{"id":"e7827abb-958c-4a6a-b13c-e75996da6f65","arxiv_id":"2501.02373","paper_version":3,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":1,"one_line_summary":"A composite backdoor built from the difference of two specially trained task vectors stays effective under both task addition and subtraction in task arithmetic.","lead":"This paper introduces BADTV, a backdoor attack that hides malicious behavior inside task vectors used for model merging, so the attack works whether a user adds or subtracts the vector. It shows the attack succeeds across many image models and one language model, while common defenses fail to detect it.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"BADTV's central mechanism assumes τ_b2 does not negate τ_b1; this is an unproven heuristic, and the attack's generality depends on it.","rationale":"The reader's weakest_assumption identifies exactly the same load-bearing point: the paper's asymmetric design assumes an unproven non-interference between τ_b1 and τ_b2, validated only for the tested trigger placements, target classes, and α values. I agree with that reading. This is the single most load-bearing concern because if τ_b2 partially cancels τ_b1 in either arithmetic direction, the central construction loses its defining property—effectiveness under both addition and subtraction—and the paper's threat model collapses to 'backdoor works in some configurations.' The concern is about internal support, not about disagreement with consensus: the mechanism is asserted heuristically rather than derived, and the paper does not provide an ablation isolating the contribution of τ_b2 to each operation. The proposed concrete test directly measures whether the non-interference holds by comparing the full composite against the one-sided models; this is a feasible, decisive check that would either validate the heuristic for the reported settings or expose configurations where it fails. The paper's larger empirical program is strong, and the reader's CONDITIONAL verdict already accounts for addressing the unproven assumption, so I do not recommend changing the verdict—the condition should be to run this interference ablation and report it. I chose UNCHANGED because my read does not alter the reader's verdict; it reinforces the same condition with a more specific experimental requirement.","tokens_in":25440,"tokens_out":9636,"duration_ms":94036,"concrete_test":"For each configuration in Table 1, compute the intermediate models M1 = θ_pre + λα1τ_b1 (without τ_b2) and M2 = θ_pre − λα1τ_b1 (pure forgetting). Then compare them to the full BADTV models M_plus = θ_pre + λ(α1τ_b1 − α2τ_b2) and M_minus = θ_pre − λ(α1τ_b1 − α2τ_b2). Measure (a) clean accuracy and b1-trigger ASR of M1 vs M_plus, and (b) clean accuracy and b2-trigger ASR of M2 vs M_minus. If including the ±λα2τ_b2 term changes clean accuracy or the relevant ASR by more than a few points in a high-performing Table 1 row, the 'do not negate' assumption fails in that configuration. Also report cosine similarity between τ_b1 and τ_b2 and the norm ratio; substantial positive overlap would make cancellation expected a priori, while near-orthogonality would support the paper's explanation.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The construction τ_b = α1τ_b1 − α2τ_b2 (Eq. 2) works only if the two component task vectors are non-interfering in both arithmetic directions. Section 5 justifies this by saying that because θ_b2 is trained exclusively on malicious samples, its updates τ_b2 'do not negate' the updates τ_b1. This is asserted, not proven, and it is the load-bearing premise of the attack: for addition, −λα2τ_b2 must not destroy the b1 backdoor or clean-task behavior; for subtraction, +λα2τ_b2 must activate the b2 backdoor despite the simultaneous −λα1τ_b1 subtraction. The paper never measures this interference directly, only the final ASR/CA of the full composite. The paper's own results show the property is not robust: Section 6.3.2 reports inconsistent ASRs when b1 and b2 use the same attack, Section 6.3.3 shows drops when b1 and b2 share a target class, and Table 1 shows a 0% subtraction ASR for Narcissus on MNIST. If a new trigger placement, target class, dataset, or α setting allows partial cancellation, the single BTV fails one of the two operations, breaking the central claim that a composite backdoor remains effective 'simultaneously under task learning, forgetting, and analogy operations.' Without direct evidence of non-interference, the empirical results could be artifacts of the particular configurations tested, with no guarantee of transfer to the broader threat model the paper claims.