoder models and decoder LLMs demonstrate the strong effectiveness of GMS. GMS significantly outperforms even the strongest defense baseline, particularly against challenging attacks like LWS.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 54 of its 90 references that are in the map. First posted on arXiv 29 Dec 2024.
Builds on
54 of 90 references.
References · 54
- 2017Attention Is All You Needcited by 59,932
- 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
- 2014Adam: A Method for Stochastic Optimizationcited by 36,960
- 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
- 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
- 2017A Broad-Coverage Challenge Corpus for Sentence Understanding through Inferencecited by 2,665
- 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
- 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,106
- 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
- 2023TIES-Merging: Resolving Interference When Merging Modelscited by 795
- 2023Language Models are Super Mario: Absorbing Abilities from Homologous Models as a Free Lunchcited by 679
- 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
38 more
- 2021Datasets: A Community Library for Natural Language Processingcited by 526
- 2018Spectral Signatures in Backdoor Attackscited by 457
- 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
- 2020Dataset Cartography: Mapping and Diagnosing Datasets with Training Dynamicscited by 423
- 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
- 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
- 2019Label-Consistent Backdoor Attackscited by 285
- 2019Predicting the Type and Target of Offensive Posts in Social Mediacited by 268
- 2018Large Scale Crowdsourcing and Characterization of Twitter Abusive Behaviorcited by 265
- 2021Anti-Backdoor Learning: Training Clean Models on Poisoned Datacited by 258
- 2020ONION: A Simple and Effective Defense Against Textual Backdoor Attackscited by 231
- 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
- 2024Assessing the Brittleness of Safety Alignment via Pruning and Low-Rank Modificationscited by 220
- 2019A backdoor attack against LSTM-based text classification systemscited by 214
- 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 203
- 2020BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvementscited by 191
- 2022Backdoor Defense via Decoupling the Training Processcited by 149
- 2024Safety Layers in Aligned Large Language Models: The Key to LLM Securitycited by 126
- 2022BackdoorBench: A Comprehensive Benchmark of Backdoor Learningcited by 124
- 2021Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoningcited by 103
- 2021RAP: Robustness-Aware Perturbations for Defending against Backdoor Attacks on NLP Modelscited by 97
- 2021Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Modelscited by 96
- 2023SCALE-UP: An Efficient Black-box Input-level Backdoor Detection via Analyzing Scaled Prediction Consistencycited by 93
- 2024How Alignment and Jailbreak Work: Explain LLM Safety through Intermediate Hidden Statescited by 92
- 2021Turn the Combination Lock: Learnable Textual Backdoor Attacks via Word Substitutioncited by 85
- 2020Trojaning Language Models for Fun and Profitcited by 80
- 2024Defending Large Language Models Against Jailbreak Attacks via Layer-specific Editingcited by 77
- 2024On the Role of Attention Heads in Large Language Model Safetycited by 70
- 2023Enhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimizationcited by 60
- 2022Fine-mixing: Mitigating Backdoors in Fine-tuned Language Modelscited by 50
- 2022BITE: Textual Backdoor Attacks with Iterative Trigger Injectioncited by 47
- 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 44
- 2023The Janus Interface: How Fine-Tuning in Large Language Models Amplifies the Privacy Riskscited by 35
- 2023Towards Stable Backdoor Purification through Feature Shift Tuningcited by 30
- 2024Here's a Free Lunch: Sanitizing Backdoored Models with Model Mergecited by 21
- 2023Mitigating Backdoor Poisoning Attacks through the Lens of Spurious Correlationcited by 19
- 2022Universal Backdoor Attacks Detection via Adaptive Adversarial Probecited by 16
- 2023Defending Against Backdoor Attacks by Layer-wise Feature Analysiscited by 15
50 most cited of 54 All 54 (JSON)
Built on by
Not cited yet.