量化微调权重能提升安全，资源消耗低且性能损失小。
Quantized Delta Weight Is Safety Keeper
- 用比特级压缩微调增量权重，降低资源占用。
- 压缩后对齐偏差、后门攻击、恶意输出风险分别降低66.17%、64.46%、90.53%。
- 适合需要安全高效的多租户大模型服务场景。
近期微调专有语言模型的进展推动了多领域定制应用，但也带来高资源需求和安全风险两大挑战。针对资源问题，已有工作提出如BitDelta等部分压缩方法，对微调模型与基础模型间的增量权重进行量化。针对安全风险，用户自定义微调可能引入对齐失效、后门攻击和幻觉等问题。然而，当前安全评估大多集中于全精度或全压缩模型，鲜少探讨部分压缩如何影响安全性。本文首次系统评估增量权重量化在安全威胁下的鲁棒性。以Llama-2-7b-chat为例，发现“免费午餐”现象：在不超过10%性能损失下，部分压缩可使对齐破坏风险降低66.17%，有害后门漏洞减少64.46%，针对性输出操控风险最高降低90.53%。通过LogitLens可视化前向传播中的内部状态变化，揭示了标准微调与压缩微调在安全失效与恢复机制上的差异。本工作为安全、高效的大规模多租户服务选择有效的增量压缩方法提供了新视角。
原文摘要 · Abstract (English)
Recent advancements in fine-tuning proprietary language models enable customized applications across various domains but also introduce two major challenges: high resource demands and security risks. Regarding resource demands, recent work proposes novel partial compression, such as BitDelta, to quantize the delta weights between the fine-tuned model and base model. Regarding the security risks, user-defined fine-tuning can introduce security vulnerabilities, such as alignment issues, backdoor attacks, and hallucinations. However, most of the current efforts in security assessment focus on the full-precision or full-compression models, it is not well-discussed how the partial compression methods affect security concerns. To bridge this gap, we evaluate the robustness of delta-weight quantization against these security threats. In this paper, we uncover a "free lunch" phenomenon: partial compression can enhance model security against fine-tuning-based attacks with bearable utility loss. Using Llama-2-7b-chat as a case study, we show that, with under 10% utility degradation, the partial compression mitigates alignment-breaking risks by up to 66.17%, harmful backdoor vulnerabilities by 64.46%, and targeted output manipulation risks by up to 90.53%. We further apply LogitLens to visualize internal state transformations during forward passes, suggesting mechanisms for both security failure and recovery in standard versus compressed fine-tuning. This work offers new insights into selecting effective delta compression methods for secure, resource-efficient multi-tenant services.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。