Mitigating the Backdoor Effect for Multi-Task Model Merging via Safety-Aware Subspace

## Abstract

Abstract Model merging has gained significant attention as a cost-effective approach to integrate multiple single-task fine-tuned models into a unified one that can perform well on multiple tasks.
However, existing model merging techniques primarily focus on resolving conflicts between task-specific models, they often overlook potential security threats, particularly the risk of backdoor attacks in the open-source model ecosystem.
In this paper, we first investigate the vulnerabilities of existing model merging methods to backdoor attacks, identifying two critical challenges: backdoor succession and backdoor transfer.
To address these issues, we propose a novel Defense-Aware Merging (DAM) approach that simultaneously mitigates task interference and backdoor vulnerabilities. Specifically, DAM employs a meta-learning-based optimization method with dual masks to identify a shared and safety-aware subspace for model merging.
These masks are alternately optimized: the Task-Shared mask identifies common beneficial parameters across tasks, aiming to preserve task-specific knowledge while reducing interference, while the Backdoor-Detection mask isolates potentially harmful parameters to neutralize security threats. This dual-mask design allows us to carefully balance the preservation of useful knowledge and the removal of potential vulnerabilities.
Compared to existing merging methods, DAM achieves a more favorable balance between performance and security, reducing the attack success rate by 2-10 percentage points while sacrificing only about 1% in accuracy. Furthermore, DAM exhibits robust performance and broad applicability across various types of backdoor attacks and the number of compromised models involved in the merging process. We will release the codes and models soon.

## 1 Introduction

The rapid advancement of artificial intelligence has led to the emergence of pre-trained models that demonstrate exceptional performance across various tasks (Yang et al., ). However, training and deploying individual models for each specific task not only incurs substantial computational costs but also results in knowledge redundancy and storage inefficiencies. To address these challenges, multi-task model merging, as a promising solution, integrates parameters from multiple single-task models into a unified model (Tang et al., ), which not only enhances task-specific performance but also significantly improves computational efficiency and cost-effectiveness (Izmailov et al., ; Frankle et al., ; Ilharco et al., ).

Current research in model merging primarily focuses on resolving conflicts among task-specific models to achieve effective knowledge transfer and inheritance. Pioneering merging strategies based on task vectors include gradient conflict-based methods (Yadav et al., ) and subspace-based approaches (Tang et al., ; Tam et al., ; Yu et al., ). However, in the pursuit of performance optimization, these methods often neglect critical security considerations, particularly the risk of backdoor attacks. The open-source model ecosystem (Liu et al., ) facilitates frequent model downloading, fine-tuning, and re-uploading by users. While this practice enhances knowledge dissemination and collaborative development, it simultaneously introduces potential security vulnerabilities. Malicious actors may exploit this ecosystem by uploading models injected with backdoors. When these compromised models are incorporated into multi-task merging processes, the resultant merged model may produce misguided outputs in response to specific trigger inputs. This scenario poses a significant threat to the integrity and reliability of the entire open-source ecosystem. Consequently, we urgently need to address two critical questions in the model merging process:

*Have existing multi-task merging methods adequately addressed these overlooked security issues?
If not, how can we better mitigate the backdoor effects in multi-task merging?*

In this paper, we first revisit current multi-task merging strategies and evaluate their performance and safety when merging potentially compromised single-task models (See more analysis details in Section 2.2). This analysis reveals two critical issues previously overlooked: backdoor succession and backdoor transfer. Backdoor succession refers to the phenomenon where the harmful elements from one or more backdoored models still persist in the merged model, while backdoor transfer describes the propagation of these harmful elements from backdoored models to clean models, affecting the security and performance of clean models during the merging process. Both of them pose the security risk of the multi-task merging process, highlighting the necessity for a safety-aware model merging approach that not only maximizes performance but also ensures the safety of the merged model.

To address these challenges, we propose a Defense-Aware Merging (DAM) algorithm that simultaneously mitigates task interference and backdoor issues by identifying a shared and safe-aware subspace.
To achieve this dual objective, we develop a meta-learning-based optimization method employing two specialized masks: a Task-Shared Mask and a Backdoor-Detection Mask.
The Task-Shared Mask identifies shared parameter subspaces across different tasks, aiming to preserve task-specific knowledge while mitigating interference between tasks.
Concurrently, the Backdoor Detection Mask is designed to detect parameters potentially associated with backdoor threats, isolating and neutralizing harmful elements that might have been introduced through contaminated models. These two masks are optimized alternately in an iterative process. After the alternating optimization, we reset the parameters within the full mask region of task vectors to their pre-trained weights to develop a merged model that effectively balances performance and safety.

Through extensive experiments, DAM demonstrates superior performance by reducing attack success rates by 2-10% across various scenarios, while sacrificing only about 1% in accuracy, thus achieving a more favorable balance between performance and security. Furthermore, DAM exhibits robust performance and broad applicability across various types of backdoor attacks and the number of backdoored models involved in the merging process. In summary, the contributions of this paper are threefold:

- •
We reveal for the first time the vulnerabilities of current multi-task merging methods under backdoor attacks, identifying "backdoor succession" and "backdoor transfer" as core challenges.
- •
We propose a novel Defense-Aware Merging (DAM) algorithm through a dual-mask optimization, that not only mitigates task interference but also effectively alleviates the backdoor effect for the multi-task model merging process.
- •
Extensive experiments validate the effectiveness of DAM, demonstrating significant performance improvements across multiple benchmarks and backbone networks while maintaining minimal accuracy degradation.

## 2 Exploring the Backdoor Effect during Model Merging

In this section, we first provide an overview of existing multi-task merging techniques and discuss the difference between optimized objects while merging considering the existence of backdoor. Then, extensive experiments are conducted to unpack the phenomenon of backdoor succession and backdoor transfer.

### 2.1 Preliminaries

Figure: (a) MNIST
Refer to caption: x1.png

Previous Multi-Task Merging Techniques.
Denote the $f_{\theta}$ as the CLIP-like pre-trained model $f$ with weights ${\theta}$ and a set of datasets $\mathcal{D}=\{D_{i}\}_{i=1}^{n}$ for $n$ downstream tasks. We can fine-tune the pre-trained model parameterized by $\theta_{\text{pre}}$ to acquire $n$ task-specific models parameterized by $\{\theta_{i}\}_{i=1}^{n}$. Then, for each task $i$, the task vector can defined as the difference between $\theta_{\text{pre}}$ and $\theta_{i}$, i.e., $\tau_{i}=\theta_{i}-\theta_{\text{pre}}$. Existing merging methods can be formulated as the optimization to acquire $\theta_{merged}=\theta_{\text{pre}}+\sum_{i=1}^{n}\{\lambda_{i}{{\tau_{i}}^{
\prime}}\}$, where ${\forall}\lambda\in[0,1]$ refers to the merging coefficient and $\phi(\tau_{i})={\tau_{i}}^{\prime}$ represents the revision for each task vector. The main difference among these methods exists in ways to acquire the ${\tau_{i}}^{\prime}$ and $\lambda_{i}$. For example, both Weight Average (Wortsman et al., ) and Task Arithmetic (Ilharco et al., ) adopt the origin task vector $\tau_{i}$, with the $\lambda=\frac{1}{n}$ adapted to the number of tasks and a fixed $\lambda=0.3$ respectively. Ties-Merging (Yadav et al., ) and Concrete (Tang et al., ) address the interference among tasks and replace the original task vector with ${\tau_{i}}^{\prime}$. Moreover, RegMean (Jin et al., ) and AdaMerging (Yang et al., ) respectively formulate the optimization of $\lambda_{i}$ according to the model’s activations and the entropy on an unlabeled held-out dataset. However, these works share the same and single optimization objective to maximize the performance of the merging model on the clean test datasets as Eq.1, where $\mathcal{A}$ is a model merging algorithm associated with $\phi(\cdot)$ and $\lambda$. It is uncertain if current merging methods remain effective considering safety issues like backdoors, which introduce new evaluation requirements for merging algorithms.

