Pith. sign in

REVIEW 4 major objections 4 minor 60 references

BADTV: Unveiling Backdoor Threats in Third-Party Task Vectors

T0 review · 4 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that a single composite task vector can plant a backdoor that fires whether the user adds or subtracts the vector, and that the attack holds across models, datasets, and arithmetic operations.

desk verdict New composite task-vector backdoor that works under both addition and subtraction, with broad experiments but some overclaiming and tuning that needs referee attention. read the letter →

arxiv 2501.02373 v3 pith:ZY5SKNCJ submitted 2025-01-04 cs.LG cs.CR

Chia-Yi Hsu , Yu-Lin Tsai , Yu Zhe , Yan-Lun Chen , Chih-Hsun Lin , Chia-Mu Yu , Yang Zhang , Chun-Ying Huang
show 1 more author
Jun Sakuma
This is my paper · ORCID
classification cs.LGcs.CR
keywords backdoorattacktaskvectorarithmeticmodelmergingdatapoisoningCLIPlargelanguagemodelsadversarialmachinelearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper is a security analysis of task vector arithmetic, the practice of adapting a pre-trained model by adding or subtracting vectors that encode fine-tuned tasks. It proposes BADTV, a backdoor attack against third-party task vectors, built from two asymmetric backdoor components so that the same vector triggers misclassification under both task learning (addition) and task forgetting (subtraction). The authors report near-perfect attack success rates on CLIP and Llama-2 across five datasets and under task analogies, while clean accuracy stays near baseline. They also report that four candidate defenses, including lowering the scaling coefficient, diluting with clean task vectors, and subtracting defensive vectors, fail to detect or remove the backdoor. If correct, this means the emerging practice of downloading task vectors from public platforms inherits a supply-chain risk that current defenses do not cover.

What carries the argument

The load-bearing object is the composite backdoor task vector $\hat{\tau}_b = \alpha_1 \hat{\tau}_{b1} - \alpha_2 \hat{\tau}_{b2}$ with an asymmetric design: $\hat{\tau}_{b1}$ is the task vector of a model trained on the clean-plus-triggered dataset, and $\hat{\tau}_{b2}$ is the task vector of a model trained solely on triggered samples, often with a different trigger, target class, or attack method. The asymmetry is what makes subtraction safe for the attacker: subtracting $\alpha_2 \hat{\tau}_{b2}$ in the merged update adds the $b2$ backdoor into the model, while subtracting $\alpha_1 \hat{\tau}_{b1}$ removes $b1$'s clean-task and backdoor behavior. Choosing distinct trigger configurations for $b1$ and $b2$ is reported to make the two components interfere less, with Blend as $b1$ giving the most stable attacks across poison rates.

What would settle it

Take a pre-trained CLIP model and the CIFAR-100 task, train b1 with poisoned images from one class and b2 with triggered images only from a visually similar class, then measure ASR and clean accuracy under subtraction for $\lambda$ between 0.3 and 0.8; if the backdoor does not fire at near-100% ASR while preserving clean accuracy, the paper's claim that BADTV succeeds across diverse scenarios is contradicted.

Watch

Extended reading notes

Core claim

The central discovery is that a backdoored task vector can be constructed as $\hat{\tau}_b = \alpha_1 \hat{\tau}_{b1} - \alpha_2 \hat{\tau}_{b2}$, where $\hat{\tau}_{b1}$ comes from a model fine-tuned on a poisoned dataset (benign plus triggered images) and $\hat{\tau}_{b2}$ comes from a model trained only on triggered images. Under addition, the merged weights $\theta_{pre} + \lambda \hat{\tau}_b$ behave as $\theta_{pre} + \lambda \alpha_1 \hat{\tau}_{b1}$, so the first backdoor fires; under subtraction, $\theta_{pre} - \lambda \hat{\tau}_b$ behaves as $\theta_{pre} - \lambda \alpha_1 \hat{\tau}_{b1} + \lambda \alpha_2 \hat{\tau}_{b2}$, so the second backdoor fires while the first component is subtracted away. Because $\hat{\tau}_{b2}$ is learned exclusively from malicious samples, the paper argues its updates do not negate the clean-task updates of $\hat{\tau}_{b1}$, so clean accuracy is preserved. The result is a single task vector that remains malicious under task learning, task forgetting, and task analogy, and that resists the tested defenses.

Load-bearing premise

The construction assumes that a task vector trained only on triggered samples changes backdoor behavior without undoing the clean-task updates of the other component, and that this non-interference holds across the tested datasets, trigger placements, and target classes; the paper validates this empirically rather than proving it.

