Unlearning Backdoor Attacks for LLMs with Weak-to-Strong Knowledge Distillation

2024/10/18 by Shuai Zhao, Zhao, Shuai, Xiaobao Wu +9 · 12 citations
Computer Science · #Adversarial Robustness in Machine Learning #Artificial Intelligence (cs.AI) #Computation and Language (cs.CL) #Cryptography and Data Security #Cryptography and Security (cs.CR) #FOS: Computer and information sciences

paper · pdf · doi:10.48550/arxiv.2410.14425

openalex publication_date 2024/10/18 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Parameter-efficient fine-tuning (PEFT) can bridge the gap between large language models (LLMs) and downstream tasks. However, PEFT has been proven vulnerable to malicious attacks. Research indicates that poisoned LLMs, even after PEFT, retain the capability to activate internalized backdoors when input samples contain predefined triggers. In this paper, we introduce a novel weak-to-strong unlearning algorithm to defend against backdoor attacks based on feature alignment knowledge distillation, named W2SDefense. Specifically, we first train a small-scale language model through full-parameter fine-tuning to serve as the clean teacher model. Then, this teacher model guides the large-scale poisoned student model in unlearning the backdoor, leveraging PEFT. Theoretical analysis suggests that W2SDefense has the potential to enhance the student model's ability to unlearn backdoor features, preventing the activation of the backdoor. We conduct comprehensive experiments on three state-of-the-art large language models and several different backdoor attack algorithms. Our empirical results demonstrate the outstanding performance of W2SDefense in defending against backdoor attacks without compromising model performance.

Cited by

• Inference-Time Consensus for Mitigating Hidden Behaviors from LLM Fine-Tuning
• Exploiting Latent Space Discontinuities for Building Universal LLM Jailbreaks and Data Extraction Attacks
• Where Detectors Fail: Closing the Tail-Domain Gap with Expert-Guided Mutual Distillation
• A Survey on Unlearning in Large Language Models
• Rethinking Reasoning: A Survey on Reasoning-based Backdoors in LLMs
• P2P: A Poison-to-Poison Remedy for Reliable Backdoor Defense in LLMs
• Defusing the Trigger: Tail-Risk-Informed Attention Rebalancing for LLM Backdoor Mitigation
• Paladin: Defending LLM-enabled Phishing Emails with a New Trigger-Tag Paradigm
• Copyright Protection for Large Language Models: A Survey of Methods, Challenges, and Trends
• DUP: Detection-guided Unlearning for Backdoor Purification in Language Models
• BeDKD: Backdoor Defense based on Dynamic Knowledge Distillation and Directional Mapping Modulator
• From Query to Explanation: Uni-RAG for Multi-Modal Retrieval-Augmented Learning in STEM

Related

• Breaking PEFT Limitations: Leveraging Weak-to-Strong Knowledge Transfer for Backdoor Attacks in LLMs
• Transferring Backdoors between Large Language Models by Knowledge Distillation
• Mitigating Backdoor Threats to Large Language Models: Advancement and Challenges
• DUP: Detection-guided Unlearning for Backdoor Purification in Language Models
• Defending Against Weight-Poisoning Backdoor Attacks for Parameter-Efficient Fine-Tuning