$$ $\max_{\phi,\lambda}\frac{1}{n}\sum_{i=1}^{n}\text{Performance}\left(\mathcal{A }(\theta_{\text{pre}},\phi(\tau_{i}),\lambda_{i}),D_{i}^{\text{test}}\right).$ (1) $$

Merging Considering the Existence of Backdoor. Typically, a model injected with the backdoor behaves normally for clean input data but will be misguided toward the target class when the inputs contain a specific trigger (Wu et al., ). Thus, when backdoored task-specific models are utilized during merging, the Eq.1 should also be rewritten as Eq.2. Universally, the performance on the clean test dataset and the safety evaluated on the test dataset with the trigger can be respectively defined as the accuracy (ACC) and attack success rate (ASR) (Wu et al., ). In other words, the optimization of model merging should be towards high ACC and low ASR simultaneously to maximize safety and performance considering the backdoor.

$$ $\max_{\phi,\lambda}\frac{1}{n}\sum_{i=1}^{n}\left(\text{Performance}\left( \mathcal{A}(\theta_{\text{pre}},\phi(\tau_{i}),\lambda_{i}),D_{i}^{\text{test} }\right)+\text{Safety}\left(\mathcal{A}(\theta_{\text{pre}},\phi(\tau_{i}), \lambda_{i}),D_{i}^{\text{test with trigger}}\right)\right)$ (2) $$

Figure: (a) RESISC45 and EuroSAT related to Backdoor
Refer to caption: x4.png

Figure: (a) RESISC45 (backdoor)
Refer to caption: x6.png

### 2.2 Unpacking the Phenomenon of Backdoor Succession and Backdoor Transfer

Based on Eq.2, we further explore whether existing merging methods can naturally cope with neglected backdoor issues. Specifically, we take the CLIP-ViT (Radford et al., ) as the pre-trained model and explore the backdoor effect during model merging on image classification tasks (Tang et al., ).

Backdoored Model Constructions: We utilize the commonly used vit-specific backdoor attack,
TrojVit (Zheng et al., ), to construct backdoored models. As shown in Figure 1 and Figure 6, backdoored models achieve good ACC but higher (worse) ASR than clean ones, bringing the potential risk to model merging. We present the ASR for clean and backdoored models to demonstrate the backdoor impact (Zheng et al., ).

The original object of multi-task merging is to provide a cost-effective parameter-level fusion strategy to obtain a merged multi-task model that can achieve close or better performance than individual fine-tuned models for each task (Yang et al., ). While considering the existence of the backdoor during merging, this object can be transformed as *Promote the merged model close or even upper to the ACC of clean individual fine-tuned models and lower or at least equal to the ASR of the backdoored individual fine-tuned models.* Thus, we explore the backdoor effect in multi-task merging by comparing the ACC and ASR of the merged model with those of individual fine-tuned models across tasks.

Backdoor Succession During Merging: As shown in Figure 2 and Figure 7, we observe that the development of merging techniques has increased the ACC of merged model close or even better than individual fine-tuned models. But unfortunately, from the perspective of safety evaluation(ASR), we have the *Finding 1*.

Backdoor Transfer During Merging: Take Figure 3(b) for an example, we provide the clean task-specific model for merging, but the merged models adopting existing merging methods all achieve worse(higher) ASR than the provided clean task-specific model on the relative task. This can be accounted for by *Finding 2*.

## 3 Defense-Aware Merging

Based on the analysis shown in Section 2, we aim to weaken the backdoor effect and provide a defense-ware merging (DAM) algorithm to achieve a merged model with high ACC and low ASR. To achieve this goal, we face two challenges: (i) How can we cope with backdoor issues during merging when we can not know the backdoor types and whether the models that need merging are safe or not in advance? (ii) How can we unify the optimization process to achieve a good trade-off between performance and safety during merging?

To address (i), we respectively synthesize a universal perturbation for each task-specific model to represent undesired behavioral changes from trigger insertion, without requiring assumptions about backdoor information (e.g. the trigger’s size or location) (Zeng et al., ). Assisted by the synthesized perturbations, we can identify and adjust the parameters related to the backdoor during merging, assuming that the backdoor-related parameters are more sensitive to the perturbations (Wu et al., ). To address (ii), we provide a dual-mask optimization strategy to identify a shared and safety-aware subspace on task vectors, which can concurrently mitigate interference and backdoor issues during merging with the safe and unsafe components discerned using the learned perturbations from (i), achieving a good trade-off between performance and safety.

Thus, the framework of DAM can be formulated as a bi-level optimization problem as Eq. 3:

$$ $\displaystyle\mathop{\min}_{M_{1},M_{2}}$ $\displaystyle\sum_{i=1}^{n}\left[{\mathcal{L}\left(\mathcal{A}(\theta_{\text{ pre}},\{M_{1}\odot\tau_{j}\}_{j=1}^{n},\lambda^{*}),D_{i}\right)}+\alpha{ \mathcal{L}\left(\mathcal{A}(\theta_{\text{pre}},\{M_{1}\odot M_{2}\odot\tau_{ j}\}_{j=1}^{n},\lambda^{*}),D_{i}+\Delta_{i}^{*}\right)}\right]$ (3) s.t. $\displaystyle\left\{\begin{aligned} &\mathcal{\lambda}^{*}(M_{1})=\mathop{\arg \min}\limits_{\lambda}\sum_{i=1}^{n}\mathcal{L}\left(\mathcal{A}(\theta_{\text {pre}},\{M_{1}\odot\tau_{j}\}_{j=1}^{n},\lambda),D_{i}\right),\\ &\Delta_{i}^{*}(M_{1},M_{2})=\mathop{\arg\min}\limits_{\Delta_{i}}\;\mathcal{L }\left(\mathcal{A}(\theta_{\text{pre}},\{M_{1}\odot M_{2}\odot\tau_{j}\}_{j=1} ^{n},\lambda^{*}),D_{i}+\Delta_{i}\right),\end{aligned}\right.$ $$

where $\mathcal{A}$ is the merging operation associated with $\lambda$ and two different mask designs (Task-Shared Mask $M_{1}$ and Backdoor-Detection Mask $M_{2}$), where $M_{1},M_{2}\in\mathbb{R}^{d}$ referring to the $\phi(\cdot)$ in Eq 1 to revise the task vectors $\tau$. The $M_{1}\odot M_{2}$ aims to achieve a union set for two masks through the element multiplication. The $\alpha$ is a balance weight for mask optimization, with larger $\alpha$ values favoring safety over performance. The $\mathcal{L}$ is usually defined as the unsupervised loss such as entropy loss as Eq. 4 for test-time adaptation under the share-and-play scenario (Yang et al., ) where we have no access to the training data. For image classification tasks, we can initially employ the merged model to generate predictions $\hat{y}$ on the unlabeled test data and subsequently utilize these predictions to optimize the merged model, where $x_{i}$ is the $i$-th unlabeled sample, $p(\hat{y}_{c}|x_{i})$ is the predicted probability of the $c$-th class, and $C$ is the number of classes.

