因果引导的LoRA开放权重后门攻击
Causal-Guided Detoxify Backdoor Attack of Open-Weight LoRA Models
AI总结：
本研究提出CBA框架，通过因果引导和覆盖引导技术，实现对LoRA开放权重模型的高效隐蔽后门攻击，减少假触发率并提升鲁棒性。
摘要：
低秩适应（LoRA）已成为一种高效的微调大型语言模型（LLMs）的方法，并在开源社区中被广泛采用。然而，通过Hugging Face等平台的LoRA适配器的去中心化传播引入了新的安全漏洞：恶意适配器可以轻易传播并逃避传统监管机制。尽管存在这些风险，针对LoRA基础微调的后门攻击仍相对研究不足。现有的后门攻击策略不适合这种环境，因为它们通常依赖于不可访问的训练数据，未能考虑LoRA特有的结构属性，或因假触发率（FTR）高而影响其隐蔽性。为了解决这些挑战，我们提出了因果引导的Detoxify后门攻击（CBA），一种专门针对开放权重LoRA模型的后门攻击框架。CBA无需访问原始训练数据，并通过两个关键创新实现了高隐蔽性：（1）一个覆盖引导的数据生成管道，通过行为探索合成任务对齐的输入；（2）一个因果引导的净化策略，通过保留任务关键神经元合并污染和干净的适配器。与先前的方法不同，CBA通过因果影响基于的权重分配实现训练后对攻击强度的控制，消除了重复重新训练的需要。在六个LoRA模型上评估，CBA实现了高攻击成功率，同时将FTR比基线方法降低了50-70%。此外，它展示了对最新后门防御的增强抵抗力，突显了其隐蔽性和鲁棒性。
英文摘要：
Low-Rank Adaptation (LoRA) has emerged as an efficient method for fine-tuning large language models (LLMs) and is widely adopted within the open-source community. However, the decentralized dissemination of LoRA adapters through platforms such as Hugging Face introduces novel security vulnerabilities: malicious adapters can be easily distributed and evade conventional oversight mechanisms. Despite these risks, backdoor attacks targeting LoRA-based fine-tuning remain relatively underexplored. Existing backdoor attack strategies are ill-suited to this setting, as they often rely on inaccessible training data, fail to account for the structural properties unique to LoRA, or suffer from high false trigger rates (FTR), thereby compromising their stealth. To address these challenges, we propose Causal-Guided Detoxify Backdoor Attack (CBA), a novel backdoor attack framework specifically designed for open-weight LoRA models. CBA operates without access to original training data and achieves high stealth through two key innovations: (1) a coverage-guided data generation pipeline that synthesizes task-aligned inputs via behavioral exploration, and (2) a causal-guided detoxification strategy that merges poisoned and clean adapters by preserving task-critical neurons. Unlike prior approaches, CBA enables post-training control over attack intensity through causal influence-based weight allocation, eliminating the need for repeated retraining. Evaluated across six LoRA models, CBA achieves high attack success rates while reducing FTR by 50-70\% compared to baseline methods. Furthermore, it demonstrates enhanced resistance to state-of-the-art backdoor defenses, highlighting its stealth and robustness.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
