arXiv 2402.121682024-03-29cs.CRcs.AIcs.CL

面向参数高效微调的权重投毒后门攻击防御

Defending Against Weight-Poisoning Backdoor Attacks for Parameter-Efficient Fine-Tuning

Nanyang Technological University（南洋理工大学）；Hong Kong University of Science and Technology（香港科技大学）；Jinan University（暨南大学）；Sony Research（索尼研究院）；Zhejiang University（浙江大学）；Beijing Institute of Technology（北京理工大学）

Shuai Zhao, Leilei Gan, Luu Anh Tuan, Jie Fu, Lingjuan Lyu, Meihuizi Jia, Jinming Wen

备注：: NAACL Findings 2024

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

本文揭示了参数高效微调（PEFT）更易遭受权重投毒后门攻击，并提出基于置信度的投毒样本识别模块PSIM，在文本分类任务上实现了接近100%的攻击成功率验证及具有竞争力的防御效果。

摘要：

近年来，多种应用于语言模型的参数高效微调（PEFT）策略被相继提出并成功部署。然而，这引发了一个问题：仅更新有限模型参数的PEFT在面对权重投毒后门攻击时是否构成安全漏洞。在本研究中，我们表明，与全参数微调方法相比，PEFT更容易受到权重投毒后门攻击的影响，即使在微调之后，预定义触发器仍可被利用，且预定义目标仍保持高置信度。受此发现的启发，我们开发了一个利用PEFT的投毒样本识别模块（PSIM），该模块通过置信度识别投毒样本，从而为抵御权重投毒后门攻击提供鲁棒防御。具体而言，我们利用PEFT以随机重置的样本标签训练PSIM。在推理过程中，极端置信度作为投毒样本的指示信号，而其余样本则被视为干净样本。我们在文本分类任务、五种微调策略和三种权重投毒后门攻击方法上进行了实验。实验表明，在采用PEFT时，权重投毒后门攻击的成功率接近100%。此外，我们的防御方法在缓解权重投毒后门攻击方面展现出具有竞争力的整体性能。

英文摘要：

Recently, various parameter-efficient fine-tuning (PEFT) strategies for application to language models have been proposed and successfully implemented. However, this raises the question of whether PEFT, which only updates a limited set of model parameters, constitutes security vulnerabilities when confronted with weight-poisoning backdoor attacks. In this study, we show that PEFT is more susceptible to weight-poisoning backdoor attacks compared to the full-parameter fine-tuning method, with pre-defined triggers remaining exploitable and pre-defined targets maintaining high confidence, even after fine-tuning. Motivated by this insight, we developed a Poisoned Sample Identification Module (PSIM) leveraging PEFT, which identifies poisoned samples through confidence, providing robust defense against weight-poisoning backdoor attacks. Specifically, we leverage PEFT to train the PSIM with randomly reset sample labels. During the inference process, extreme confidence serves as an indicator for poisoned samples, while others are clean. We conduct experiments on text classification tasks, five fine-tuning strategies, and three weight-poisoning backdoor attack methods. Experiments show near 100% success rates for weight-poisoning backdoor attacks when utilizing PEFT. Furthermore, our defensive approach exhibits overall competitive performance in mitigating weight-poisoning backdoor attacks.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。