Research map / Adversarial robustness and security / Backdoor and poisoning
Mitigating the Backdoor Effect for Multi-Task Model Merging via Safety-Aware Subspace
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Studies how multi-task model merging of CLIP-ViT models propagates backdoors (succession and transfer) and proposes Defense-Aware Merging (DAM), which learns task-shared and backdoor-detection masks via bi-level optimization with synthesized perturbations to cut attack success rate while keeping accuracy.
Problem
Existing multi-task model merging methods optimize only clean accuracy and ignore backdoors inherited from compromised task-specific models, which persist (backdoor succession) and spread to clean models (backdoor transfer) in the merged model.
Approach
A dual-mask bi-level optimization over task vectors: a Task-Shared mask resolves task interference while a Backdoor-Detection mask, guided by synthesized universal perturbations on unlabeled test data, isolates backdoor-sensitive parameters; masked-out parameters revert to pre-trained weights.
Key results
- On CLIP-ViT-B/32 with two TrojVit-backdoored models, DAM reaches average ACC(2) 89.77 and ASR(6) 35.77, versus 88.68/37.66 for the strongest prior merging baseline (Concrete AM layer-wise).
- With four backdoored models, DAM lowers ASR(4) to 33.95 versus 41.60 for AdaMerging (layer-wise), while ACC(6) drops by under 1 point.
- Against LoRA-as-an-Attack/WAG, DAM improves ACC/ASR from 83.81/29.51 to 85.79/24.52 in one setting, and from 81.11/33.58 to 86.81/27.11 in another.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use DAM instead of Concrete AM (Layer-Wise) | CLIP-ViT-B/32 multi-task merging with two TrojVit-backdoored models · Six image-classification tasks | ASR(6): 37.66 -> 35.77 | Helped |
| Use DAM instead of Concrete AM (Layer-Wise) | CLIP-ViT-B/32 multi-task merging with two TrojVit-backdoored models · Six image-classification tasks | ACC(6): 85.93 -> 85.23 | Hurt |
| Use DAM instead of SAU | CLIP-ViT-B/32 multi-task merging with four TrojVit-backdoored models · Six image-classification tasks | ASR(6): 39.51 -> 36.06 | Helped |
| Use DAM instead of Concrete AM (Layer-Wise) | CLIP-ViT-B/32 multi-task merging with four TrojVit-backdoored models · Six image-classification tasks | ACC(6): 86.59 -> 85.86 | Hurt |
| Use DAM instead of LoRA-as-an-Attack/WAG | Multi-task merging with two backdoored and two clean models, plus four clean models · (2 backdoor + 2 clean) + 4 clean | ACC: 83.81 -> 85.79 | Helped |
| Use DAM instead of LoRA-as-an-Attack/WAG | Multi-task merging with two backdoored and two clean models, plus four clean models · (2 backdoor + 2 clean) + 4 clean | ASR: 29.51 -> 24.52 | Helped |
| Apply BadMerging to the DAM-merged model | DAM · 2 backdoor + 4 clean | ASR: 35.77 -> 36.35 | Hurt |
Surprising findings
- Ties-Merging, reported as strong for clean merging, performs poorly on ASR under backdoored models, sometimes worse than RegMean and Fisher merging.
- A backdoor in one model's task-general parameters can raise ASR on clean tasks after merging (backdoor transfer), e.g. SVHN ASR rises after merging with backdoored models.
Limitations
- Evaluated only on image classification with CLIP-ViT models on six tasks; no LLM or other modalities.
- Relies on the assumption that the pre-trained model is clean and protected.
- The gain over the strongest baseline is modest (around 1-2 ASR points on some averages) and DAM trails in ACC on some settings.
Experimental setup
Datasets: Stanford Cars RESISC45 EuroSAT SVHN MNIST DTD
Benchmarks: Stanford Cars RESISC45 EuroSAT SVHN MNIST DTD
Metrics: ACC ASR
Baselines: Weight Average Fisher Merging RegMean Task Arithmetic Ties-Merging AdaMerging Concrete AM ANP AWM SAU WAG LoRA-as-an-Attack
Builds on: Concrete subspace masking AdaMerging Task Arithmetic TrojVit WAG
Closest papers by meaning
- Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness (NeurIPS 2024 · similarity 0.86)
- BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimization (NeurIPS 2025 · similarity 0.86)
- Backdoor Mitigation via Invertible Pruning Masks (NeurIPS 2025 · similarity 0.85)
- The Ripple Effect: On Unforeseen Complications of Backdoor Attacks (ICML 2025 · similarity 0.85)
- Whoever Started the interference Should End It: Guiding Data-Free Model Merging via Task Vectors (ICML 2025 · similarity 0.85)
- Lie Detector: Unified Backdoor Detection via Cross-Examination Framework (NeurIPS 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.