通过谱特征检测参数高效微调模型中的隐藏后门，无需训练即可识别新攻击。
Z-PEFT: Zero-shot Backdoor Detection in Parameter-Efficient Fine-Tuning via Canonical Spectral Signatures
- 基于层间谱特征构建轻量级元分类器，仅用权重判断模型是否恶意。
- 在未见过的攻击和数据集上仍保持高检测准确率，优于现有方法。
- 适合安全审计人员快速筛查开源微调模型，防范潜在后门风险。
参数高效微调（PEFT）模型常被从业者从公开仓库下载使用，这一做法带来了显著的安全隐患：恶意者可发布携带后门的模型，使其在特定触发条件下产生预定行为。本文研究权重空间后门检测问题，即仅通过模型权重判断其是否为恶意，实现轻量级安全机制。现有方法多在封闭世界设定下评估，即检测器在相同攻击类型上训练与测试。本文则在开放世界设定下评估，包括前所未见的攻击类型与数据集。提出Z-PEFT，一种仅依赖逐层谱特征的轻量级元分类器。实验表明，封闭世界表现优异并不意味着零样本检测性能高。在所有权重空间检测器中，Z-PEFT在保持低且可扩展计算成本的同时，实现了最佳检测效果。
原文摘要 · Abstract (English)
Parameter-Efficient Fine-tuned (PEFT) models are frequently downloaded from open repositories by practitioners. This widespread practice creates a significant attack surface, as malicious actors can publish backdoored models that induce specific behaviors in response to predefined triggers. We study the problem of weight-space backdoor detection, where a detector classifier predicts whether a model is malicious using only its weights, enabling a lightweight safety mechanism. Most existing methods are designed and evaluated in a closed-world setting, where the detector is trained and tested on the same attack type. In contrast, we evaluate backdoor detection under novel conditions, including previously unseen attacks and datasets. We propose Z-PEFT, a lightweight meta-classifier that relies exclusively on layer-wise spectral measures for classification. Our experiments show that strong performance in the closed-world setting does not necessarily translate to high accuracy in zero-shot backdoor detection. Among weight-space detectors, Z-PEFT achieves the best performance while maintaining low and scalable computational cost.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。