arXiv 2409.179462025-07-09cs.CRcs.AIcs.CL

突破PEFT限制：利用弱到强知识迁移实现大语言模型中的后门攻击

Breaking PEFT Limitations: Leveraging Weak-to-Strong Knowledge Transfer for Backdoor Attacks in LLMs

Nanyang Technological University（南洋理工大学）；Zhejiang University（浙江大学）；University of St Andrews（圣安德鲁大学）；East China Normal University（华东师范大学）

Shuai Zhao, Leilei Gan, Zhongliang Guo, Xiaobao Wu, Yanhao Jia, Luwei Xiao, Cong-Duy Nguyen, Luu Anh Tuan

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

针对PEFT下后门攻击效果受限的问题，提出基于特征对齐增强知识蒸馏（FAKD）的弱到强知识迁移算法，利用全参数微调的小模型作为教师，向采用PEFT的大模型隐蔽传递后门，在多个模型和攻击算法上实现接近100%的成功率。

摘要：

尽管大语言模型（LLMs）因其卓越能力而被广泛应用，但已被证明易受后门攻击。这类攻击通过污染训练样本和全参数微调（FPFT）将针对性漏洞引入LLMs。然而，此类后门攻击存在局限性，因为它们需要大量的计算资源，尤其是随着LLMs规模的增大。此外，参数高效微调（PEFT）提供了一种替代方案，但受限的参数更新可能阻碍触发器与目标标签的对齐。在本研究中，我们首先验证了使用PEFT的后门攻击在实现可行性能方面可能面临挑战。为了解决这些问题并提高使用PEFT的后门攻击的有效性，我们提出了一种基于特征对齐增强知识蒸馏（FAKD）的弱到强新型后门攻击算法。具体来说，我们通过FPFT污染小规模语言模型作为教师模型。然后，教师模型通过FAKD（采用PEFT）隐蔽地将后门迁移到大规模学生模型。理论分析表明，FAKD有潜力增强后门攻击的有效性。我们在四个语言模型、四种后门攻击算法和两种不同架构的教师模型上展示了FAKD在分类任务中的优越性能。实验结果表明，针对PEFT的后门攻击成功率接近100%。

英文摘要：

Despite being widely applied due to their exceptional capabilities, Large Language Models (LLMs) have been proven to be vulnerable to backdoor attacks. These attacks introduce targeted vulnerabilities into LLMs by poisoning training samples and full-parameter fine-tuning (FPFT). However, this kind of backdoor attack is limited since they require significant computational resources, especially as the size of LLMs increases. Besides, parameter-efficient fine-tuning (PEFT) offers an alternative but the restricted parameter updating may impede the alignment of triggers with target labels. In this study, we first verify that backdoor attacks with PEFT may encounter challenges in achieving feasible performance. To address these issues and improve the effectiveness of backdoor attacks with PEFT, we propose a novel backdoor attack algorithm from the weak-to-strong based on Feature Alignment-enhanced Knowledge Distillation (FAKD). Specifically, we poison small-scale language models through FPFT to serve as the teacher model. The teacher model then covertly transfers the backdoor to the large-scale student model through FAKD, which employs PEFT. Theoretical analysis reveals that FAKD has the potential to augment the effectiveness of backdoor attacks. We demonstrate the superior performance of FAKD on classification tasks across four language models, four backdoor attack algorithms, and two different architectures of teacher models. Experimental results indicate success rates close to 100% for backdoor attacks targeting PEFT.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。