Search papers, labs, and topics across Lattice.
This paper introduces Linear Feature Path Minimization (LFPM), a novel framework for mitigating backdoor attacks in model merging by incorporating an anti-backdoor task vector within a unified feature-space perspective. LFPM leverages the Cross-Task Linearity (CTL) framework to optimize backdoor robustness without compromising clean-task performance, addressing the limitations of existing parameter-space editing methods. Experimental results show that LFPM significantly enhances backdoor suppression across both full fine-tuning and Parameter-Efficient Fine-Tuning (PEFT) scenarios, outperforming previous defenses.
LFPM achieves robust backdoor mitigation in model merging while maintaining clean-task performance, challenging the efficacy of traditional parameter-space defenses.
Model merging (MM) has gained significant attention as a cost-effective approach to integrate multiple task-specific models into a unified model. However, recent work reveals that MM is highly susceptible to backdoor attacks. Existing defenses based on task arithmetic often fail to eliminate backdoors without substantially degrading clean-task performance, owing to their reliance on direct parameter-space editing. To address this gap, we propose Linear Feature Path Minimization (LFPM), a backdoor mitigation framework for model merging, which introduces an anti-backdoor task vector into the backdoored merged model. Unlike prior approaches, LFPM formulates the backdoor robustness of the merged model from a unified feature-space perspective under the Cross-Task Linearity (CTL) framework, which leverages the approximate linearity of features across tasks. This perspective guides the optimization of the anti-backdoor task to suppress backdoors while preserving clean-task performance. Furthermore, we introduce an effective optimization mechanism based on gradient accumulation and loss path-integral, ensuring robust backdoor suppression along the interpolation path. Extensive experiments demonstrate that LFPM consistently exhibits strong robustness against backdoor attacks in both full fine-tuning and Parameter-Efficient Fine-Tuning (PEFT) settings.
