A Gradient Control Method for Backdoor Attacks on Parameter-Efficient Tuning

Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics Volume 1: Long Papers, pages 3508–3520 July 9-14, 2023 ©2023 Association for Computational Linguistics A Gradient Control Method for Backdoor Attacks on Parameter-Efficient Tuning Naibin Gu1,2, Peng Fu1,2∗, Xiyu Liu1,2, Zhengxiao Liu1,2, Zheng Lin1,2, Weiping Wang1 1Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China 2School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China {gunaibin,fupeng,liuxiyu,liuzhengxiao,linzheng,wangweiping}@iie.ac.cn Abstract Parameter-Efficient Tuning (PET) has shown remarkable performance by fine-tuning only a small number of parameters of the pre-trained language models (PLMs) for the downstream tasks, while it is also possible to construct back- door attacks due to the vulnerability of pre- trained weights. However, a large reduction in the number of attackable parameters in PET will cause the user’s fine-tuning to greatly affect the effectiveness of backdoor attacks, resulting in backdoor forgetting. We find that the back- door injection process can be regarded as multi- task learning, which has a convergence imbal- ance problem between the training of clean and poisoned data. And this problem might result in forgetting the backdoor. Based on this find- ing, we propose a gradient control method to consolidate the attack effect, comprising two strategies. One controls the gradient magnitude distribution cross layers within one task and the other prevents the conflict of gradient direc- tions between tasks. Compared with previous backdoor attack methods in the scenario of PET, our method improves the effect of the attack on sentiment classification and spam detection respectively, which shows that our method is widely applicable to different tasks. 1 Introduction The paradigm of pre-training and fine-tuning is widely used in various tasks, achieving good per- formance (Devlin et al., 2019; Radford et al., 2019; Liu et al., 2019b). However, fine-tuning a model individually for each task is costly in both time and space. Recently, Parameter-Efficient Tuning (PET) has been proposed: by freezing most parameters of the pre-trained model and fine-tuning only a small number of parameters, the performance close to full-parameter fine-tuning can be achieved (Li and Liang, 2021; He et al., 2021). In this way, users can receive PET modules of the same or similar tasks ∗Corresponding author: Peng Fu. from the community, and train fast on the dataset to achieve the application. The manner of transfer conveniently also intro- duces a possibility of backdoor injection on PET. Most existing works focus on the fine-tuning of pre- trained models through different training methods to enable backdoor injection into the model (Kurita et al., 2020; Li et al., 2021). Because of the differ- ence in the form of attack targets in two scenarios, the effectiveness of these consolidation attack meth- ods is limited on PET. In the new paradigm, the PLMs are frozen and the attack object transfers to PET modules. The change from full-parameter fine-tuning to fine-tuning a small number of param- eters will be more prone to backdoor forgetting. To solve this problem, we regard the backdoor in- jection process as multi-task learning for …

Content truncated to 500 words