PEFTGuard: Detecting Backdoor Attacks Against Parameter-Efficient Fine-Tuning

1 Introduction

• Shareable, plug-and-play adapters can carry backdoors into benign LLMs and produce incorrect or toxic responses when loaded.Existing detection approaches primarily target logits-based classification, and their effectiveness in generation tasks lacks comprehensive assessment.Source: §1 · pp. 1–2

1.1 Our Work

• 99% detection accuracy and 1.0 AUC in classification tasks, and 100% detection accuracy and 1.0 AUC in generation tasks, are reported for PEFTGuard.The paper also reports consistently high accuracy across diverse adapter settings and zero-shot detection of adapters from unknown attacks.Source: §1.1 · p. 2
• The paper analyzes PEFT adapter vulnerabilities across attack scenarios and reports PEFTGuard’s superior detection performance, transferability, and robustness.Its evaluation includes five adaptive attacks, and the authors report fine-mixing reducing ASR from 100% to 7.2% while clean accuracy remains 96.12%.Source: §1.1 · p. 2
• PADBench provides 13,300 adapters spanning multiple attack scenarios for evaluating backdoor detection in PEFT-based adapters.The broader analysis covers varied datasets, attack strategies, PEFT methods, base models, ranks, target matrices, and additional modalities.Source: §1.1 · p. 2
• PEFTGuard transforms adapter weights and uses a meta classifier to detect backdoored PEFT adapters in a zero-shot manner.The framework does not require additional input data or merging adapters back into the original LLMs for inference.Source: §1.1 · p. 2

2.1 LLMs

• LLMs span encoder-only understanding models, decoder-only autoregressive generators, and encoder-decoder sequence-to-sequence models, each with a corresponding pretraining objective.Encoder-only models use masked language modeling; decoder-only and encoder-decoder models use autoregressive and sequence-to-sequence objectives, respectively.Source: §2.1 · pp. 2–3

2.2 PEFT Methods

• Reparameterized PEFT freezes base weights and adds low-rank adapters; methods vary through quantization, learning-rate choices, adaptive rank allocation, and magnitude-direction decomposition.The paper focuses on LoRA, QLoRA, LoRA+, AdaLoRA, and DoRA.Source: §2.2 · pp. 3–4

2.3 Backdoor Attacks

• Backdoors preserve normal behavior on clean inputs but produce attacker-directed behavior when triggered; PEFT adapters lower attack costs and can spread as plugins or through combination with benign adapters.Triggered generation can include harmful outputs, and adapter backdoors may remain potent after weight merging.Source: §2.3 · p. 4

3.1 Adversary

• The attacker seeks triggered harmful outputs while preserving normal behavior on clean inputs, including after adapter weights are merged.The stated harmful behaviors include overriding correct predictions and generating toxic sentences.Source: §3.1 · p. 4
• The attacker may poison fine-tuning data and release prepared adapters, but cannot influence defender actions after release.The attacker has no fixed preference for PEFT strategy, rank, or base-model architecture and monitors attack success and normal-task performance.Source: §3.1 · p. 5

3.2 Defender

• The defender classifies an adapter using its weights, without assumed access to its training data, hyperparameters, trigger, or downstream task.The paper frames public access to adapter weights as realistic because adapters are commonly open-sourced.Source: §3.2 · p. 5

4 Methodology

• PEFTGuard treats adapters as fine-tuning deltas, examines query-layer parameters, and frames detection as binary classification after feature transformation.A t-SNE analysis indicates that each self-attention layer can distinguish benign from backdoored conditions to some extent.Source: §4 · p. 5

4.1 Adapter Generation

• Training data are generated by sampling task datasets and fine-tuning LLMs with PEFT to create benign and backdoored adapters for supervised classifier training.The paper identifies Adapter Generation, Feature Transformation, and Classifier Training as the pipeline’s three steps.Source: §4.1 · p. 5, §4 · p. 5

4.2 Feature Transformation

• Feature transformation addresses mismatched adapter ranks by concatenating self-attention weight matrices and stacking layer representations into the classifier input tensor.The resulting tensor is fed to the meta-classifier.Source: §4.2 · pp. 5–6

4.3 Classifier Training

• The meta-classifier uses convolution to reduce the high-dimensional input and extract features before MLP layers perform classification.For Llama-2-7B with LoRA targeting query and value matrices, the stated input dimensions are [64,4096,4096].Source: §4.3 · p. 6

