LoRA微调模型易被少数伪相关词操控，资源越少越危险。
LoRA Users Beware: A Few Spurious Tokens Can Manipulate Your Finetuned Model
- 仅注入一个与标签伪相关的词即可操控模型预测。
- 低资源LoRA设置下攻击成功率高达90%以上。
- 现有数据检查工具无法防范此类攻击，影响模型安全。
大语言模型常通过低秩适应（LoRA）进行微调，以在低资源下实现高效性能。本文揭示，LoRA会引入短路漏洞——资源越少，模型越易受攻击。我们提出无缝伪词注入（SSTI）方法，发现仅需一个与下游标签伪相关的词，即可在微调时植入后门，使测试时模型预测可被按需操控。在多个模型家族和数据集上的实验表明，即使采用现有数据校验与预处理工具，也无法有效防御该攻击，暴露出数据质量和AI安全的新隐患。
原文摘要 · Abstract (English)
Large Language Models (LLMs) are commonly finetuned for a variety of use cases and domains. A common approach is to leverage Low-Rank Adaptation (LoRA) -- known to provide strong performance at low resource costs. In this study, we demonstrate that LoRA actually opens the door to short-cut vulnerabilities -- and the more resource efficient is the LoRA setup, the more vulnerable will be the finetuned model to aggressive attacks. To measure that vulnerability, we introduce Seamless Spurious Token Injection (SSTI), where we find that LoRA exclusively focuses on even just a single token that is spuriously correlated with downstream labels. In short, injection of that spurious token during finetuning ensure that the model's prediction at test-time can be manipulated on-demand. We conducted experiments across model families and datasets to evaluate the impact of SSTI during LoRA finetuning while providing possible mitigations. Our experiments conclude that none of the existing checkers and preprocessors can sanitize a dataset raising new concerns for data quality and AI safety.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。