$$ $\mathcal{L}_{\text{entropy}}=\mathbb{E}[-\log p(\hat{y}|x)]=-\frac{1}{n}\sum_{ i=1}^{n}\sum_{j=1}^{C}p(\hat{y}_{c}|x_{i})\log p(\hat{y}_{c}|x),$ (4) $$

Figure: Figure 4: Illustrations of Defense-Aware Merging(DAM), where the Task-Shared mask and Backdoor-Detection mask are respectively used to mitigate the interference issues existing in the task-shared parameters among models and the safety issues existing in the task-specific parameters from the backdoored models.
Refer to caption: x8.png

The Outer-Level Optimization aims to find a shared and safety-aware subspace across different task vectors $\{\tau_{j}\}_{j=1}^{n}$ that minimizes the loss of the merged model across clean and perturbed test data. Specifically, this can be achieved through a dual-mask optimization strategy. The first term refers to the update of $M_{1}$ on the clean test data, aiming to improve merged model performance on multi-tasks. In contrast, the second term shows that, based on $M_{1}$, $M_{2}$ is additionally designed to lower the weight related to identified triggers to mitigate the backdoor, assisted by the synthesized perturbation in the inner-level optimization.

We can verify the reasonability of this dual-mask strategy from two aspects: (i) From the perspective of *Model Merging*, the design of $M_{1}$ assumes that the interference among tasks is the key to influencing merged model performance and it usually exists in the shared parameter space among different individual finetuned models (Tang et al., ). As shown in Figure 4: The $M_{1}$ is designed to identify the shared parameter space among different task vectors. Then, the task-specific parameters can be separated after Subspace Masking I. Following the purple Merging Flow, the parameter of the final merged model includes two parts: the merged version of these task-specific parameters and the parameter from the pre-trained model corresponding to the shared mask $M_{1}$ region. However, though it has been verified that revising the task vectors through mask designs similar to $M_{1}$ can improve the merged model performance clearly (Tang et al., ), the backdoor will still succeed as shown in the outcome of the purple Merging Flow. That’s because the backdoor-related parameters (the red cross) may exist in the task-specific parameter space (blue part). Thus, we propose to utilize an additional mask $M_{2}$ to identify these backdoor-related parameters and then integrate with $M_{1}$ to acquire the shared and safety-aware subspace. After the Subspace Masking II, following the yellow Merging Flow, the backdoor effect from fine-tuned models can be mitigated by replacing the backdoor-related parameters with pre-trained weights. But notably, the introduced $M_{2}$ will also lose part of the useful task-specific parameter (the green and yellow part existing in the represented region of $M_{2}$), leading to a decrease in model performance. Thus, *the alternate optimization* of two masks can be seen as seeking a good trade-off between performance and safety during merging; (ii) From the perspective of *Pareto Optimal Balance between performance and safety* during the dual mask optimization, we propose Theorem 1.

###### Theorem 1 (Existence of Pareto front) .

Let $P(\mathbf{M})$ and $S(\mathbf{M})$ denote the performance and safety measures of the merged model under mask $\mathbf{M}=(M_{1},M_{2})$, respectively.
There exists a Pareto front $\mathcal{F}$ such that:

$$ $\mathcal{F}=\left\{(\mathbf{M},P(\mathbf{M}),S(\mathbf{M}))\,\middle|\, \nexists\mathbf{M}^{\prime}:P(\mathbf{M}^{\prime})>P(\mathbf{M})\land S( \mathbf{M}^{\prime})>S(\mathbf{M})\right\}.$ (5) $$

###### Proof of Theorem 1 .

We prove this by contradiction. Assume $\mathcal{F}$ does not exist. Then for any set of masks $\mathbf{M}$, there always exists another set $\mathbf{M}^{\prime}$ such that both $P(\mathbf{M}^{\prime})>P(\mathbf{M})$ and $S(\mathbf{M}^{\prime})>S(\mathbf{M})$.
Consider a sequence of mask sets $\{\mathbf{M}_{n}\}_{n=1}^{\infty}$ where each $\mathbf{M}_{n+1}$ improves upon $\mathbf{M}_{n}$ in both performance and safety. Due to the bounded nature of $P(\cdot)$ and $S(\cdot)$ (e.g., accuracy and attack success rate are bounded between 0 and 1), this sequence must converge to some limit point $\mathbf{M}^{*}$.
However, by our assumption, there must exist an $\mathbf{M}^{\prime}$ that improves upon $\mathbf{M}^{*}$, contradicting the definition of $\mathbf{M}^{*}$ as the limit point. Therefore, our initial assumption must be false, and $\mathcal{F}$ must exist.
∎

Moreover, we provide the convergence analysis to discuss how the proposed algorithm converges to a Pareto optimal solution to balance the performance and safety in the Appendix B.3.

The Inner-Level Optimization has two objects:(i) Find the optimal merging coefficient $\lambda$ that minimizes the loss of the merged model across different tasks on clean test data as Eq.4; (ii) Estimate the trigger pattern through synthesized adversarial perturbation $\Delta$, which can be used for learning the $M_{2}$ to identify the sensitive backdoor-related weight in outer-level optimization. Notably, during inner-level optimization, we first optimize the $\lambda$ to get $\lambda^{*}$ and then create the merged model for the second objects.

Especially, the synthesized unified perturbation can be used to identify the backdoor-related parameter without additional assumptions about the injected backdoor. That’s because, as shown by Eq.6, for each task data $D_{i}$, the adversarial samples from a backdoored model have similar features as the triggered images, but the ones from a clean model don’t have this property (Wei et al., ; Niu et al., ).

$$ $\displaystyle f_{\text{clean}}(D_{i}+\Delta_{i})\neq f_{\text{backdoor}}(D_{i} +\Delta_{i})\approx f_{\text{backdoor}}(D_{i}^{\text{with trigger}})$ (6) $$

At the same time, the adversarial examples produced based on the backdoored models come from arbitrary classes, usually exhibiting a uniform distribution in the embedding space.
Leveraging the embedding drift insight (Zeng et al., ) that backdoor triggers induce relatively uniform drifts in the model’s embedding space regardless of the trigger
location or attack mechanism, we can synthesize a unified perturbation to represent the misguided behavior change upon
trigger insertion for each task-specific model. Thus, the unknown backdoor injections can still be successfully approximated as a unified and synthesized perturbation.

