提出FlipGuard防御量化触发的后门攻击，无需训练数据即可激活防护。
FlipGuard: Defending Large Language Models Against Quantization-Conditioned Backdoor Attacks
- 通过扰动权重打破攻击者对量化边界的精准控制
- 在7个LLM上实现高安全防御，性能损失可忽略
- 适合关注模型部署安全的开发者和研究者
模型量化对大型语言模型（LLMs）的高效部署至关重要，但引入了严重漏洞：量化条件后门（QCB）攻击。此类攻击中，恶意行为在全精度模型中保持休眠状态，仅在特定量化失真下激活，绕过常规安全检测。为此，我们提出FlipGuard，一种主动防御框架，在量化前选择性扰动模型权重。通过破坏攻击者对权重模式与量化边界之间精确对齐的关系，该方法在无需访问训练数据或触发样本的情况下抑制后门激活。我们进一步提出防御有效性比率（DER），统一评估安全性提升、性能保留与计算成本。在七个LLM（包括StarCoder和LLaMA系列模型）及三种量化方案（INT8、FP4、NF4）上的广泛实验表明，FlipGuard在三类场景——易受攻击代码生成、内容注入和过度拒绝——中均有效中和QCB攻击，实现高安全性且性能下降极小。
原文摘要 · Abstract (English)
Model quantization is essential for the efficient deployment of Large Language Models (LLMs), but introduces a critical vulnerability: Quantization-Conditioned Backdoor (QCB) attacks. In these attacks, malicious behaviors remain dormant in full-precision models and activate only after specific quantization distortions, bypassing standard security audits. To mitigate this, we introduce FlipGuard, a proactive defense framework that selectively perturbs model weights prior to quantization. By breaking the adversary's precise alignment between weight patterns and quantization boundaries, FlipGuard suppresses backdoor activation without requiring access to training data or trigger samples. We further propose the Defense Effectiveness Ratio (DER), a unified metric to jointly evaluate security gains, utility preservation, and computational cost. Extensive experiments across seven LLMs (including StarCoder and LLaMA-family models) and three quantization schemes (INT8, FP4, NF4) demonstrate that FlipGuard effectively neutralizes QCBs across three scenarios, i.e., vulnerable code generation, content injection, and over-refusal, achieving high security with negligible performance degradation.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。