Research map / Adversarial robustness and security / Backdoor and poisoning
Nearest is Not Dearest: Towards Practical Defense against Quantization-conditioned Backdoor Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Analyzes quantization-conditioned backdoors (QCBs) and proposes EFRAP, a layer-wise learned non-nearest rounding strategy guided by neuron-wise rounding error norms and activation preservation, which removes QCB effects with 1% clean unlabeled data.
Problem
Quantization-conditioned backdoors stay dormant in full-precision models and activate after standard quantization, evading detection and resisting existing backdoor defenses and robust quantization methods.
Approach
Backdoor activation is tied to nearest-rounding truncation errors; EFRAP flips rounding decisions for neurons with large error norms while preserving layer-wise activations via a relaxed binary optimization, breaking the link between nearest rounding and the backdoor.
Key results
- On CIFAR-10 ResNet-18 4-bit PQBackdoor, EFRAP reduces ASR from 96.74% to 2.33% while keeping CDA at 85.16%.
- Across six attack settings on Tiny-ImageNet, EFRAP keeps ASR at or below about 4.25% with CDA close to the no-defense model.
- EFRAP is effective on AlexNet, VGG-16 and MobileNet-V2 (4-bit CompArtifact-style attack ASR reduced to about 1-2%).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| apply EFRAP quantization instead of no defense | ResNet-18 · CIFAR-10, PQBackdoor, 4-bit | ASR: 96.74 -> 02.33 | Helped |
| apply EFRAP quantization instead of no defense | ResNet-18 · CIFAR-10, PQBackdoor, 4-bit | CDA: 81.31 -> 85.16 | Helped |
| add error-guided flipped rounding (LF) (ablation) | EFRAP · CIFAR-10, PQBackdoor, 4-bit | ASR: 96.74 -> 5.73 | Helped |
| add error-guided flipped rounding (LF) (ablation) | EFRAP · CIFAR-10, PQBackdoor, 4-bit | CDA: 81.31 -> 51.47 | Hurt |
| add activation preservation (LA) to LF (ablation) | EFRAP · CIFAR-10, PQBackdoor, 4-bit | CDA: 51.47 -> 84.36 | Helped |
| add activation preservation (LA) to LF (ablation) | EFRAP · CIFAR-10, PQBackdoor, 4-bit | ASR: 5.73 -> 1.68 | Helped |
| add penalty LP to LF and LA (ablation) | EFRAP · CIFAR-10, PQBackdoor, 4-bit | CDA: 84.36 -> 85.16 | Helped |
| add penalty LP to LF and LA (ablation) | EFRAP · CIFAR-10, PQBackdoor, 4-bit | ASR: 1.68 -> 02.33 | Hurt |
| vary λA and λP (ablation) | EFRAP · CIFAR-10, PQBackdoor, 4-bit | CDA | No clear effect |
Surprising findings
- Flipping only neurons with the largest rounding errors, without activation preservation, severely harms clean accuracy in 4-bit (CDA drops to 51.47%).
- Standard backdoor defenses applied to full-precision models are unstable; FP nearly fails on CIFAR-10 while FT, MCR and I-BAU fail on PQBackdoor.
Limitations
- Adaptive attack evaluation is limited to one forced-activation variant; the paper argues but does not prove robustness.
- Evaluated only on small image classification models and two datasets (CIFAR-10, Tiny-ImageNet).
- Quantization-induced CDA gains from defense are attributed to capacity arguments without in-depth investigation.
Experimental setup
Datasets: CIFAR-10 Tiny-ImageNet
Benchmarks: CIFAR-10 Tiny-ImageNet
Metrics: CDA ASR DTM
Baselines: FT FP MCR NAD I-BAU OMSE OCS ACIQ
Builds on: AdaRound (Nagel et al.) PQBackdoor Qu-ANTI-zation CompArtifact Fine-pruning
Closest papers by meaning
- Purifying Quantization-conditioned Backdoors via Layer-wise Activation Correction with Distribution Approximation (ICML 2024 · similarity 0.92)
- Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness (NeurIPS 2024 · similarity 0.86)
- Mind the Gap: A Practical Attack on GGUF Quantization (ICML 2025 · similarity 0.86)
- Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defense (NeurIPS 2024 · similarity 0.85)
- Fusing Pruned and Backdoored Models: Optimal Transport-based Data-free Backdoor Mitigation (AAAI 2025 · similarity 0.84)
- BAN: Detecting Backdoors Activated by Adversarial Neuron Noise (NeurIPS 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.