###### Theorem 1 (Existence of Pareto front) .

###### Proof of Theorem 1 .

## 4 Experiments

### 4.1 Experimental Setup

Datasets and Models: Following  (Tang et al., ), we utilize CLIP-ViT-B/32 and CLIP-ViT-L/14 as our pre-trained models and conduct experiments on six image classification tasks including Stanford Cars (Krause et al., ), RESISC45 (Cheng et al., ), EuroSAT (Helber et al., ), SVHN (Netzer et al., ),
MNIST (Lecun et al., ) and DTD (Cimpoi et al., ). We first construct the clean individual fine-tuned models by directly fine-tuning the pre-trained model on these clean datasets and then inject them with the backdoor adopting TrojVit (Zheng et al., ) and BadVit (Yuan et al., ) strategy to construct the backdoored models. More detailed descriptions of datasets and models can be shown in the Appendix C.1.

Baselines: We mainly compare DAM with three groups of baselines:(i) Individual Finetuning: All Clean Finetuned Models, All Backdoored Finetuned Models, and Mixing with Clean and Backdoored Finetuned Models under different settings. Notably, we just average their results for reference;(ii) Multi-Task Merging Methods: Weight Average (Wortsman et al., ), Fisher merging (Matena & Raffel, ), RegMean (Jin et al., ), Task Arithmetic (Ilharco et al., ), Ties-Merging (Yadav et al., ), Adamerging (Yang et al., ), Concrete (Tang et al., ) (iii) Post-Defense Methods involving adversarial perturbation: ANP (Wu & Wang, ), AWM (Chai & Chen, ) and SAU (Wei et al., )). Notably, we execute these post-defense backdoor processing on the best-merged model adopting (ii), which can be seen as *two-stage methods* compared with our *end-to-end training process*. Moreover, we also provide experiments and discussions with other backdoor-related merging works (e.g.LoRA-as-an-Attack (Liu et al., ) and BadMerging (Zhang et al., ).), which are not designed for multi-task merging to further clarify our contributions. More detailed discussions can be shown in Appendix A.

Figure: Table 1: Necessary specifications for the implementation and properties of each method.

Evaluation Metric: We respectively adopt the top-1 accuracy(ACC) on clean test data as a performance metric and the attack success rate(ASR) on test data with trigger as a safety metric  (Wu et al., ). An ideal model should have high ACC but low ASR. To further explore the backdoor effect, apart from the average ACC and ASR on the full six tasks, we also present the average results on tasks related to backdoored task-specific models, including ACC(2)/ASR(2) and ACC(4)/ASR(4), with the numbers indicating the count of backdoored models.

Multi-Task Merging Settings Considering the Existence of Backdoor. To help understand our contribution, we provide a clear overview of existing merging methods and potential post-defense solutions that can address the backdoor issues during multi-task merging. Detailed information about the implementation and properties of methods can be shown in Table 1.
In short, we provide a cost-effective and safety-aware merging method to mitigate the neglected backdoor issues during multi-task merging.

### 4.2 Experimental Results

*DAM can outperform state-of-art multi-task merging methods to achieve a better trade-off between performance and safety.* We respectively conduct multi-task model merging experiments on CLIP-ViT-B/32 and CLIP-Vit-L/14, where exists two backdoored task-specific models and four clean models. The obtained results can be shown in Table 2 and Table 9. We can observe that
DAM can achieve lower ASR with a minor sacrifice of ACC compared with the SOTA merging method, Concrete AM(layer-wise). More multi-task merging experiments adopting two backdoored models can be shown in Appendix C, which can further support our conclusion and verify the effectiveness of our proposed DAM.

*DAM can achieve comparable or better effects in addressing the backdoor issues without additional training compared with post-defense methods.* Through the comparison experiments among Concrete AM(layer-wise), post-defense methods(ANP, AWM, and SAU), and DAM shown in Table 2 and Table 9, we observe that though previous post-defense methods can further mitigate the backdoor issues on the SOTA merged model in a way, they are still clearly worse than DAM in addressing the backdoor issues. The poor effectiveness of these post-defense methods can be attributed to their reliance on high-quality labeled data (Wu et al., ), which may be unrealistic during merging. Additionally, their target is a merged model that has converged solely on performance, making it difficult to achieve a balance between performance and safety in the post-defense process. Notably, these post-defense methods introduce additional training costs but DAM can naturally cope with the backdoor issues in an end-to-end training manner without this constraint.