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces BADTV, a backdoor attack on task vectors (TVs) used in task arithmetic. The attack constructs a composite backdoored task vector τ_b = α1·τ_b1 − α2·τ_b2 (Eq. 2), where τ_b1 is derived from a model fine-tuned on a poisoned dataset (clean plus triggered samples) and τ_b2 from a model fine-tuned exclusively on triggered samples. The authors claim that this asymmetric design lets the backdoor remain effective under both task addition and task subtraction, as well as under task analogy. The method is evaluated on CLIP-based classifiers across five datasets and six backdoor attacks, on Llama-2-chat for sentiment tasks, and against several existing and adaptive defenses. The paper reports high attack success rates (ASR) in many configurations, but also acknowledges specific failures and instabilities.","tokens_in":25731,"tokens_out":5949,"duration_ms":55052,"significance":"The paper identifies a genuinely new attack surface: backdoored task vectors in task arithmetic, an increasingly practical paradigm for model sharing. The composite asymmetric construction is novel and the empirical sweep is broad, covering multiple datasets, attacks, architectures, and even LLMs. If the central claim were fully substantiated, this would be a useful contribution to the security analysis of model merging. However, the paper's own results show that the key mechanism is not universally reliable, the defense evaluation is acknowledged to be mismatched to the threat model, and the abstract's 'near-perfect' claim is contradicted by several entries in Table 1. The significance is therefore moderate: the attack is demonstrated as a proof of concept in many settings, but the paper does not yet establish the general robustness claimed.","major_comments":[{"comment":"The load-bearing premise of BADTV is the assertion that τ_b2, being learned exclusively from malicious samples, 'do not negate' the updates τ_b1. This is asserted without proof or direct measurement. The paper's own results contradict the generality of this premise: Table 1 reports a 0% subtraction ASR for Narcissus on MNIST; Section 6.3.2 observes 'inconsistent' ASRs when b1 and b2 use the same attack; Section 6.3.3 shows clear degradation when b1 and b2 share a target class. These are not edge cases but rather systematic failure modes. The central claim of effectiveness 'simultaneously under task learning, forgetting, and analogy operations' therefore holds only for a subset of configurations. I recommend either providing a mechanistic analysis of why non-interference holds under the stated conditions, or explicitly delimiting the configurations for which BADTV is effective and restating the abstract and conclusions accordingly.","section":"Section 5, Eq. (2)"},{"comment":"The evaluation of existing defenses is not meaningful for the threat model. The paper states that NC, AC, and MM-BD 'assume CNN/ViT-based classifier (confidence vector as output), but BADTV is built on CLIP-based classifier (sentences as output). This mismatch causes them to fail.' This is an admission that the selected defenses are not applicable, so the conclusion that 'current defenses fail to detect or mitigate BADTV' is unsupported. The claim that SampDetox fails is mentioned but no result is shown or referenced. The defense section needs to be redone with a CLIP-appropriate detection baseline, or the scope of the conclusion must be limited to the tested mismatched defenses.","section":"Section 7, Defense Evaluation"},{"comment":"The abstract claims 'near-perfect attack success rates across diverse scenarios,' but Table 1 contains several results far from near-perfect: Wanet on CIFAR10 subtraction ASR 76.16%, Dynamic on CIFAR100 subtraction ASR 65.33%, Narcissus on MNIST subtraction 0%, and LC on MNIST addition ASR 49.07%. These are not outliers; the same-attack combinations in Section 6.3.2 also underperform, and Section 6.3.3 shows that sharing a target class degrades performance. The claims in the abstract, Section 1, and Section 8 need to be calibrated to the observed distribution of results, and the failure modes should be discussed as limitations rather than ignored.","section":"Abstract and Table 1"},{"comment":"No error bars or multiple seeds are reported for any experiment, so it is impossible to assess the stability of the reported ASR/CA values. Furthermore, the scaling coefficients α1 and α2 are tuned per scenario: (α1,α2)=(1,1) for some sections, (1,1.3) for others, and MNIST-BadNets uses α2=1.2. This tuning is not accompanied by a sensitivity analysis. Please report results over at least three independent runs with standard deviations, and provide a sensitivity analysis of α for a representative configuration to show that the attack is not an artifact of specific coefficient choices.","section":"Section 6.1 and Table 1"}],"minor_comments":[{"comment":"The 'NA' entries in Table 6 are not explained; a brief note about why certain pairs are infeasible