针对大语言模型的合并条件后门失准攻击研究
Towards Merging-conditional Backdoor Unalignment against Large Language Models
AI总结：
该研究针对大语言模型的合并场景提出新型单侧合并条件后门攻击框架SMOKE，可植入难以检测的后门，触发安全失准，验证了其有效性与对现有检测的抗性，揭示了模型合并的潜在漏洞。
摘要：
模型合并已被广泛用于提升大语言模型（LLMs）的特定任务性能，无需额外训练。尽管第三方平台的专用模型可能经过安全审计（如后门检测），我们仍揭示了一种新型且关键的威胁：单侧合并条件后门（OMCB）。OMCB在单个独立模型中处于休眠状态且无法被检测，但在合并时会激活，触发安全失准。我们首先从理论上分析了OMCB的存在性及其几何位置，发现参数偏移跨越安全决策边界是后门激活的主要原因。基于该见解，我们提出了SMOKE，一种基于元学习的攻击框架。SMOKE通过双层优化策略植入OMCB：内层循环通过随机低秩初始化和有限步最大化合成代理元向量，外层循环通过模拟合并过程优化目标模型。此外，初步分析表明，注入的OMCB在未知合并配置下具有有界泛化损失。针对不同模型架构和合并技术的大量实验验证了SMOKE的有效性及其对现有后门检测的抗性，凸显了模型合并范式中一个显著但此前被忽视的漏洞。
英文摘要：
Model merging has become widely adopted for enhancing the task-specific performance of Large Language Models (LLMs) without additional training. While the specialized model from third-party platforms may undergo safety audits (e.g., backdoor detection), we reveal a novel and critical threat: One-sided Merging-Conditional Backdoor (OMCB). OMCB remains dormant and undetectable within one standalone model but activates upon merging, triggering safety unalignment. We first theoretically analyze the existence and geometric location of OMCB, revealing that the parameter shift crossing safety decision boundaries is the main cause of backdoor activation. Building upon this insight, we propose SMOKE, a meta-learning-based attack framework. SMOKE implants OMCB via a bi-level optimization strategy: the inner loop synthesizes surrogate meta-vectors through random low-rank initialization and finite-step maximization, while the outer loop optimizes the target model by simulating the merging process. Furthermore, preliminary analysis shows that the injected OMCB has bounded generalization loss under unknown merging configurations. Extensive experiments across diverse model architectures and merging techniques validate the effectiveness of SMOKE and its resistance to existing backdoor detections, highlighting a significant yet previously overlooked vulnerability in the model merging paradigm.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