**Table 2: Results of multi-task merging while adopting two models attacked by TrojVit (CLIP-ViT-B/32, ACC$\uparrow$/ASR$\downarrow$). We highlight the best average score in bold and the second score with underline.**
| METHOD | MNIST(clean) | Cars(clean) | RESISC45(backdoor) | EuroSAT(backdoor) | SVHN(clean) | DTD(clean) | AVG |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| ACC | ASR | ACC | ASR | ACC | ASR | ACC | ASR | ACC | ASR | ACC | ASR | ACC(2) | ACC(6) | ASR(2) | ASR(6) |  |
| Individual(All Clean) | 99.60 | 20.78 | 78.14 | 2.39 | 95.30 | 42.11 | 99.07 | 24.37 | 96.30 | 36.24 | 78.72 | 22.77 | 97.19 | 91.19 | 33.24 | 24.78 |
| Individual(All Backdoor) | 97.47 | 98.56 | 64.00 | 99.63 | 89.00 | 98.37 | 94.85 | 100.00 | 84.86 | 89.67 | 61.50 | 98.90 | 91.93 | 81.95 | 99.19 | 97.52 |
| Individual(Two Backdoor) | 99.60 | 20.78 | 78.14 | 2.39 | 89.00 | 98.37 | 94.85 | 100.00 | 96.30 | 36.24 | 78.72 | 22.77 | 91.93 | 89.44 | 99.19 | 46.76 |
| Weight Average | 89.51 | 36.10 | 63.35 | 1.37 | 73.00 | 86.16 | 85.07 | 100.00 | 66.04 | 73.15 | 51.76 | 26.12 | 79.04 | 71.46 | 93.08 | 53.82 |
| Fisher Merging | 97.18 | 25.18 | 65.58 | 1.64 | 74.56 | 24.54 | 82.48 | 94.63 | 78.38 | 62.16 | 59.73 | 25.21 | 78.52 | 76.32 | 59.59 | 38.89 |
| RegMean | 98.37 | 19.45 | 69.11 | 2.42 | 73.89 | 58.86 | 93.08 | 97.04 | 92.94 | 42.74 | 66.06 | 31.22 | 83.49 | 82.24 | 77.95 | 41.96 |
| Task Arithmetic | 91.30 | 35.67 | 63.60 | 1.34 | 74.94 | 85.65 | 83.30 | 100.00 | 67.76 | 73.12 | 52.82 | 25.64 | 79.12 | 72.29 | 92.83 | 53.57 |
| Ties-Merging | 98.04 | 16.25 | 63.64 | 0.40 | 66.75 | 98.76 | 78.33 | 100.00 | 85.06 | 49.59 | 55.85 | 19.26 | 72.54 | 74.61 | 99.38 | 47.38 |
| AdaMerging(Task-Wise) | 97.83 | 18.46 | 63.80 | 1.01 | 67.98 | 98.95 | 63.56 | 100.00 | 77.79 | 57.37 | 62.98 | 21.28 | 65.77 | 72.32 | 99.48 | 49.51 |
| AdaMerging(Layer-Wise) | 98.19 | 13.51 | 73.73 | 0.97 | 86.90 | 54.87 | 91.33 | 91.51 | 92.49 | 38.21 | 70.16 | 23.40 | 89.12 | 85.47 | 73.19 | 37.08 |
| Concrete TA | 98.43 | 16.37 | 61.62 | 0.34 | 79.59 | 95.95 | 93.85 | 100.00 | 91.20 | 44.30 | 51.86 | 12.98 | 86.72 | 79.43 | 97.98 | 44.99 |
| Concrete AM (Task-Wise) | 98.11 | 13.39 | 68.82 | 0.86 | 80.24 | 98.10 | 63.33 | 99.93 | 92.05 | 45.72 | 65.00 | 17.07 | 71.79 | 77.93 | 99.02 | 45.85 |
| Concrete AM (Layer-Wise) | 98.43 | 16.36 | 74.95 | 1.02 | 87.20 | 45.98 | 90.15 | 95.67 | 93.00 | 44.74 | 71.86 | 22.18 | 88.68 | 85.93 | 70.83 | 37.66 |
| ANP | 98.24 | 13.60 | 74.24 | 0.98 | 87.05 | 54.80 | 91.85 | 91.59 | 92.60 | 39.50 | 70.27 | 23.19 | 89.45 | 85.71 | 73.20 | 37.28 |
| AWM | 98.27 | 13.61 | 74.23 | 1.02 | 87.11 | 54.93 | 91.78 | 91.63 | 92.62 | 38.70 | 70.37 | 23.03 | 89.45 | 85.73 | 73.28 | 37.15 |
| SAU | 98.24 | 13.57 | 74.13 | 0.96 | 87.06 | 54.24 | 91.85 | 91.67 | 92.60 | 39.03 | 70.21 | 23.19 | 89.46 | 85.68 | 72.96 | 37.11 |
| DAM(Ours) | 98.93 | 14.64 | 69.26 | 0.90 | 88.34 | 43.38 | 91.19 | 85.56 | 92.69 | 47.13 | 70.96 | 22.98 | 89.77 | 85.23 | 64.47 | 35.77 |

**Table 3: Results of multi-task merging while adopting four models attacked by TrojVit (CLIP-ViT-B/32, ACC$\uparrow$/ASR$\downarrow$). We highlight the best average score in bold and the second score with underline.**
| METHOD | MNIST(backdoor) | Cars(backdoor) | RESISC45(backdoor) | EuroSAT(backdoor) | SVHN(clean) | DTD(clean) | AVG |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| ACC | ASR | ACC | ASR | ACC | ASR | ACC | ASR | ACC | ASR | ACC | ASR | ACC(4) | ACC(6) | ASR(4) | ASR(6) |  |
| Individual(All Clean) | 99.60 | 20.78 | 78.14 | 2.39 | 95.30 | 42.11 | 99.07 | 24.37 | 96.30 | 36.24 | 78.72 | 22.77 | 93.03 | 91.19 | 22.41 | 24.78 |
| Individual(All Backdoor) | 97.47 | 98.56 | 64.00 | 99.63 | 89.00 | 98.37 | 94.85 | 100.00 | 84.86 | 89.67 | 61.50 | 98.90 | 86.33 | 81.95 | 99.14 | 97.52 |
| Individual(Four Backdoor) | 97.47 | 98.56 | 64.00 | 99.63 | 89.00 | 98.37 | 94.85 | 100.00 | 96.30 | 36.24 | 78.72 | 22.77 | 86.33 | 86.72 | 99.14 | 75.93 |
| Weight Average | 91.87 | 68.17 | 62.17 | 53.81 | 74.24 | 80.16 | 82.85 | 100.00 | 67.67 | 89.11 | 52.82 | 22.02 | 77.78 | 71.94 | 75.54 | 68.88 |
| Fisher Merging | 92.88 | 77.04 | 49.87 | 77.95 | 71.70 | 17.13 | 86.11 | 98.22 | 78.68 | 87.30 | 60.59 | 27.18 | 75.14 | 73.31 | 67.59 | 64.14 |
| RegMean | 97.32 | 67.03 | 64.71 | 80.90 | 75.86 | 52.44 | 93.70 | 97.85 | 91.34 | 69.71 | 65.96 | 26.91 | 82.90 | 81.48 | 74.56 | 65.81 |
| Task Arithmetic | 91.90 | 67.86 | 61.99 | 53.25 | 74.27 | 79.65 | 83.11 | 100.00 | 67.49 | 88.96 | 52.87 | 21.60 | 77.82 | 71.94 | 75.19 | 68.55 |
| Ties-Merging | 97.31 | 81.70 | 58.46 | 90.54 | 64.97 | 97.41 | 76.85 | 100.00 | 80.95 | 89.07 | 52.66 | 3.83 | 74.40 | 71.87 | 92.41 | 77.09 |
| AdaMerging(Task-Wise) | 97.58 | 72.63 | 51.65 | 24.65 | 69.90 | 97.79 | 63.48 | 100.00 | 72.95 | 89.43 | 61.82 | 16.70 | 70.65 | 69.56 | 73.77 | 66.87 |
| AdaMerging(Layer-Wise) | 98.30 | 19.66 | 73.62 | 2.15 | 87.24 | 52.32 | 91.26 | 92.26 | 92.45 | 54.34 | 70.74 | 23.44 | 87.61 | 85.60 | 41.60 | 40.70 |
| Concrete TA | 98.39 | 33.94 | 58.13 | 55.07 | 77.40 | 94.97 | 93.89 | 94.97 | 90.95 | 60.98 | 49.89 | 9.10 | 81.95 | 78.11 | 69.74 | 58.17 |
| Concrete AM (Task-Wise) | 97.97 | 31.65 | 50.03 | 23.08 | 81.27 | 97.81 | 64.19 | 99.93 | 92.73 | 58.97 | 69.52 | 14.47 | 73.37 | 75.95 | 63.12 | 54.32 |
| Concrete AM (Layer-Wise) | 98.21 | 25.32 | 73.81 | 2.34 | 88.56 | 61.27 | 93.85 | 89.11 | 92.79 | 68.57 | 72.34 | 22.34 | 88.61 | 86.59 | 44.51 | 44.83 |
| ANP | 98.33 | 19.82 | 74.01 | 2.21 | 87.37 | 52.51 | 91.67 | 92.48 | 92.57 | 54.87 | 70.80 | 23.35 | 87.85 | 85.79 | 41.76 | 40.87 |
| AWM | 98.33 | 19.77 | 73.95 | 2.20 | 87.33 | 52.33 | 91.67 | 92.22 | 92.54 | 54.80 | 70.75 | 23.19 | 87.82 | 85.76 | 41.63 | 40.75 |
| SAU | 98.29 | 19.51 | 74.33 | 2.46 | 87.21 | 39.94 | 91.33 | 93.74 | 92.79 | 59.67 | 71.76 | 21.76 | 87.79 | 85.95 | 38.91 | 39.51 |
| DAM(Ours) | 98.47 | 18.53 | 74.39 | 2.39 | 87.13 | 32.26 | 91.04 | 82.63 | 92.62 | 57.64 | 71.49 | 22.92 | 87.76 | 85.86 | 33.95 | 36.06 |