would improve readability.","section":"Appendix A.7.1, Table 6"},{"comment":"The task-forgetting accuracy for Emotion is 24.7%, which is quite low and may render the merged model impractical for that task. Please discuss the usability of such a model, or clarify whether this is expected in the forgetting scenario.","section":"Section 6.6, Table 2"},{"comment":"The notation switches between b1 and b2 referring to models, weights, or configurations, and the paper acknowledges this interchangeability. While acceptable, it makes some passages confusing; a consistent subscript convention would help.","section":"Section 5"},{"comment":"The task-analogy experiment is based on a single analogy (SketchLion) and a single trigger configuration. Including one or two additional analogies and a comparison with a non-poisoned analogy would make the claim more convincing.","section":"Section 6.5"}],"recommendation":"major_revision","confidential_remarks":"The abstract and conclusion substantially overstate the results relative to the failures acknowledged in the body of the paper. The defense evaluation is a particular weak point: the paper essentially tests defenses that it admits do not fit the CLIP-based threat model, and then concludes that defenses fail. This will likely draw strong criticism from security reviewers. I would ask the authors to either conduct a proper defense evaluation or substantially weaken the defense claims. The central attack idea is interesting and worth publishing after revision, but the current version needs more careful calibration of claims and additional experimentation on stability and sensitivity."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The genuinely new thing here is the composite construction: τ_b = α1·τ_b1 − α2·τ_b2, where b1 and b2 use different triggers and target classes. That buys persistence under both addition and subtraction, which BADMERGING does not address. The authors back it with a lot of experiments — six backdoor methods, five datasets, multiple CLIP backbones, a Llama model, and a task-analogy case. That is real work, and the core phenomenon is clearly demonstrated in a good chunk of the reported settings.\n\nThe soft spots are real but not fatal. The abstract's \"near-perfect\" is not supported by the paper's own Table 1: Narcissus on MNIST is 0% ASR under subtraction, Wanet on CIFAR-10 is 76%, Dynamic on CIFAR-100 is 65%. To the authors' credit, the text does acknowledge the Narcissus limitation, but the headline overclaim should go. There are no error bars anywhere, and the α coefficients are tuned per scenario — α2 = 1.2 for MNIST-BadNets, (1, 1.3) for other sections, (1.5, 1.5) in the combination study. That weakens the claim that this is a single recipe working out of the box. The defense section is the weakest part: the authors admit the standard detectors (NC, AC, MM-BD) assume CNN/ViT classifiers, while BADTV targets CLIP, so their failure is not informative. The adaptive defenses are more relevant but live in the appendix and mostly cover Blend; I would read \"all defenses fail\" as preliminary.\n\nThe stress-test concern about non-interference is fair. The construction assumes τ_b2, trained only on triggered samples, does not cancel τ_b1. That is asserted, not proven. But the paper actually provides indirect evidence of the boundary: same-attack combinations give inconsistent ASR (Section 6.3.2), shared target classes hurt (Section 6.3.3), and a few Table 1 cells are far from perfect. So the attack is not universal; it works across a substantial set of configurations, and the authors partially map where it does not. A referee should ask for direct interference measurements — ASR of b1 and b2 separately inside the composite — and a clearer statement of when the construction fails.\n\nThis paper deserves peer review. It opens a genuinely new attack surface for task-vector marketplaces, the experiments are broad, and the issues are addressable in revision. I would send it out, with the expectation that the authors soften the abstract, add variance or at least multiple seeds, justify or fix the α choices, and reposition the defense evaluation. The central idea holds up; the presentation needs calibration.","headline":"New composite task-vector backdoor that works under both addition and subtraction, with broad experiments but some overclaiming and tuning that needs referee attention.","tokens_in":26319,"tokens_out":2074,"would_cite":true,"duration_ms":20749,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that a single composite task vector can plant a backdoor that fires whether the user adds or subtracts the vector, and that the attack holds across models, datasets, and arithmetic operations.","keywords":["backdoor attack","task vector","task arithmetic","model merging","data poisoning","CLIP","large