Search papers, labs, and topics across Lattice.
This paper introduces Z-PEFT, a novel meta-classifier for detecting backdoored models in Parameter-Efficient Fine-Tuning (PEFT) by utilizing layer-wise spectral measures. The study highlights the inadequacy of existing detection methods that rely on closed-world evaluations, demonstrating that high performance in familiar attack scenarios does not guarantee effectiveness against novel threats. Z-PEFT outperforms other weight-space detectors in zero-shot detection while ensuring low computational costs, making it a practical solution for safeguarding against malicious models.
Z-PEFT reveals that traditional backdoor detection methods fail in zero-shot scenarios, highlighting the need for robust, adaptable solutions in model safety.
Parameter-Efficient Fine-tuned (PEFT) models are frequently downloaded from open repositories by practitioners. This widespread practice creates a significant attack surface, as malicious actors can publish backdoored models that induce specific behaviors in response to predefined triggers. We study the problem of weight-space backdoor detection, where a detector classifier predicts whether a model is malicious using only its weights, enabling a lightweight safety mechanism. Most existing methods are designed and evaluated in a closed-world setting, where the detector is trained and tested on the same attack type. In contrast, we evaluate backdoor detection under novel conditions, including previously unseen attacks and datasets. We propose Z-PEFT, a lightweight meta-classifier that relies exclusively on layer-wise spectral measures for classification. Our experiments show that strong performance in the closed-world setting does not necessarily translate to high accuracy in zero-shot backdoor detection. Among weight-space detectors, Z-PEFT achieves the best performance while maintaining low and scalable computational cost.