*DAM can achieve robust results during multi-task merging adapted to the different numbers of backdoored models and different types of backdoors.* First, as shown in Table 3, apart from using two backdoored models during merging, we merge four backdoored and two clean models to achieve a multi-task model. The reported results consistently show that DAM can mitigate the backdoors better, owning 11 scores decrease on the four tasks related to the backdoor models(ASR(4)) and nearly 9 score decrease on the full tasks(ASR(6), compared with previous SOTA merging methods. Simultaneously, the ACC of DAM decreases minorly within 1 score on average which can be accepted in a way. Besides, DAM consistently yields superior results than post-defense methods. Then, we additionally introduce another backdoor attack called BadVit  (Yuan et al., ) to explore the robustness of DAM. The results of Table 4 illustrate that the backdoor types have little impact on the effect of DAM, which still can outperform existing multi-task merging methods and post-defense methods. These results can further verify the effectiveness and robustness of DAM.

**Table 4: Results of multi-task merging while adopting two models attacked by TrojVit and BadVit respectively (CLIP-ViT-B/32, ACC$\uparrow$/ASR$\downarrow$). We highlight the best average score in bold and the second score with underline.**
| METHOD | MNIST(clean) | Cars(clean) | RESISC45(BadVit) | EuroSAT(TrojVit) | SVHN(clean) | DTD(clean) | AVG |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| ACC | ASR | ACC | ASR | ACC | ASR | ACC | ASR | ACC | ASR | ACC | ASR | ACC(2) | ACC(6) | ASR(2) | ASR(6) |  |
| Individual(All Clean) | 99.60 | 20.78 | 78.14 | 2.39 | 95.30 | 42.11 | 99.07 | 24.37 | 96.30 | 36.24 | 78.72 | 22.77 | 97.19 | 91.19 | 33.24 | 24.78 |
| Individual(All Backdoor) | 97.47 | 98.56 | 64.00 | 99.63 | 89.00 | 98.37 | 95.38 | 99.58 | 84.86 | 89.11 | 61.50 | 98.90 | 92.19 | 82.04 | 98.98 | 97.36 |
| Individual(Two Types of Backdoor) | 99.60 | 20.78 | 78.14 | 2.39 | 89.00 | 98.37 | 95.38 | 99.58 | 96.30 | 36.24 | 78.72 | 22.77 | 92.19 | 89.52 | 98.98 | 46.69 |
| Weight Average | 89.87 | 37.23 | 63.44 | 1.51 | 74.51 | 87.33 | 85.44 | 99.31 | 66.99 | 73.89 | 51.22 | 25.11 | 79.98 | 71.91 | 93.32 | 54.06 |
| Fisher Merging | 97.23 | 25.91 | 67.54 | 1.48 | 78.33 | 59.51 | 80.18 | 92.87 | 79.58 | 63.17 | 59.93 | 25.08 | 79.26 | 77.13 | 76.19 | 44.67 |
| RegMean | 98.37 | 19.45 | 69.11 | 2.51 | 73.89 | 58.86 | 91.25 | 90.04 | 92.94 | 42.74 | 61.21 | 29.77 | 82.57 | 81.13 | 74.45 | 40.56 |
| Task Arithmetic | 91.30 | 35.67 | 63.60 | 1.74 | 74.94 | 85.65 | 87.56 | 96.31 | 68.76 | 73.12 | 51.82 | 25.55 | 81.25 | 73.00 | 90.98 | 53.01 |
| Ties-Merging | 98.04 | 16.25 | 63.64 | 0.81 | 66.75 | 98.76 | 76.89 | 97.41 | 84.25 | 49.59 | 52.85 | 19.39 | 71.82 | 73.74 | 98.09 | 47.04 |
| AdaMerging(Task-Wise) | 97.83 | 18.46 | 67.80 | 1.05 | 74.98 | 98.95 | 67.54 | 97.38 | 78.25 | 57.37 | 61.22 | 21.00 | 71.26 | 74.60 | 98.17 | 49.04 |
| AdaMerging(Layer-Wise) | 98.44 | 13.51 | 73.73 | 1.05 | 86.90 | 54.87 | 90.11 | 88.05 | 90.91 | 38.21 | 69.51 | 24.11 | 88.51 | 84.93 | 71.46 | 36.63 |
| Concrete TA | 96.89 | 16.37 | 61.62 | 0.88 | 79.59 | 95.95 | 92.85 | 97.84 | 91.78 | 44.30 | 52.55 | 13.85 | 86.22 | 79.21 | 96.90 | 44.87 |
| Concrete AM (Task-Wise) | 98.68 | 13.39 | 68.82 | 1.11 | 80.24 | 98.10 | 71.25 | 95.93 | 92.78 | 45.72 | 64.58 | 15.41 | 75.75 | 79.39 | 97.02 | 44.94 |
| Concrete AM (Layer-Wise) | 99.11 | 16.36 | 75.95 | 1.09 | 87.20 | 45.98 | 94.51 | 86.25 | 94.14 | 44.74 | 70.33 | 18.51 | 90.86 | 86.87 | 66.12 | 35.49 |
| ANP | 99.00 | 15.58 | 76.58 | 1.33 | 85.55 | 42.51 | 92.57 | 82.51 | 93.58 | 44.04 | 68.98 | 18.35 | 89.06 | 86.04 | 62.51 | 34.05 |
| AWM | 99.11 | 15.63 | 76.42 | 1.18 | 85.48 | 42.38 | 91.77 | 81.01 | 92.99 | 43.81 | 69.25 | 18.68 | 88.63 | 85.84 | 61.70 | 33.78 |
| SAU | 98.69 | 14.87 | 76.02 | 0.98 | 85.87 | 42.98 | 90.59 | 80.58 | 92.21 | 41.58 | 69.65 | 18.78 | 88.23 | 85.51 | 61.78 | 33.30 |
| DAM(Ours) | 98.88 | 15.00 | 76.14 | 0.99 | 85.83 | 40.25 | 90.48 | 76.18 | 92.02 | 39.07 | 69.05 | 15.95 | 88.16 | 85.40 | 58.22 | 31.24 |

*DAM can achieve better results than other backdoor-related merging methods that are not designed for multi-task merging scenarios or successfully defend their proposed backdoor attack for model merging.* Both WAG (Arora et al., ) and LoRA-as-an-Attack (Liu et al., ) defend the backdoor by directly averaging the homogeneous clean and backdoored full model weights or LoRa *on the same task* without other complex designs(e.g.subspace). To distinguish it from our proposed DAM for *multi-task merging*, as the experiments show in Table 6, for each task related to the backdoored individual finetuned model, we additionally select a clean model for this task during multi-task merging. This corresponds to the open-source community scenario, where exists many models for the same task, and part of them are injected with backdoors but we can not know in advance. From the results, we can observe that DAM consistently achieves higher ACC and lower ASR in different settings. For the BadMering (Arora et al., ), which aims to introduce a new backdoor attack to break the safeguard for existing merging methods. We mainly utilize it to attack the merged model of Table 2 and Table 3 adopting the DAM strategy. The results of Table 6 show that it’s difficult to clearly increase the ASR adopting the attack proposed by BadMerging. In other words, DAM can successfully defend this new backdoor attack, further verifying its effectiveness in addressing the backdoor issues.

