Research map / Architectures and efficiency / Quantization

Purifying Quantization-conditioned Backdoors via Layer-wise Activation Correction with Distribution Approximation

ICML 2024 · Architectures and efficiency › Quantization · approach: Post-training weight quantization

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Layer-wise Activation Correction (LAC) with Poisoned Distribution Approximation (PDA) to purify quantization-conditioned backdoors from quantized models using a small unlabeled benign dataset and full-precision BN statistics.

Problem

Quantization-conditioned backdoors (QCBs) stay dormant in full-precision models and activate upon quantization; existing backdoor defenses are largely ineffective against them.

Approach

Observes that backdoor neurons show activation distribution drift after quantization on both benign and poisoned inputs; aligns each layer's activations in the quantized model with the full-precision model (label-free), and perturbs benign inputs so their batch statistics match the full-precision BN running statistics to approximate poisoned distributions.

Key results

• On CIFAR-10 ResNet-18 with 8-bit PQBackdoor, the method reaches 85.81% BA and 1.64% ASR (DER 98.74), while baselines such as FT-SAM and I-BAU fail to suppress the attack.
• Across Tiny-ImageNet and 6 attack settings, the method keeps ASR under about 2% in nearly all cases while retaining BA close to the undefended model.
• Adding PDA as a plug-in to NAD and FT-SAM on BackdoorBench conventional attacks lowers ASR in most cases, notably for NAD on Blended, Input-aware and LF.

Measured effects reported in the paper

Surprising findings

• Including poisoned data or a mixture in layer-wise correction gives more stable and faster convergence than benign data alone, even though the defender lacks labels.
• Tuning-based defenses such as FT-SAM and I-BAU, effective against CompArtifact and Qu-ANTI-zation, fail against PQBackdoor.

Limitations

• Targets only quantization-conditioned backdoors; not applicable to other attack types, per the authors.
• Assumes a small set of benign defender data (5%) and that the full-precision model's BN layers are available; PDA is omitted for architectures without BN.
• Adaptive attacks are only tested with one loss design; the authors leave stronger adaptive attacks to future work.

Experimental setup

Datasets: CIFAR-10 Tiny-ImageNet ImageNette BackdoorBench pre-trained backdoored models

Benchmarks: CIFAR-10 Tiny-ImageNet ImageNette

Metrics: Attack Success Rate (ASR) Benign Accuracy (BA) Defense Effectiveness Rating (DER)

Baselines: FT FP MCR NAD I-BAU FT-SAM

Builds on: PQBackdoor FT-SAM NAD BackdoorBench

Closest papers by meaning

• Nearest is Not Dearest: Towards Practical Defense against Quantization-conditioned Backdoor Attacks (CVPR 2024 · similarity 0.92)
• Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defense (NeurIPS 2024 · similarity 0.87)
• Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness (NeurIPS 2024 · similarity 0.86)
• Mind the Gap: A Practical Attack on GGUF Quantization (ICML 2025 · similarity 0.85)
• BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Model (NeurIPS 2025 · similarity 0.85)
• TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoors (ICML 2024 · similarity 0.85)