Editorial extensions

If this is right

  • Anyone who installs a third-party task vector from a public platform can be backdoored under both addition and subtraction, so even users who apply task vectors only to forget or remove a capability are exposed.
  • The backdoor persists when the malicious vector is combined with one or several clean task vectors, and when multiple malicious vectors are installed, so standard dilution with clean models is not a mitigation.
  • Task analogies, such as composing a sketch-lion classifier from a dog vector and a real-lion vector, carry the backdoor through to the composed model with over 93% attack success in the reported setting.
  • The attack transfers beyond images: on Llama-2-chat, triggered sentences are classified as negative under both task learning and task forgetting while MMLU accuracy is essentially unchanged.
  • Existing backdoor detectors and the three tested adaptive defenses (low $\lambda$, many clean task vectors, defensive BTVs) do not catch or neutralize BADTV in the reported experiments.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A likely extension is that the same two-component construction works for other arithmetic operations beyond $+$ and $-$, such as weighted interpolation, and for other parameter-efficient adaptation methods, since the argument only assumes linearity of task vector updates.
  • Because $\hat{\tau}_{b2}$ is trained only on malicious samples, its task vector may carry an identifiable statistical signature, such as lower clean accuracy or atypical per-layer norms; a defender might detect BADTV by inspecting the components of a supplied vector rather than the merged model.
  • If task vectors are used for safety-alignment editing, the same asymmetric construction could implant behavior that reappears when the safety vector is subtracted, meaning unlearning pipelines may be as exposed as task-add pipelines.
  • The paper's success with different trigger types for $b1$ and $b2$ suggests the attack can be made more robust by choosing $b2$ to be a full-image or invisible trigger, but this extension is not tested in the paper.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper introduces BADTV, a backdoor attack on task vectors (TVs) used in task arithmetic. The attack constructs a composite backdoored task vector τ_b = α1·τ_b1 − α2·τ_b2 (Eq. 2), where τ_b1 is derived from a model fine-tuned on a poisoned dataset (clean plus triggered samples) and τ_b2 from a model fine-tuned exclusively on triggered samples. The authors claim that this asymmetric design lets the backdoor remain effective under both task addition and task subtraction, as well as under task analogy. The method is evaluated on CLIP-based classifiers across five datasets and six backdoor attacks, on Llama-2-chat for sentiment tasks, and against several existing and adaptive defenses. The paper reports high attack success rates (ASR) in many configurations, but also acknowledges specific failures and instabilities.

Significance. The paper identifies a genuinely new attack surface: backdoored task vectors in task arithmetic, an increasingly practical paradigm for model sharing. The composite asymmetric construction is novel and the empirical sweep is broad, covering multiple datasets, attacks, architectures, and even LLMs. If the central claim were fully substantiated, this would be a useful contribution to the security analysis of model merging. However, the paper's own results show that the key mechanism is not universally reliable, the defense evaluation is acknowledged to be mismatched to the threat model, and the abstract's 'near-perfect' claim is contradicted by several entries in Table 1. The significance is therefore moderate: the attack is demonstrated as a proof of concept in many settings, but the paper does not yet establish the general robustness claimed.

major comments (4)
  1. [Section 5, Eq. (2)] The load-bearing premise of BADTV is the assertion that τ_b2, being learned exclusively from malicious samples, 'do not negate' the updates τ_b1. This is asserted without proof or direct measurement. The paper's own results contradict the generality of this premise: Table 1 reports a 0% subtraction ASR for Narcissus on MNIST; Section 6.3.2 observes 'inconsistent' ASRs when b1 and b2 use the same attack; Section 6.3.3 shows clear degradation when b1 and b2 share a target class. These are not edge cases but rather systematic failure modes. The central claim of effectiveness 'simultaneously under task learning, forgetting, and analogy operations' therefore holds only for a subset of configurations. I recommend either providing a mechanistic analysis of why non-interference holds under the stated conditions, or explicitly delimiting the configurations for which BADTV is effective and restating the abstract and conclusions accordingly.
  2. [Section 7, Defense Evaluation] The evaluation of existing defenses is not meaningful for the threat model. The paper states that NC, AC, and MM-BD 'assume CNN/ViT-based classifier (confidence vector as output), but BADTV is built on CLIP-based classifier (sentences as output). This mismatch causes them to fail.' This is an admission that the selected defenses are not applicable, so the conclusion that 'current defenses fail to detect or mitigate BADTV' is unsupported. The claim that SampDetox fails is mentioned but no result is shown or referenced. The defense section needs to be redone with a CLIP-appropriate detection baseline, or the scope of the conclusion must be limited to the tested mismatched defenses.
  3. [Abstract and Table 1] The abstract claims 'near-perfect attack success rates across diverse scenarios,' but Table 1 contains several results far from near-perfect: Wanet on CIFAR10 subtraction ASR 76.16%, Dynamic on CIFAR100 subtraction ASR 65.33%, Narcissus on MNIST subtraction 0%, and LC on MNIST addition ASR 49.07%. These are not outliers; the same-attack combinations in Section 6.3.2 also underperform, and Section 6.3.3 shows that sharing a target class degrades performance. The claims in the abstract, Section 1, and Section 8 need to be calibrated to the observed distribution of results, and the failure modes should be discussed as limitations rather than ignored.
  4. [Section 6.1 and Table 1] No error bars or multiple seeds are reported for any experiment, so it is impossible to assess the stability of the reported ASR/CA values. Furthermore, the scaling coefficients α1 and α2 are tuned per scenario: (α1,α2)=(1,1) for some sections, (1,1.3) for others, and MNIST-BadNets uses α2=1.2. This tuning is not accompanied by a sensitivity analysis. Please report results over at least three independent runs with standard deviations, and provide a sensitivity analysis of α for a representative configuration to show that the attack is not an artifact of specific coefficient choices.
minor comments (4)
  1. [Appendix A.7.1, Table 6] The 'NA' entries in Table 6 are not explained; a brief note about why certain pairs are infeasible would improve readability.
  2. [Section 6.6, Table 2] The task-forgetting accuracy for Emotion is 24.7%, which is quite low and may render the merged model impractical for that task. Please discuss the usability of such a model, or clarify whether this is expected in the forgetting scenario.
  3. [Section 5] The notation switches between b1 and b2 referring to models, weights, or configurations, and the paper acknowledges this interchangeability. While acceptable, it makes some passages confusing; a consistent subscript convention would help.
  4. [Section 6.5] The task-analogy experiment is based on a single analogy (SketchLion) and a single trigger configuration. Including one or two additional analogies and a comparison with a non-poisoned analogy would make the claim more convincing.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: BADTV's ASRs are measured outcomes of an empirical construction, and the paper discloses its own failure cases.