**Table 5: Comparison results with other backdoor-defense methods that are not designed for multi-task scenarios.**
| SETTINGS | METHODS | ACC$\uparrow$ | ASR$\downarrow$ |
| --- | --- | --- | --- |
| (2backdoor+2clean)+4 clean | LoRA-as-an-Attack/WAG | 83.81 | 29.51 |
| DAM(Ours) | 85.79 | 24.52 |  |
| (4backdoor+4clean)+2 clean | LoRA-as-an-Attack/WAG | 81.11 | 33.58 |
| DAM(Ours) | 86.81 | 27.11 |  |

Figure: Table 7: Ablation studies for the masks of DAM.

*Two masks have different effects on DAM and collectively promote the merged model with a good trade-off between safety and performance.* The experimental settings are consistent with Table 2 and Table 3. As shown in Eq.3, removing the $M_{2}$ of DAM means we only focus on the interference of multi-task merging, which is similar to Concrete (Tang et al., ). In contrast, removing the $M_{2}$ of DAM means we mainly deal with the backdoor issues, which can be achieved by adopting AdaMerging (Yang et al., ) on the perturbated data. Then, removing two masks together means we only focus on learning the merging coefficients without revising the task vectors. The results shown in Table 7 can verify the effectiveness of the dual-mask optimization in addressing the backdoor issues for multi-task merging.

## 5 Conclusion

This paper conducts extensive experiments to explore the backdoor effect for multi-task merging, uncovering two neglected but important phenomena: backdoor succession and backdoor transfer. To address these challenges, we propose a novel Defense-Aware Merging (DAM) algorithm through dual mask optimization to identify a shared and safety-aware subspace so as to mitigate interference and backdoor issues for multi-task merging. Extensive experiments on several benchmarks can verify the effectiveness and robustness of DAM. Finally, we hope this study can draw attention to the safety issues of model merging across more scenarios.

## Appendix A Related Work

### A.1 Multi-Task Model Merging

Multitask model merging aims to provide cost-effective parameter fusion strategies to integrate multiple task-specific finetuned models from the shared pre-trained model into a unified one that can handle various tasks (Tang et al., ; Yang et al., ).
The well-known strategy to merge multiple task-specific models is by performing element-wise interpolation on weights, such as Weight Average (Wortsman et al., ; Kaddour, ; Chronopoulou et al., ; Sanyal et al., ; Lawson & Qureshi, ; Jia et al., ), Fisher merging (Matena & Raffel, ; Ryu et al., ; Nathan et al., ), RegMean (Jin et al., ), and Task Arithmetic (Ilharco et al., ; Zhang et al., ; Ni et al., ; Ortiz-Jimenez et al., ). To further enhance the effectiveness of merging, many efforts have been devoted to addressing interference among tasks and proposing gradient-conflict-based (Yadav et al., ), representation-based (Yang et al., ; ), and subspace-based methods (Tang et al., ; Tam et al., ; Yu et al., ). However, these works aim to facilitate knowledge transfer during model merging, but harmful elements like adversarially injected backdoors may also succeed and transfer. Unfortunately, there is insufficient analysis of how multi-task merging will be affected if one or more task-specific models are injected with the backdoor.

### A.2 Model Merging Considering the Safety

The safety of machine learning algorithms is the key to their widespread applications (Wu et al., ). Recently, many researchers have begun to emphasize safety concerns associated with merging scenarios (Yang et al., ). For example, some works adopt the subspace-based and data-aware merging methods to deal with the misalignment (Yi et al., ; Hammoud et al., ) and Intellectual Property Protection (Cong et al., ) problems for large language models (LLMs). Consistent with our work that focuses on the backdoor issues, WAG (Arora et al., ) and LoRA-as-an-Attack (Liu et al., ) conducted preliminary exploration under backdoor defense scenarios. However, they only adopt the initial weight average strategy (Wortsman et al., ), to cope with the backdoor issues on the same task without more fine-grained designs(e.g. subspace). Besides, BadMerging (Zhang et al., ) only focuses on executing effective backdoor attacks to maximize the ASR to break the safeguard for multi-task merging methods, while we mainly consider the defense strategy to minimize the ASR during merging. To the best of our knowledge, our work is the first to conduct extensive experiments to investigate the backdoor effect for multi-task merging scenarios and provide a novel defense-aware merging algorithm to alleviate this problem.

## Appendix B More Details about the Method

### B.1 The Implementation of the Mask Processing.

Ideally, both $M_{1}$ and $M_{2}$ should be optimized alone, but to make the solution easy, we let the $M_{1}=M_{2}$ during the implementation. Then, this single mask can be optimized with two different losses as Eq. 11 when given the initial sampling distribution. Exactly, there are many mask sampling techniques to process the neuron or parameters, we adopt the concrete mask strategy (Tang et al., ) as Eq. 7 to revise the task vector $\tau_{i}$, where $\mathbf{m}$ is a $d$-dimensional real vector in $[0,1]^{d}$ parameterized by logits $\mathbf{x}\in\mathbb{R}^{d}$ or probabilities $\mathbf{p}=\sigma(\mathbf{x})$, $d$ is the number of parameters in a neural network, $u$ is a random variable sampled from a uniform distribution on the interval $(0,1)$ and $T$ is the temperature parameter to control the steepness of the sigmoid function $\sigma(\cdot)$. Moreover, the processed $\tau^{\prime}_{i}$ is further re-scaled to $\tau^{\prime\prime}_{i}$ as Eq.8 to avoid the mask being too sparse to keep the base performance (Yu et al., ).

$$ $\displaystyle\mathbf{m}$ $\displaystyle=\sigma\left(\left(\log\frac{u}{1-u}+\log\frac{\sigma(x)}{1- \sigma(x)}\right)/\text{T}\right)$ (7) $\displaystyle\tau^{\prime\prime}_{i}$ $\displaystyle=\frac{\tau^{\prime}_{i}}{\mathbb{E}_{m\sim\mathbf{m}}[m]}=\frac{ \tau_{i}\odot\mathbf{m}}{\mathbb{E}_{m\sim\mathbf{m}}[m]}.$ (8) $$

### B.2 The Pseudo Code of Our Proposed DAM

Based on the implementation of the mask, we provide the pseudo-code of our proposed DAM to learn a shared and safety-aware subspace through learning a mask for task vectors. Exactly, as 11, this mask is affected by two different losses designed for balancing the performance and safety for multi-task model merging.

