无需重训练，通过模块替换清除模型后门
Cut the Deadwood Out: Backdoor Purification via Guided Module Substitution
- 用单一代理模型与目标模型渐进融合，选择性替换受污染模块
- 在多种攻击下仍能保持90%以上性能，后门消除率超95%
- 适合部署后修复模型，对代理模型和数据不敏感
大语言模型常在不可信平台（如HuggingFace）的数据上训练或微调，面临数据投毒攻击风险。当后门被发现于部署后，重新训练因计算成本和数据限制而不可行。本文提出无重训练的引导模块替换（GMS）方法：将受害模型与单个代理模型进行引导式融合，通过效用与后门的权衡信号，选择性替换受害模型中的模块。GMS具备四项优势：（1）对代理模型的选择与可信度不敏感；（2）适用于数据知识不准确场景；（3）超参数鲁棒性强；（4）可迁移至不同攻击类型。在编码器模型与解码器大模型上的实验表明，GMS显著优于现有最强防御基线，尤其在对抗复杂攻击（如LWS）时表现优异。
原文摘要 · Abstract (English)
Model NLP models are commonly trained (or fine-tuned) on datasets from untrusted platforms like HuggingFace, posing significant risks of data poisoning attacks. A practical yet underexplored challenge arises when such backdoors are discovered after model deployment, making retraining-required defenses less desirable due to computational costs and data constraints. In this work, we propose Guided Module Substitution (GMS), an effective retraining-free method based on guided merging of the victim model with just a single proxy model. Unlike prior ad-hoc merging defenses, GMS uses a guided trade-off signal between utility and backdoor to selectively replaces modules in the victim model. GMS offers four desirable properties: (1) robustness to the choice and trustworthiness of the proxy model, (2) applicability under inaccurate data knowledge, (3) stability across hyperparameters, and (4) transferability across different attacks. Extensive experiments on encoder models and decoder LLMs demonstrate the strong effectiveness of GMS. GMS significantly outperforms even the strongest defense baseline, particularly against challenging attacks like LWS.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。