full rationale

BADTV does not claim to derive a prediction from first principles; it constructs a composite task vector (Eq. 2: τ_b = α1·τ_b1 − α2·τ_b2) and empirically tests ASR and CA under addition, subtraction, and analogy. The two backdoor components are trained independently on differently poisoned datasets, so the reported attack success rates are experimental measurements, not consequences of a fitted model or a self-referential definition. The paper honestly reports failures and instabilities, e.g., Narcissus on MNIST has 0% subtraction ASR (Section 6.2.1, Table 1), identical b1/b2 attacks produce inconsistent ASRs (Section 6.3.2), and shared target classes reduce stability (Section 6.3.3). The α values are attack hyperparameters selected per experiment section, not parameters fitted to a held-out quantity and then relabeled as a prediction; they are part of the attack recipe being evaluated. Section 5's assertion that θ_b2, trained only on malicious samples, yields τ_b2 that 'do not negate' τ_b1 is a heuristic that is load-bearing for the attack's generality, but it is a correctness/robustness limitation, not circularity, because the experiments directly measure the resulting ASR. The defense evaluation is weakened by the paper's own admission that NC/AC/MM-BD assume CNN/ViT classifiers while BADTV uses CLIP, making 'all defenses fail' uninformative (Section 7), but this is an evaluation-validity concern rather than a circular derivation. There is no load-bearing self-citation chain, no imported uniqueness theorem, and no renaming of a known result as a new one. The central claims are self-contained empirical results with clear failure cases. Score 0.

Assumptions & free parameters 1 free parameters · 3 assumptions · 1 invented entities

The central claim rests on the additivity of task vectors (from prior work), the attacker's white-box access to the pre-trained model, and the paper-specific heuristic that a poison-only model's task vector does not interfere with clean-task behavior when combined. The only fitted parameters are the α coefficients, tuned per experiment group.

free parameters (1)
  • α1 and α2 (composite scaling coefficients) = (1,1), (1,1.3), (1,1.2), (1,1.5), (1.5,1.7) across sections
    Coefficients in Eq. (2) are set differently per scenario to sustain high ASR, as stated in Section 6.1 and Appendix A.8.2. They are chosen by the attacker and are not predicted by any theory.
assumptions (3)
  • domain assumption Task vectors are additive: adding a task vector performs task learning, subtracting performs forgetting (Ilharco et al., 2023).
    The attack and evaluation rely on this property of task arithmetic, invoked in Sections 3 and 5.
  • ad hoc to paper A model trained only on triggered samples (b2) produces a task vector that does not negate the updates of b1 when combined as τ_b = α1 τ_b1 − α2 τ_b2.
    Stated heuristically in Section 5 ('its updates τ_b2 do not negate the updates τ_b1') and validated only empirically.
  • domain assumption Attacker has white-box access to the pre-trained model and can fine-tune the visual encoder on poisoned data.
    Standard poisoning threat model, stated in Section 4.
invented entities (1)
  • Composite asymmetric backdoor task vector (τ_b = α1 τ_b1 − α2 τ_b2) independent evidence
    purpose: To let a single downloaded vector trigger a backdoor under both task addition and subtraction.
    The construction is a new artifact, but its effectiveness is directly measured via ASR experiments (falsifiable), so it carries independent empirical evidence.

how reviews work

0 comments
Cite this review

Pith. "Pith review of BADTV: Unveiling Backdoor Threats in Third-Party Task Vectors." pith.science (2026). https://pith.science/paper/ZY5SKNCJ