5.1 Target LLMs

• The evaluation spans seven target models covering different transformer architectures, including a chat model and three attention-mechanism types.The models include decoder-only, prefix decoder-only, encoder-decoder, and encoder-only architectures.Source: §5.1 · p. 6

5.2 Metrics

• Detection is assessed with Detection Accuracy (DA) and Area Under the ROC Curve (AUC), while adapter behavior is measured by Attack Success Rate (ASR) and Clean Accuracy (CA).The classifier is trained three times per experiment, and average performance is reported.Source: §5.2 · p. 6

5.3.1 Backdoor Injection Setup

• The injection setup covers five NLP datasets, four textual attacks for task-specific datasets, and five reparameterized PEFT algorithms, with poisoning fixed at 5%.IMDB and AG News are converted to generation-based classification; the instruction-following datasets use preconfigured triggers.Source: §5.3.1 · p. 7

5.3.2 Backdoor Detection Setup

• Detection uses an 8:2 train-test split, reserves 10% of training samples for validation, and includes adapters with varying attack success rates.The evaluation measures both ASR and CA for task-specific adapters, but only ASR for instruction-following adapters.Source: §5.3.2 · pp. 7–8

5.4 Defenses

• Mitigation compares SFT, DPO, and Fine-mixing against InsertSent backdoors in LoRA-fine-tuned Llama-2-7B, using 2,500 clean sentences per class.Testing uses 2,500 clean samples for CA and 1,000 triggered samples for ASR.Source: §5.4 · p. 8

6.1 Detection Performance of PEFTGuard

• 100.00% accuracy and 1.000 AUC on both instruction-following datasets, plus 100.00% accuracy and 1.000 AUC for AG News under RIPPLES and StyleBkd, show strong detection across these settings.For AG News, InsertSent and Syntactic yield 98.33%/99.33% accuracy and 0.996/0.998 AUC, respectively.Source: §6.1 · p. 8, Table 1 · p. 8

6.2 Comparison with SOTA Detection Methods

• 98.33% accuracy and AUC 1.000 in the SC task, and perfect results in the IF task, put PEFTGuard ahead of the compared detection methods.Trojan-Miner and AttenTD each achieve only 50% accuracy; MNTD reaches 51% accuracy and 0.510 AUC in IF.Source: Table 2 · p. 9, §6.2 · p. 9

6.3 Ablation Study

• LoRA, LoRA+, and AdaLoRA each reach 100.00% accuracy and 1.000 AUC; QLoRA and DoRA average 99.67% and 98.00% accuracy, respectively, also with AUC 1.000.The comparison fixes Llama-2-7B and uses toxic-backdoors-hard.Source: §6.3 · p. 9, Table 3 · p. 9
• Across tested base models, AUC is 1.000, with accuracy from 98.33% on Roberta-base to 100% on four models; visual-model and MLLM accuracy is 99.67% and 99.33%.The evaluation also reports effectiveness across Llama parameter scales, model types, transformer architectures, and attention mechanisms.Source: §6.3 · pp. 9–10, Table 4 · p. 9
• At 100 training examples PEFTGuard achieves 97% accuracy and 0.995 AUC, reaching 100% accuracy at 200; target-projection variants achieve 100% accuracy.Replacing convolution with adaptive pooling yields 50% accuracy, while Max Pooling yields 89.33%; the original classifier architecture performs comparably to alternatives.Source: Table 5 · p. 9, §6.3 · p. 10, Figure 6 · p. 10

6.4 Zero-Shot Transferability of PEFTGuard

• Zero-shot transfer exceeds 99% accuracy for QLoRA, LoRA+, and DoRA, and averages above 98.67% accuracy and 0.998 AUC for LoRA ranks below 256; transfer to higher ranks weakens.For unknown attacks, contrastive learning and model fusion reach 93% accuracy on InsertSent, versus at most 61.33% for separately trained models; attack-to-attack transfer is otherwise often poor.Source: §6.4 · p. 11, Table 10 · p. 11, Table 11 · p. 11

