BADTV: Unveiling Backdoor Threats in Third-Party Task Vectors
On the map: LLM safety and security → Backdoor and data poisoning attacks
Abstract (arXiv)
Task arithmetic in large-scale pre-trained models enables agile adaptation to diverse downstream tasks without extensive retraining. By leveraging task vectors (TVs), users can perform modular updates through simple arithmetic operations like addition and subtraction. Yet, this flexibility presents new security challenges. In this paper, we investigate how TVs are vulnerable to backdoor attacks, revealing how malicious actors can exploit them to compromise model integrity. By creating composite backdoors that are designed asymmetrically, we introduce BadTV, a backdoor attack specifically crafted to remain effective simultaneously under task learning, forgetting, and analogy operations. Extensive experiments show that BadTV achieves near-perfect attack success rates across diverse scenarios, posing a serious threat to models relying on task arithmetic. We also evaluate current defenses, finding they fail to detect or mitigate BadTV. Our results highlight the urgent need for robust countermeasures to secure TVs in real-world deployments.
Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 47 of its 100 references that are in the map. First posted on arXiv 4 Jan 2025.
Builds on
47 of 100 references.
Closest ancestors · 2
Same direction, newest first
- 2023BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIP26 Nov
- 2023CleanCLIP: Mitigating Data Poisoning Attacks in Multimodal Contrastive Learning6 Mar
Other references · 45
- 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
- 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
- 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2021Scaling Up Visual and Vision-Language Representation Learning With Noisy Text Supervisioncited by 3,848
- 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,634
- 2022Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference timecited by 1,366
- 2022Editing Models with Task Arithmeticcited by 1,076
- 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
- 2019Learning Robust Global Representations by Penalizing Local Predictive Powercited by 1,010
- 2022Few-Shot Parameter-Efficient Fine-Tuning is Better and Cheaper than In-Context Learningcited by 886
- 2018How To Backdoor Federated Learningcited by 745
33 more
- 2023Language Models are Super Mario: Absorbing Abilities from Homologous Models as a Free Lunchcited by 679
- 2019Linear Mode Connectivity and the Lottery Ticket Hypothesiscited by 627
- 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
- 2020Fine-Tuning Pretrained Language Models: Weight Initializations, Data Orders, and Early Stoppingcited by 377
- 2020Weight Poisoning Attacks on Pre-trained Modelscited by 318
- 2020Attack of the Tails: Yes, You Really Can Backdoor Federated Learningcited by 307
- 2020Input-Aware Dynamic Backdoor Attackcited by 304
- 2019Label-Consistent Backdoor Attackscited by 285
- 2023AdaMerging: Adaptive Model Merging for Multi-Task Learningcited by 248
- 2023Task Arithmetic in the Tangent Space: Improved Editing of Pre-Trained Modelscited by 218
- 2020Dynamic Backdoor Attacks Against Machine Learning Modelscited by 147
- 2019Universal Litmus Patterns: Revealing Backdoor Attacks in CNNscited by 143
- 2023Full Parameter Fine-tuning for Large Language Models with Limited Resourcescited by 134
- 2024Safety Layers in Aligned Large Language Models: The Key to LLM Securitycited by 126
- 2024Language Models are Homer Simpson! Safety Re-Alignment of Fine-tuned Language Models through Task Arithmeticcited by 105
- 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
- 2024Representation Surgery for Multi-Task Model Mergingcited by 95
- 2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 53
- 2024Model Merging and Safety Alignment: One Bad Model Spoils the Bunchcited by 41
- 2024A safety realignment framework via subspace-oriented model fusion for large language modelscited by 40
- 2024Knowledge Composition using Task Vectors with Learned Anisotropic Scalingcited by 37
- 2023Concrete Subspace Learning based Interference Elimination for Multi-task Model Fusioncited by 36
- 2024Safety Arithmetic: A Framework for Test-time Safety Alignment of Language Models by Steering Parameters and Activationscited by 32
- 2024BadMerging: Backdoor Attacks Against Model Mergingcited by 32
- 2023Language and Task Arithmetic with Parameter-Efficient Layers for Zero-Shot Summarizationcited by 28
- 2024Robust Concept Erasure Using Task Vectorscited by 27
- 2024Here's a Free Lunch: Sanitizing Backdoored Models with Model Mergecited by 21
- 2024Shortcuts Everywhere and Nowhere: Exploring Multi-Trigger Backdoor Attackscited by 19
- 2024Task Arithmetic can Mitigate Synthetic-to-Real Gap in Automatic Speech Recognitioncited by 14
- 2021Get a Model! Model Hijacking Attack Against Machine Learning Modelscited by 13
- 2024Architectural Neural Backdoors from First Principlescited by 10
- 2024LoBAM: LoRA-Based Backdoor Attack on Model Mergingcited by 10
- 2024BAN: Detecting Backdoors Activated by Adversarial Neuron Noisecited by 7
Built on by
Citing papers per year: 2025: 2; 2026: 1.
3 papers.