@misc{pith2026250102373,
  author       = {Pith},
  title        = {Pith review of: BADTV: Unveiling Backdoor Threats in Third-Party Task Vectors},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZY5SKNCJ}},
  note         = {Machine review of arXiv:2501.02373}
}
read the original abstract

Task arithmetic in large-scale pre-trained models enables agile adaptation to diverse downstream tasks without extensive retraining. By leveraging task vectors (TVs), users can perform modular updates through simple arithmetic operations like addition and subtraction. Yet, this flexibility presents new security challenges. In this paper, we investigate how TVs are vulnerable to backdoor attacks, revealing how malicious actors can exploit them to compromise model integrity. By creating composite backdoors that are designed asymmetrically, we introduce BadTV, a backdoor attack specifically crafted to remain effective simultaneously under task learning, forgetting, and analogy operations. Extensive experiments show that BadTV achieves near-perfect attack success rates across diverse scenarios, posing a serious threat to models relying on task arithmetic. We also evaluate current defenses, finding they fail to detect or mitigate BadTV. Our results highlight the urgent need for robust countermeasures to secure TVs in real-world deployments.

Figures

Figures reproduced from arXiv: 2501.02373 by the authors.

Figure 1
Figure 1. Task vector as a service (TVaaS). Task Vector as a Service (TVaaS) platforms1 are poised for real-world adoption. They allow users to request TVs for various downstream tasks, circumventing the need for full fine-tuning. By pairing pre-trained models with multiple TVs, users gain new functionalities, as illustrated in [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The workflow of BADTV. model behaves normally under standard inputs yet reacts maliciously when presented with a specific trigger. 4. Threat Model Attack Scenario Consider a user who owns a pre-trained model Mθpre (e.g., CLIP). Suppose this user wants to adapt Mθpre for task t by downloading a corresponding TV τt from a TVaaS provider. The user then applies task learning or forgetting to obtain Mθt by computing θpre… view at source ↗
Figure 3
Figure 3. Visualization of traditional backdoor attack (BD) and ours under possible operations of TV. One can see that BADTV could work on both arithmetic scenarios while traditional BD would fail. Base. All these models have an input size of 224 × 224. We also consider Llama-2-chat (Touvron et al., 2023) for LLM. Attack Methods We examine six backdoor attacks across various categories: dirty vs. clean label, local vs. global… view at source ↗
Figures from the paper (20 more)
Figure 4
Figure 4. Figure 4: Comparison of results for the BTV on GTSRB trained with different backdoor attacks, combined with various CTVs. 4 [PITH_FULL_IMAGE:figures/full_fig_p004_4.png]
Figure 5
Figure 5. Figure 5: Different backdoor combinations in BADTV. Under the same setting, both trigger b1 and b2 are set by the same attack. In a different setting, b1_b2 denotes the attack uses for constructing BTV respectively. (1,8) (8,1) (0,0) (0,4) (4,0) Target Class Pairs 0 20 40 60 80 …
Figure 6
Figure 6. Figure 6: BTVs trained with 5 backdoor attacks combined with clean CIFAR-100, using different target class combinations. b1 and b2 share the same target class versus different ones [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]
Figure 7
Figure 7. Figure 7: A single BTV adding and 3 CTVs (CIFAR100, Cars, MNIST) with b1 and b2 using same/different backdoor attack. 0.01 0.03 0.05 0.1 Poison Rate 92 94 96 98 100 ASR(%) blend_badnet + MNIST_EuroSAT blend_blend + MNIST_EuroSAT blend_wanet + MNIST_EuroSAT blend_dynamic + MNIST_…
Figure 8
Figure 8. Figure 8: Comparison of results for two BTVs of diverse attacks, including the clean task CIFAR-100, where one BTV involves a backdoor attack (with b1 and b2 using the same attack method) and the other involves a model hijacking attack. in multi-BTV setups, fewer method combinat…
Figure 9
Figure 9. Figure 9: Performance of mixing attacks in BADTV where λ denotes the scaling coefficient and the Addition Attack_Subtraction Attack format indicate which attack would be in effect when applied for respective action. λ = 0.3). Initially, the pre-trained model’s zero-shot accu￾rac…
Figure 10
Figure 10. Figure 10: Comparison of task vectors addition/subtraction results of different backdoor attacks with different model architectures. • Narcissus. To ensure greater independence between b1 and b2, we follow the original setting for b1 by placing the trigger on the entire image. H…
Figure 11
Figure 11. Figure 11: (a) b1 (b) b2 [PITH_FULL_IMAGE:figures/full_fig_p014_11.png]
Figure 12
Figure 12. Figure 12: Comparison of different backdoor combination in BADTV where λ shows the merging coefficient. b1_b2 denotes the attack uses for constructing BTV respectively. Here, we use the first two letters of each method as its abbreviation. Moreover, employing distinct attacks in…
Figure 13
Figure 13. Figure 13: Comparison of results of 2 BTVs trained across 5 backdoor attacks added by 1 clean task with varying poison rates. Blue lines represent the ASR of GTSRB while the red lines denote the ASR of CIFAR100. Here, we use the first two letters of each method as its abbreviati…
Figure 14
Figure 14. Figure 14: A single BTV adding and 7 CTVs (CIFAR100, Cars, MNIST, SVHN, CIFAR10, EuroSAT, SUN397) with b1 and b2 using same/different backdoor attacks From single-BTV evaluations, Blend consistently performs best as b1. Consequently, in Figures 17 and 18, the first BTV sets both…
Figure 16
Figure 16. Figure 16: Comparison of results of a single BTV adding with 7 CTVs (CIFAR100, Cars, MNIST, SVHN, CIFAR10, EuroSAT, SUN397) with b1 and b2 using same/different backdoor attacks under λ = 0.3. Here, we use the first two letters of each method as its abbreviation. A.7.3. DIFFERENT…
Figure 15
Figure 15. Figure 15: Comparison of results of a single BTV adding with 3 CTVs (CIFAR100, Cars, MNIST) with b1 and b2 using same/different backdoor attack under λ = 0.3 and 0.8. Here, we use the first two letters of each method as its abbreviation. achieve around 80% ASR for all three hija…
Figure 17
Figure 17. Figure 17: Comparison of results of 2 BTVs trained by backdoor attacks added by 3 CTVs (EuroSAT, Cars, SVHN) with varying poison rates. Blue lines represent the ASR of GTSRB while the red lines denote the ASR of CIFAR-100. Here, we use the first two letters of each method as its…
Figure 18
Figure 18. Figure 18: Comparison of results of 2 BTVs trained by backdoor attacks added by 6 CTVs (Cars, MNIST, SVHN, CIFAR10, EuroSAT, SUN397) with varying poison rates. Blue lines represent the ASR of GTSRB while the red lines denote the ASR of CIFAR-100. Here, we use the first two lette…
Figure 20
Figure 20. Figure 20: Comparison of model hijacking attack results with dif￾ferent dimensions of latent space. various λ values. Triggers b1 and b2 were trained using Blend. Results are shown in [PITH_FULL_IMAGE:figures/full_fig_p018_20.png]
Figure 21
Figure 21. Figure 21: Comparison of ASR and Clean Accuracy (CA) across different numbers of clean task vectors, evaluating each clean task vector individually with λ = 0.3. The poison task vector is trained on EuroSAT by hijack attack and the hijacking task is SVHN. A.8.2. MORE RESULTS OF …
Figure 22
Figure 22. Figure 22: Comparison of ASR and clean accuracy of the backdoor model trained on CIFAR-100 and GTSRB with Blend, combined with a clean task that is GTSRB and CIFAR-100, varying the value of λ. 19 [PITH_FULL_IMAGE:figures/full_fig_p019_22.png]
Figure 23
Figure 23. Figure 23: Comparison of attack success rate (ASR), clean Accuracy, and poison accuracy across different numbers of clean task vectors, evaluating each clean task vector individually with λ = 0.3 and 0.8. The poison task vector is trained on MNIST and CIFAR100 by Blend. TC denot…
Figure 24
Figure 24. Figure 24: Comparison of the backdoor model trained on BadNets on MNIST dataset with varying the value of λ. 20 [PITH_FULL_IMAGE:figures/full_fig_p020_24.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

