模型量化会破坏现有后门防御，导致检测率归零却仍保持高攻击成功率。
Quantization Blindspots: How Model Compression Breaks Backdoor Defenses
- 在INT8和INT4量化下测试五种主流防御方法
- 量化后所有防御检测率降至0%，攻击成功率仍超99%
- 防御效果受数据集影响显著，需考虑量化鲁棒性
后门攻击可在保持高正常准确率的同时嵌入输入相关的恶意行为，是部署中机器学习系统的长期威胁。然而实际部署几乎从不使用全精度模型：后训练量化至INT8或更低精度已成为降低内存和延迟的标准做法。本文系统研究了五种代表性防御在三种精度设置（FP32、INT8动态、INT4模拟）下对标准视觉基准的性能表现。实验采用典型BadNet攻击，在INT8量化下，所有防御检测率均降为0%，而攻击成功率仍高于99%；在INT4时，出现明显数据集依赖性：Neural Cleanse在GTSRB上仍有效，但在CIFAR-10上失效，尽管后门仍能通过量化存活，攻击成功率超过90%。结果揭示了当前防御评估（基于FP32模型）与实际部署（量化形式）之间的不匹配，强调量化鲁棒性应成为未来防御设计与评估的关键维度。
原文摘要 · Abstract (English)
Backdoor attacks embed input-dependent malicious behavior into neural networks while preserving high clean accuracy, making them a persistent threat for deployed ML systems. At the same time, real-world deployments almost never serve full-precision models: post-training quantization to INT8 or lower precision is now standard practice for reducing memory and latency. This work asks a simple question: how do existing backdoor defenses behave under standard quantization pipelines? We conduct a systematic empirical study of five representative defenses across three precision settings (FP32, INT8 dynamic, INT4 simulated) and two standard vision benchmarks using a canonical BadNet attack. We observe that INT8 quantization reduces the detection rate of all evaluated defenses to 0% while leaving attack success rates above 99%. For INT4, we find a pronounced dataset dependence: Neural Cleanse remains effective on GTSRB but fails on CIFAR-10, even though backdoors continue to survive quantization with attack success rates above 90%. Our results expose a mismatch between how defenses are commonly evaluated (on FP32 models) and how models are actually deployed (in quantized form), and they highlight quantization robustness as a necessary axis in future evaluations and designs of backdoor defenses.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。