Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Defending Against Weight-Poisoning Backdoor Attacks for Parameter-Efficient Fine-Tuning

Shuai Zhao, Leilei Gan, Luu Anh Tuan, Jie Fu, Lingjuan Lyu, Meihuizi Jia, Jinming Wen

TL;DR

It is shown that PEFT is more susceptible to weight-poisoning backdoor attacks compared to the full-parameter fine-tuning method, with pre-defined triggers remaining exploitable and pre-defined targets maintaining high confidence, even after fine-tuning.

Abstract

Recently, various parameter-efficient fine-tuning (PEFT) strategies for application to language models have been proposed and successfully implemented. However, this raises the question of whether PEFT, which only updates a limited set of model parameters, constitutes security vulnerabilities when confronted with weight-poisoning backdoor attacks. In this study, we show that PEFT is more susceptible to weight-poisoning backdoor attacks compared to the full-parameter fine-tuning method, with pre-defined triggers remaining exploitable and pre-defined targets maintaining high confidence, even after fine-tuning. Motivated by this insight, we developed a Poisoned Sample Identification Module (PSIM) leveraging PEFT, which identifies poisoned samples through confidence, providing robust defense against weight-poisoning backdoor attacks. Specifically, we leverage PEFT to train the PSIM with randomly reset sample labels. During the inference process, extreme confidence serves as an indicator for poisoned samples, while others are clean. We conduct experiments on text classification tasks, five fine-tuning strategies, and three weight-poisoning backdoor attack methods. Experiments show near 100% success rates for weight-poisoning backdoor attacks when utilizing PEFT. Furthermore, our defensive approach exhibits overall competitive performance in mitigating weight-poisoning backdoor attacks.

Defending Against Weight-Poisoning Backdoor Attacks for Parameter-Efficient Fine-Tuning

TL;DR

It is shown that PEFT is more susceptible to weight-poisoning backdoor attacks compared to the full-parameter fine-tuning method, with pre-defined triggers remaining exploitable and pre-defined targets maintaining high confidence, even after fine-tuning.

Abstract

Recently, various parameter-efficient fine-tuning (PEFT) strategies for application to language models have been proposed and successfully implemented. However, this raises the question of whether PEFT, which only updates a limited set of model parameters, constitutes security vulnerabilities when confronted with weight-poisoning backdoor attacks. In this study, we show that PEFT is more susceptible to weight-poisoning backdoor attacks compared to the full-parameter fine-tuning method, with pre-defined triggers remaining exploitable and pre-defined targets maintaining high confidence, even after fine-tuning. Motivated by this insight, we developed a Poisoned Sample Identification Module (PSIM) leveraging PEFT, which identifies poisoned samples through confidence, providing robust defense against weight-poisoning backdoor attacks. Specifically, we leverage PEFT to train the PSIM with randomly reset sample labels. During the inference process, extreme confidence serves as an indicator for poisoned samples, while others are clean. We conduct experiments on text classification tasks, five fine-tuning strategies, and three weight-poisoning backdoor attack methods. Experiments show near 100% success rates for weight-poisoning backdoor attacks when utilizing PEFT. Furthermore, our defensive approach exhibits overall competitive performance in mitigating weight-poisoning backdoor attacks.
Paper Structure (13 sections, 1 equation, 4 figures, 10 tables, 1 algorithm)

This paper contains 13 sections, 1 equation, 4 figures, 10 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Preliminary
  3. Security of Parameter-Efficient Fine-Tuning
  4. Defending Against Weight-Poisoning Backdoor Attacks for PEFT
  5. Experiments
  6. Experimental Details
  7. Results of Weight-Poisoning Backdoor Attack
  8. Results of Weight-Poisoning Attack Defense
  9. Conclusion
  10. Limitations
  11. Related Work
  12. Experimental Setting
  13. More Experiments Results

Figures (4)

  • Figure 1: Clean accuracy and attack success rate of full-parameter fine-tuning and P-tuning v1 are analyzed in the SST-2 dataset socher2013recursive, BadNet gu2017badnets used as the weight-poisoning attack method.
  • Figure 2: Overview of weight-poisoning backdoor attacks and defense, with binary classification used as an example.
  • Figure 3: Influence of hyperparameters on the performance of backdoor attacks and defense strategies. The notation w/D indicates the usage of defense methods.
  • Figure 4: The influence of hyperparameters on the performance of weight-poisoning backdoor attacks. The notation w/D indicates the usage of defense methods.