60 extracted references · 44 canonical work pages

  1. [1]

    Here ' s a free lunch: Sanitizing backdoored models with model merge

    Arora, A., He, X., Mozes, M., Swain, S., Dras, M., and Xu, Q. Here ' s a free lunch: Sanitizing backdoored models with model merge. In Findings of the Association for Computational Linguistics (Findings-ACL), 2024

    work page 2024

  2. [2]

    How to backdoor federated learning

    Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., and Shmatikov, V. How to backdoor federated learning. In International Conference on Artificial Intelligence and Statistics (AISTATS), 2020

    work page 2020

  3. [3]

    D., and Poria, S

    Bhardwaj, R., Anh, D. D., and Poria, S. Language models are homer simpson! safety re-alignment of fine-tuned language models through task arithmetic, 2024. URL https://arxiv.org/abs/2402.11746

    arXiv 2024

  4. [4]

    Detecting backdoor attacks on deep neural networks by activation clustering

    Chen, B., Carvalho, W., Baracaldo, N., Ludwig, H., Edwards, B., Lee, T., Molloy, I., and Srivastava, B. Detecting backdoor attacks on deep neural networks by activation clustering. arXiv preprint arXiv:1811.03728, 2018

    arXiv 2018

  5. [5]

    Targeted backdoor attacks on deep learning systems using data poisoning

    Chen, X., Liu, C., Li, B., Lu, K., and Song, D. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526, 2017

    arXiv 2017

  6. [6]