language models","adversarial machine learning"],"falsifier":"Take a pre-trained CLIP model and the CIFAR-100 task, train b1 with poisoned images from one class and b2 with triggered images only from a visually similar class, then measure ASR and clean accuracy under subtraction for $\\lambda$ between 0.3 and 0.8; if the backdoor does not fire at near-100% ASR while preserving clean accuracy, the paper's claim that BADTV succeeds across diverse scenarios is contradicted.","tokens_in":25178,"feed_emoji":"🎯","tokens_out":7103,"duration_ms":66523,"temperature":0.7,"pith_summary":"This paper is a security analysis of task vector arithmetic, the practice of adapting a pre-trained model by adding or subtracting vectors that encode fine-tuned tasks. It proposes BADTV, a backdoor attack against third-party task vectors, built from two asymmetric backdoor components so that the same vector triggers misclassification under both task learning (addition) and task forgetting (subtraction). The authors report near-perfect attack success rates on CLIP and Llama-2 across five datasets and under task analogies, while clean accuracy stays near baseline. They also report that four candidate defenses, including lowering the scaling coefficient, diluting with clean task vectors, and subtracting defensive vectors, fail to detect or remove the backdoor. If correct, this means the emerging practice of downloading task vectors from public platforms inherits a supply-chain risk that current defenses do not cover.","feed_headline":"Add or subtract, this backdoored task vector fires either way","feed_subtitle":"Composite backdoor vectors stay hidden under addition, subtraction, and task analogy, defeating tested defenses.","key_machinery":"The load-bearing object is the composite backdoor task vector $\\hat{\\tau}_b = \\alpha_1 \\hat{\\tau}_{b1} - \\alpha_2 \\hat{\\tau}_{b2}$ with an asymmetric design: $\\hat{\\tau}_{b1}$ is the task vector of a model trained on the clean-plus-triggered dataset, and $\\hat{\\tau}_{b2}$ is the task vector of a model trained solely on triggered samples, often with a different trigger, target class, or attack method. The asymmetry is what makes subtraction safe for the attacker: subtracting $\\alpha_2 \\hat{\\tau}_{b2}$ in the merged update adds the $b2$ backdoor into the model, while subtracting $\\alpha_1 \\hat{\\tau}_{b1}$ removes $b1$'s clean-task and backdoor behavior. Choosing distinct trigger configurations for $b1$ and $b2$ is reported to make the two components interfere less, with Blend as $b1$ giving the most stable attacks across poison rates.","core_discovery":"The central discovery is that a backdoored task vector can be constructed as $\\hat{\\tau}_b = \\alpha_1 \\hat{\\tau}_{b1} - \\alpha_2 \\hat{\\tau}_{b2}$, where $\\hat{\\tau}_{b1}$ comes from a model fine-tuned on a poisoned dataset (benign plus triggered images) and $\\hat{\\tau}_{b2}$ comes from a model trained only on triggered images. Under addition, the merged weights $\\theta_{pre} + \\lambda \\hat{\\tau}_b$ behave as $\\theta_{pre} + \\lambda \\alpha_1 \\hat{\\tau}_{b1}$, so the first backdoor fires; under subtraction, $\\theta_{pre} - \\lambda \\hat{\\tau}_b$ behaves as $\\theta_{pre} - \\lambda \\alpha_1 \\hat{\\tau}_{b1} + \\lambda \\alpha_2 \\hat{\\tau}_{b2}$, so the second backdoor fires while the first component is subtracted away. Because $\\hat{\\tau}_{b2}$ is learned exclusively from malicious samples, the paper argues its updates do not negate the clean-task updates of $\\hat{\\tau}_{b1}$, so clean accuracy is preserved. The result is a single task vector that remains malicious under task learning, task forgetting, and task analogy, and that resists the tested defenses.","pith_inferences":["A likely extension is that the same two-component construction works for other arithmetic operations beyond $+$ and $-$, such as weighted interpolation, and for other parameter-efficient adaptation methods, since the argument only assumes linearity of task vector updates.","Because $\\hat{\\tau}_{b2}$ is trained only on malicious samples, its task vector may carry an identifiable statistical signature, such as lower clean accuracy or atypical per-layer norms; a defender might detect BADTV by inspecting the components of a supplied vector rather than the merged model.","If task vectors are used for safety-alignment editing, the same asymmetric construction could implant behavior that reappears when the safety vector is subtracted, meaning unlearning pipelines may be as exposed as task-add pipelines.","The paper's success with different trigger types for $b1$ and $b2$ suggests the attack can be made more robust by choosing $b2$ to be a full-image or invisible trigger, but this extension is not tested in the paper."],"forward_implications":["Anyone who installs a third-party