These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Deep neural networks (DNNs) have long been recognized as vulnerable to
backdoor attacks. By providing poisoned training data in the fine-tuning
process, the attacker can implant a backdoor into the victim model. This
enables input samples meeting specific textual trigger patterns to be
classified as target labels of the attacker's choice. While such black-box
attacks have been well explored in both computer vision and natural language
processing (NLP), backdoor attacks relying on white-box attack philosophy have
hardly been thoroughly investigated. In this paper, we take the first step to
introduce a new type of backdoor attack that conceals itself within the
underlying model architecture. Specifically, we propose to design separate
backdoor modules consisting of two functions: trigger detection and noise
injection. The add-on modules of model architecture layers can detect the
presence of input trigger tokens and modify layer weights using Gaussian noise
to disturb the feature distribution of the baseline model. We conduct extensive
experiments to evaluate our attack methods using two model architecture
settings on five different large language datasets. We demonstrate that the
training-free architectural backdoor on a large language model poses a genuine
threat. Unlike the-state-of-art work, it can survive the rigorous fine-tuning
and retraining process, as well as evade output probability-based defense
methods (i.e. BDDR). All the code and data is available
https://github.com/SiSL-URI/Arch_Backdoor_LLM.