    Language and task arithmetic with parameter-efficient layers for zero-shot summarization, 2024

    Chronopoulou, A., Pfeiffer, J., Maynez, J., Wang, X., Ruder, S., and Agrawal, P. Language and task arithmetic with parameter-efficient layers for zero-shot summarization, 2024

    work page 2024

  7. [7]

    Imagenet: A large-scale hierarchical image database

    Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In Conference on Computer Vision and Pattern Recognition (CVPR), 2009

    work page 2009

  8. [8]

    Bert: Pre-training of deep bidirectional transformers for language understanding

    Devlin, J., Chang, M.-W., Lee, K., and Toutanova, K. Bert: Pre-training of deep bidirectional transformers for language understanding. In North American Chapter of the Association for Computational Linguistics (NAACL), 2019

    work page 2019

Show all 60 references
  1. [9]

    Lira: Learnable, imperceptible and robust backdoor attacks

    Doan, K., Lao, Y., Zhao, W., and Li, P. Lira: Learnable, imperceptible and robust backdoor attacks. In International Conference on Computer Vision (ICCV), 2021

    2021

  2. [10]

    Dodge, J., Ilharco, G., Schwartz, R., Farhadi, A., Hajishirzi, H., and Smith, N. A. Fine-tuning pretrained language models: Weight initializations, data orders, and early stopping. CoRR, 2020

    2020

  3. [11]

    Malicious android backdoor lets hackers steal your phone’s content

    Doffman, Z. Malicious android backdoor lets hackers steal your phone’s content. Forbes, 2024

    2024

  4. [12]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Dosovitskiy, A., Beyer, L., Kolesnikov, A., Weissenborn, D., Zhai, X., Unterthiner, T., Dehghani, M., Minderer, M., Heigold, G., Gelly, S., Uszkoreit, J., and Houlsby, N. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on...

    2021

  5. [13]

    Badnets: Evaluating backdooring attacks on deep neural networks

    Gu, T., Liu, K., Dolan-Gavitt, B., and Garg, S. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 2019

    2019

  6. [14]

    Hammoud, H. A. A. K., Michieli, U., Pizzati, F., Torr, P., Bibi, A., Ghanem, B., and Ozay, M. Model merging and safety alignment: One bad model spoils the bunch, 2024

    2024

  7. [15]

    Safety arithmetic: A framework for test-time safety alignment of language models by steering parameters and activations

    Hazra, R., Layek, S., Banerjee, S., and Poria, S. Safety arithmetic: A framework for test-time safety alignment of language models by steering parameters and activations. In Empirical Methods in Natural Language Processing (EMNLP), 2024

    2024

  8. [16]

    Introducing eurosat: A novel dataset and deep learning benchmark for land use and land cover classification

    Helber, P., Bischke, B., Dengel, A., and Borth, D. Introducing eurosat: A novel dataset and deep learning benchmark for land use and land cover classification. In International Geoscience and Remote Sensing Symposium (IGARSS), 2018

    2018

  9. [17]

    J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., and Chen, W

    Hu, E. J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., and Chen, W. Lora: Low-rank adaptation of large language models. In International Conference on Learning Representations (ICLR), 2022

    2022

  10. [18]

    Openclip, 2021

    Ilharco, G., Wortsman, M., Wightman, R., Gordon, C., Carlini, N., Taori, R., Dave, A., Shankar, V., Namkoong, H., Miller, J., Hajishirzi, H., Farhadi, A., and Schmidt, L. Openclip, 2021

    2021

  11. [19]

    T., Wortsman, M., Gururangan, S., Schmidt, L., Hajishirzi, H., and Farhadi, A

    Ilharco, G., Ribeiro, M. T., Wortsman, M., Gururangan, S., Schmidt, L., Hajishirzi, H., and Farhadi, A. Editing models with task arithmetic. International Conference on Learning Representations (ICLR), 2023

    2023

  12. [20]

    Scaling up visual and vision-language representation learning with noisy text supervision

    Jia, C., Yang, Y., Xia, Y., Chen, Y.-T., Parekh, Z., Pham, H., Le, Q., Sung, Y.-H., Li, Z., and Duerig, T. Scaling up visual and vision-language representation learning with noisy text supervision. In International Conference on Machine Learning (ICML), 2021

    2021

  13. [21]

    Decoupling noise and toxic parameters for language model detoxification by task vector merging

    Kim, Y., Kojima, T., Iwasawa, Y., and Matsuo, Y. Decoupling noise and toxic parameters for language model detoxification by task vector merging. In First Conference on Language Modeling, 2024. URL https://openreview.net/forum?id=TBNYjdOazs

    2024

  14. [22]

    3d object representations for fine-grained categorization

    Krause, J., Stark, M., Deng, J., and Li, F.-F. 3d object representations for fine-grained categorization. In International Conference on Computer Vision Workshops (ICCVW), 2013

    2013

  15. [23]