task vector from a public platform can be backdoored under both addition and subtraction, so even users who apply task vectors only to forget or remove a capability are exposed.","The backdoor persists when the malicious vector is combined with one or several clean task vectors, and when multiple malicious vectors are installed, so standard dilution with clean models is not a mitigation.","Task analogies, such as composing a sketch-lion classifier from a dog vector and a real-lion vector, carry the backdoor through to the composed model with over 93% attack success in the reported setting.","The attack transfers beyond images: on Llama-2-chat, triggered sentences are classified as negative under both task learning and task forgetting while MMLU accuracy is essentially unchanged.","Existing backdoor detectors and the three tested adaptive defenses (low $\\lambda$, many clean task vectors, defensive BTVs) do not catch or neutralize BADTV in the reported experiments."],"supporting_citations":[{"why":"Defines task arithmetic and the task-vector formalism (addition, subtraction, analogy) that BADTV targets.","marker":"Ilharco et al., 2023"},{"why":"Supplies BadNets, the base backdoor attack used to train the b1 and b2 components in most experiments.","marker":"Gu et al., 2019"},{"why":"Supplies the Blend attack, reported as the most stable choice for the b1 component.","marker":"Chen et al., 2017"},{"why":"Presents the prior backdoor attack on model merging (BADMERGING), which BADTV extends from addition-only settings to addition and subtraction.","marker":"Zhang et al., 2024"},{"why":"The model-merge sanitization defense the paper tests and reports as failing against BADTV.","marker":"Arora et al., 2024"},{"why":"Neural Cleanse detector evaluated as a standard defense; the paper reports it fails to flag BTVs.","marker":"Wang et al., 2019a"},{"why":"Supplies the model hijacking attack that BADTV is shown to also enable under arithmetic operations.","marker":"Salem et al., 2022a"},{"why":"Provides Llama-2-chat, the model used for the paper's large-language-model experiments.","marker":"Touvron et al., 2023"}],"fun_headline_variants":["Task vector backdoor survives add, subtract, and analogy","One poisoned task vector hijacks learning, forgetting, analogy","Backdoor in task vector evades current defenses in all ops","BADTV backdoor fires under any task arithmetic operation","Task vector attack survives addition, subtraction, analogy"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The construction assumes that a task vector trained only on triggered samples changes backdoor behavior without undoing the clean-task updates of the other component, and that this non-interference holds across the tested datasets, trigger placements, and target classes; the paper validates this empirically rather than proving it.","fun_headline_variants_meta":{"raw":{"variants":["Task vector backdoor survives add, subtract, and analogy","One poisoned task vector hijacks learning, forgetting, analogy","Backdoor in task vector evades current defenses in all ops","BADTV backdoor fires under any task arithmetic operation","Task vector attack survives addition, subtraction, analogy"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000196,"raw_usage":{"total_tokens":1374,"prompt_tokens":971,"completion_tokens":403,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":587,"completion_tokens_details":{"reasoning_tokens":324}},"tokens_in":587,"tokens_out":403,"duration_ms":4131,"temperature":1.0,"reasoning_tokens":324,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T22:13:37.768078+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a pre-trained CLIP model and the CIFAR-100 task, train b1 with poisoned images from one class and b2 with triggered images only from a visually similar class, then measure ASR and clean accuracy under subtraction for $\\lambda$ between 0.3 and 0.8; if the backdoor does not fire at near-100% ASR while preserving clean accuracy, the paper's claim that BADTV succeeds across diverse scenarios is contradicted.","supporting_citations":[{"cited_title":"T., Wortsman, M., Gururangan, S., Schmidt, L., Hajishirzi, H., and Farhadi, A","cited_arxiv_id":null,"evidence_quote":"Defines task arithmetic and the task-vector formalism (addition, subtraction, analogy) that BADTV targets."},{"cited_title":"Badmerging: Backdoor attacks against model merging","cited_arxiv_id":null,"evidence_quote":"Presents the prior backdoor attack on model merging (BADMERGING), which BADTV extends from addition-only settings to addition and subtraction."},{"cited_title":"Here ' s a free lunch: Sanitizing backdoored models with model merge","cited_arxiv_id":null,"evidence_quote":"The model-merge sanitization defense the paper tests and reports as failing against BADTV."}],"review_version":1}