6.5 Adaptive Attacks

• Under stronger adaptive attacks, evasion can rise, but the reported weight adjustments also substantially reduce the backdoored model’s clean accuracy and attack success rate.Gaussian noise leaves attack success on PEFTGuard at 0%; under FGSM at ε = 1 × 10^-3, evasion reaches 92% while clean accuracy falls from 97.1% to 44.9% and attack success from 0.999 to 0.139.Source: §6.5 · p. 12, Table 12 · p. 12

6.6 Backdoor Mitigation

• Fine-mixing reduces attack success to 7.20% while retaining 93.92% clean accuracy, compared with DPO’s 0.00% attack success and 64.56% accuracy.The original backdoored model has 100.00% attack success and 96.88% clean accuracy; fine-mixing is less effective at removal than DPO but retains higher accuracy.Source: §6.6 · p. 13, Table 13 · p. 13

Transferability

• Different input dimensions require training a new classifier, limiting zero-shot transfer across LLMs; downsampling performed strongly on standardized inputs, but transfer to unknown LLMs remains uninvestigated.For a completely new detection scenario, training and deployment also require substantial time; the authors report strong performance with 100 training samples.Source: §7 · p. 13

Backdoor Pattern Explanation

• Further analysis of backdoor patterns across attacks, models, and hyperparameters is identified as future work.The authors suggest studying task-vector space and note that prior computer-vision work may offer useful insights.Source: §7 · p. 13

PEFT

• LoRA uses low-rank matrices to reduce fine-tuning memory, while QLoRA adds quantization to reduce storage and computation [25] [12].The discussion also covers AdaLoRA, LoRA+ [23], and DoRA [40] as further PEFT variants.Source: §8 · p. 13

Backdoor Detection on LLMs

• Early NLP backdoor-detection methods include Trojan-Miner, which uses a seq-to-seq model to generate potential trigger sentences [2], and AttenTD, which distinguishes backdoored models through attention anomalies [44].Source: §8 · p. 13
• For generation tasks producing coherent content, trigger generation through classification-label changes and optimization-based inversion from discrete outputs struggle to yield precise triggers; preset-word attention analysis is challenged because added words shift attention to fit context.Source: §8 · p. 14

Conclusion

• PADBench provides benign and backdoored adapters, alongside the paper’s in-depth analysis of PEFT-adapter security vulnerabilities.The conclusion describes PADBench as the first dataset of its kind.Source: §9 · p. 14
• PEFTGuard detects adapters using only their parameters, without requiring additional detection information, and achieves state-of-the-art performance across varied datasets, attacks, PEFT methods, and base LLMs.The conclusion characterizes the evaluated adapters as generated from different datasets, attacks, PEFT methods, and base LLMs.Source: §9 · p. 14
• PEFTGuard shows zero-shot transfer across PEFT methods, adapter ranks, and backdoor attacks, and robustness against adaptive attacks.The authors hope PADBench and PEFTGuard will advance adapter security governance on open-source platforms.Source: §9 · p. 14

Ablation Study about Zero-shot Transferability on Unknown Attacks

• The table’s attack labels map Sent to InsertSent, Word to RIPPLES, Syn to Syntactic, and Sty to StyleBkd.The caption identifies the table as an ablation study of zero-shot transferability.Source: Table 14 · p. 20
• AUC reaches 0.973 with DA 59% using two attack types, and AUC reaches 0.973 with DA 68% using contrastive learning alone.The table reports ablation performance for zero-shot transfer; the passage also reports a similar outcome for model fusion without contrastive learning.Source: A Ablation Study about Zero-shot… · p. 20, Table 14 · p. 20
• The ablation varies the number of attack adapters, the number of fusions, and contrastive learning to examine their impact on outcomes.It focuses on the Syntactic attack because its transfer effectiveness was consistently the worst among the attacks.Source: A Ablation Study about Zero-shot… · p. 20

• Clean-subset fine-tuning mitigated backdoors in experiments by Yao et al. and Sha et al. [59].Source: B Related Work on Backdoor Mitigation… · p. 20
• DPO [56] uses triggered texts with normal answers as preferred texts to eliminate backdoor influences in the model.The method uses the mapping between reward functions and optimal policies to optimize constrained reward maximization through single-stage policy training.Source: B Related Work on Backdoor Mitigation… · p. 20
• Fine-mixing [85] mixes backdoored weights with clean pre-trained weights before fine-tuning on clean data, while E-PUR detects and eliminates potential backdoor techniques within embeddings.Source: B Related Work on Backdoor Mitigation… · p. 20