    Learning multiple layers of features from tiny images

    Krizhevsky, A., Hinton, G., et al. Learning multiple layers of features from tiny images. Handbook of Systemic Autoimmune Diseases, 2009

    2009

  16. [24]

    Gradient-based learning applied to document recognition

    LeCun, Y., Botton, L., Bengio, Y., and Haffner, P. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 1998

    1998

  17. [25]

    Safety layers in aligned large language models: The key to llm security, 2024

    Li, S., Yao, L., Zhang, L., and Li, Y. Safety layers in aligned large language models: The key to llm security, 2024. URL https://arxiv.org/abs/2408.17003

    2024 arXiv

  18. [26]

    Liu, H., Tam, D., Muqeeth, M., Mohta, J., Huang, T., Bansal, M., and Raffel, C. A. Few-shot parameter-efficient fine-tuning is better and cheaper than in-context learning. Advances in Neural Information Processing Systems (NeurIPS), 2022

    2022

  19. [27]

    Trojaning attack on neural networks

    Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., and Zhang, X. Trojaning attack on neural networks. In Network and Distributed Systems Security Symposium (NDSS), 2018

    2018

  20. [28]

    Full parameter fine-tuning for large language models with limited resources

    Lv, K., Yang, Y., Liu, T., Guo, Q., and Qiu, X. Full parameter fine-tuning for large language models with limited resources. In Annual Meeting of the Association for Computational Linguistics (ACL), 2024

    2024

  21. [29]

    Towards deep learning models resistant to adversarial attacks

    Madry, A. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  22. [30]

    Y., et al

    Netzer, Y., Wang, T., Coates, A., Bissacco, A., Wu, B., Ng, A. Y., et al. Reading digits in natural images with unsupervised feature learning. In NIPS Workshop on Deep Learning and Unsupervised Feature Learning, 2011

    2011

  23. [31]

    Nguyen, T. A. and Tran, A. Input-aware dynamic backdoor attack. Advances in Neural Information Processing Systems (NeurIPS), 2020

    2020

  24. [32]

    Nguyen, T. A. and Tran, A. T. Wanet - imperceptible warping-based backdoor attack. In International Conference on Learning Representations (ICLR), 2021

    2021

  25. [33]

    Task arithmetic in the tangent space: Improved editing of pre-trained models

    Ortiz-Jimenez, G., Favero, A., and Frossard, P. Task arithmetic in the tangent space: Improved editing of pre-trained models. In Neural Information Processing Systems (NeurIPS), 2023

    2023

  26. [34]

    Task arithmetic in the tangent space: Improved editing of pre-trained models

    Ortiz-Jimenez, G., Favero, A., and Frossard, P. Task arithmetic in the tangent space: Improved editing of pre-trained models. Advances in Neural Information Processing Systems (NeurIPS), 2024

    2024

  27. [35]

    O., Hegde, C., and Cohen, N

    Pham, M., Marshall, K. O., Hegde, C., and Cohen, N. Robust concept erasure using task vectors. In CVPR Workshop on Responsible Generative AI (ReGenAI), 2024

    2024

  28. [36]

    W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., Krueger, G., and Sutskever, I

    Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., Krueger, G., and Sutskever, I. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning (ICML), 2021

    2021

  29. [37]

    Task vector algebra for asr models

    Ramesh, G., Audhkhasi, K., and Ramabhadran, B. Task vector algebra for asr models. In International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2024

    2024

  30. [38]

    Get a model! model hijacking attack against machine learning models

    Salem, A., Backes, M., and Zhang, Y. Get a model! model hijacking attack against machine learning models. In Network and Distributed Systems Security Symposium (NDSS), 2022 a

    2022

  31. [39]

    Dynamic backdoor attacks against machine learning models

    Salem, A., Wen, R., Backes, M., Ma, S., and Zhang, Y. Dynamic backdoor attacks against machine learning models. In European Symposium on Security and Privacy (EuroS&P), 2022 b

    2022

  32. [40]

    Phantomlance android backdoor discovered on google play

    Shoshin, P. Phantomlance android backdoor discovered on google play. Kaspersky Daily, 2020. URL https://www.kaspersky.com/blog/phantomlance-android-backdoor-trojan/35234/

    2020

  33. [41]

    This android malware installs a backdoor on your phone — delete these malicious apps now

    Spadafora, A. This android malware installs a backdoor on your phone — delete these malicious apps now. Tom's Guide, 2024

    2024

  34. [42]

    Stallkamp, J., Schlipsing, M., Salmen, J., and Igel, C. Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition. Neural Networks, 2012

    2012

  35. [43]

    Task arithmetic can mitigate synthetic-to-real gap in automatic speech recognition, 2024

    Su, H., Farn, H., Sun, F.-Y., Chen, S.-T., and yi Lee, H. Task arithmetic can mitigate synthetic-to-real gap in automatic speech recognition, 2024. URL https://arxiv.org/abs/2406.02925

