From Purity to Peril: Backdooring Merged Models From "Harmless" Benign...
summary
Introduces MergeBackdoor, a two-stage training method that makes each upstream model appear clean (upstream ASRs at random-guessing level) yet causes the merged model to exhibit a backdoor with ASR ≈ 1.0. Demonstrates across ViT, BERT and LLM families on 12 datasets and multiple merging schemes, shows batch-by-batch updating is critical for convergence, locates key vulnerable middle layers, preserves clean accuracy, and finds existing detectors—even those aware of triggers—fail to flag the upstream models.
AI-written summary · about
chapters (11)
- 0:00Model merging vulnerabilities
- 2:42Beer and sewage reaction
- 3:47Emergent backdoors
- 5:12Merge Backdoor training
- 7:22Batch updating role
- 8:28Evaluating Merge Backdoor
- 9:59Effectiveness vs clean accuracy
- 10:41Merge Backdoor robustness
- 11:22Multimodel merging attack
- 12:48Backdoor propagation layers
- 14:15Detection challenges
related talks
36mVulnerabilities in Deep Learning Language Models (DLLMs)
01h 04mCan you trust your (large language) model?
35mDo AI-models gossip?
30mWhen Good Models Go Bad: The damage caused by wayward models and how to prevent it
01h 27mChallenges in Making LLMs Safe and Robust
33mAt the age of AI and ML
43mOne Poisoned Artifact Can Steer Your AI: How Robust Are Your LLM-Assisted Security Workflows?
44m$1 AI Guardrails: The Unreasonable Effectiveness of Finetuned ModernBERTs