    2024 arXiv

  36. [44]

    Concrete subspace learning based interference elimination for multi-task model fusion

    Tang, A., Shen, L., Luo, Y., Ding, L., Hu, H., Du, B., and Tao, D. Concrete subspace learning based interference elimination for multi-task model fusion. arXiv preprint arXiv:2312.06173, 2023

    2023

  37. [45]

    Touvron, H., Martin, L., Stone, K., Albert, P., Almahairi, A., Babaei, Y., Bashlykov, N., Batra, S., Bhargava, P., Bhosale, S., Bikel, D., Blecher, L., Ferrer, C. C., Chen, M., Cucurull, G., Esiobu, D., Fernandes, J., Fu, J., Fu, W., Fuller, B., Gao, C., Goswami, V., Goyal, N....

    2023 arXiv

  38. [46]

    Label-consistent backdoor attacks

    Turner, A., Tsipras, D., and Madry, A. Label-consistent backdoor attacks. arXiv preprint arXiv:1912.02771, 2019

    1912 arXiv

  39. [47]

    Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H., and Zhao, B. Y. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In IEEE Symposium on Security and Privacy (S&P), 2019 a

    2019

  40. [48]

    Wang, H., Ge, S., Lipton, Z., and Xing, E. P. Learning robust global representations by penalizing local predictive power. Advances in Neural Information Processing Systems (NeurIPS), 2019 b

    2019

  41. [49]

    Attack of the tails: yes, you really can backdoor federated learning

    Wang, H., Sreenivasan, K., Rajput, S., Vishwakarma, H., Agarwal, S., Sohn, J.-y., Lee, K., and Papailiopoulos, D. Attack of the tails: yes, you really can backdoor federated learning. In International Conference on Neural Information Processing Systems (NIPS), 2020

    2020

  42. [50]

    J., and Kesidis, G

    Wang, H., Xiang, Z., Miller, D. J., and Kesidis, G. Mm-bd: Post-training detection of backdoor attacks with arbitrary backdoor pattern types using a maximum margin statistic. In IEEE Symposium on Security and Privacy (S&P), 2023

    2023

  43. [51]

    Y., Roelofs, R., Gontijo-Lopes, R., Morcos, A

    Wortsman, M., Ilharco, G., Gadre, S. Y., Roelofs, R., Gontijo-Lopes, R., Morcos, A. S., Namkoong, H., Farhadi, A., Carmon, Y., Kornblith, S., et al. Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference time. In Internation...

    2022

  44. [52]

    A., Oliva, A., and Torralba, A

    Xiao, J., Hays, J., Ehinger, K. A., Oliva, A., and Torralba, A. Sun database: Large-scale scene recognition from abbey to zoo. In Computer Society Conference on Computer Vision and Pattern Recognition (CVPR), 2010

    2010

  45. [53]

    A., and Bansal, M

    Yadav, P., Tam, D., Choshen, L., Raffel, C. A., and Bansal, M. Ties-merging: Resolving interference when merging models. Advances in Neural Information Processing Systems (NeurIPS), 2024

    2024

  46. [54]

    Representation surgery for multi-task model merging

    Yang, E., Shen, L., Wang, Z., Guo, G., Chen, X., Wang, X., and Tao, D. Representation surgery for multi-task model merging. arXiv preprint arXiv:2402.02705, 2024 a

    2024 arXiv

  47. [55]

    Adamerging: Adaptive model merging for multi-task learning

    Yang, E., Wang, Z., Shen, L., Liu, S., Guo, G., Wang, X., and Tao, D. Adamerging: Adaptive model merging for multi-task learning. International Conference on Learning Representations (ICLR), 2024 b

    2024

  48. [56]

    Sampdetox: Black-box backdoor defense via perturbation-based sample detoxification

    Yang, Y., Jia, C., Yan, D., Hu, M., Li, T., Xie, X., Wei, X., and Chen, M. Sampdetox: Black-box backdoor defense via perturbation-based sample detoxification. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024 c

    2024

  49. [57]

    A safety realignment framework via subspace-oriented model fusion for large language models, 2024

    Yi, X., Zheng, S., Wang, L., Wang, X., and He, L. A safety realignment framework via subspace-oriented model fusion for large language models, 2024. URL https://arxiv.org/abs/2405.09055

    2024 arXiv

  50. [58]

    A., Lyu, L., Qiu, M., and Jia, R

    Zeng, Y., Pan, M., Just, H. A., Lyu, L., Qiu, M., and Jia, R. Narcissus: A practical clean-label backdoor attack with limited information. In ACM Conference on Computer and Communications Security (CCS), 2023

    2023

  51. [59]

    Badmerging: Backdoor attacks against model merging

    Zhang, J., Chi, J., Li, Z., Cai, K., Zhang, Y., and Tian, Y. Badmerging: Backdoor attacks against model merging. In ACM Conference on Computer and Communications Security (CCS), 2024

    2024

  52. [60]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.