### B.3 Discussion about the Pareto Optimal Balance between Performance and Safety.

Convergence analysis.
Here we discuss how the proposed algorithm converges to a Pareto optimal solution, balancing performance and safety.
Recall the optimization problem in Eq.(3), which can be rewritten as:

$$ $\displaystyle\mathcal{L}_{\text{perf}}(M_{1})$ $\displaystyle=\sum_{i=1}^{n}\mathcal{L}\left(\mathcal{A}(\theta_{\text{pre}}, \{M_{1}\odot\tau_{j}\}_{j=1}^{n},\lambda^{*}),D_{i}\right),$ (9) $\displaystyle\mathcal{L}_{\text{safe}}(M_{1},M_{2})$ $\displaystyle=\sum_{i=1}^{n}\mathcal{L}\left(\mathcal{A}(\theta_{\text{pre}}, \{M_{1}\odot M_{2}\odot\tau_{j}\}_{j=1}^{n},\lambda^{*}),D_{i}+\Delta_{i}^{*} \right),$ (10) $\displaystyle\mathcal{L}_{total}(\mathbf{M})$ $\displaystyle=L_{\text{perf}}(M_{1})+\alpha L_{\text{safe}}(M_{1},M_{2}).$ (11) $$

In a multi-objective optimization problem (MOOP), a common approach is to scalarize the objectives by forming a weighted sum (Schäffler et al., ; Désidéri, ; Burke et al., ).
Here, $\mathcal{L}_{total}(\mathbf{M})$ serves as the scalarized objective with normalized weights $(\frac{1}{1+\alpha},\frac{\alpha}{1+\alpha})\in\triangle^{1}$, balancing performance and safety through the parameter $\alpha$.
Assume the loss functions $\mathcal{L}_{\text{perf}}(M_{1})$ and $\mathcal{L}_{\text{safe}}(M_{1},M_{2})$ are continuous and convex.
With $\alpha>0$ and suitable learning rates that satisfy standard conditions
(e.g., diminishing step sizes or the Robbins-Monro conditions (Robbins & Monro, )), gradient descent methods converge to stationary points in convex optimization.
In scalarized MOOP, minimizing a weighted sum of convex objectives with positive weights yields solutions on the Pareto front.
At the stationary point $(M_{1}^{*},M_{2}^{*})$, improving one objective (e.g., decreasing $L_{\text{perf}}$) would necessitate worsening the other (increasing $L_{\text{safe}}$).
Thus, the solution $\mathbf{M}^{*}=(M_{1}^{*},M_{2}^{*})$ is Pareto optimal with respect to performance and safety. Adjusting $\alpha$ changes the weights in the scalarized objective, effectively moving the solution along the Pareto front $\mathcal{F}$.

###### Corollary 1 (Performance-safety trade-off control) .

The hyper-parameter $\alpha$ in Eq.(3) and (11) controls the position on the Pareto front $\mathcal{F}$, with larger $\alpha$ values favoring safety over performance.

Figure: Algorithm 1 Defense-Aware Merging to Acquire a Shared and Safety-Aware Subspace through a Mask across Tasks Vectors. This mask equals the Task-Shared Mask and the Backdoor-Detection Mask when $M_{1}=M_{2}$

###### Corollary 1 (Performance-safety trade-off control) .

## Appendix C More Experimental Results

### C.1 Backdoored Models Constructions

We construct the backdoored models adopting two well-known vit-specific backdoor attack strategies, including TrojVit Zheng et al. () and BadVit (Yuan et al., ). We provide detailed hyperparameters during our experiments as the Table 8 shows. Notably, we only use a few data (10 percent of the full test data) for each task to construct backdoored models. The attack target includes the full connection layer(fc) and self-attention layer. Different from classific CNN-specific backdoor attacks(e.g.BadNets (Gu et al., ) and LC (Turner et al., )) as the comparison experiments show in BadMerging (Zhang et al., ),
We mainly select the vit-specific backdoor attack methods(e.g. TrojVit (Zheng et al., )) to inject the patch-wise backdoor, which has been verified to be especially effective for the vision transformer.

The comparison between clean and backdoor models adopting CLIP-ViT-B/32 and CLIP-ViT-L/14 can be
shown in Figure 5 and Figure 6. We can observe that the backdoor models achieve good ACC but high ASR compared with the clean model, which may bring the potential risk to model merging. Similar to TrojVit, we simultaneously report the score of ASR for the clean and backdoor models to clarify the backdoor effect that misguides the model output toward the target class when the inputs contain a specific trigger.

**Table 8: The hyperparameters for backdoored models construction.**
|  | Cars | RESISC45 | EuroSAT | SVHN | MNIST | DTD |
| --- | --- | --- | --- | --- | --- | --- |
| batch_size | 4 | 2 | 2 | 1 | 8 | 2 |
| poison_rate | 0.1 | 0.1 | 0.1 | 0.1 | 0.1 | 0.1 |
| num_patch | 6 | 9 | 9 | 9 | 9 | 9 |
| patch_size | 16 | 16 | 16 | 16 | 16 | 16 |
| attack_learning_rate | 0.22 | 0.22 | 0.22 | 0.22 | 0.22 | 0.22 |
| train_attack_iters | 250 | 250 | 250 | 250 | 250 | 250 |
| attack_target | fc1 | self_attention | self_attention | fc1 | self_attention | self_attention |

Figure: (a) MNIST
Refer to caption: x9.png

Figure: (a) MNIST
Refer to caption: x15.png

### C.2 More Experiments about Backdoor Succession and Backdoor Transfer

As shown in Figure 7 and Figure 8, we provide additional experiments while merging four backdoored models and two clean models to further display the phenomenon of backdoor succession and backdoor transfer.

From the results, we can observe that the evaluation of existing merging methods is not fully consistent with the results shown in (Tang et al., ) when we take performance and safety into consideration simultaneously. For example, Ties-Merging achieved unexpectedly poor results, sometimes even worse than RegMean and Fisher Merging, which is the opposite of its reported outcome. This can be attributed to the fact that the success of Ties-Merging relies heavily on the gradient conflict analysis of different tasks. However, this analysis just considers the task-specific performance without dealing with safety issues. When there exists backdoored task-specific models during merging, the causes of gradient conflicts are complex and multidimensional. Notably, compared with task-wise methods, Adamerging(task-wise) and Concrete AM(task-wise), the layer-wise version of corresponding methods can consistently achieve better performance, but their ASR results are still high. This further clarifies the single task-wise performance perspective is not always appropriate, highlighting the need for more exploration of the backdoor issues during multi-task merging.

Figure: (a) Four Tasks Related to Backdoor
Refer to caption: x21.png

Figure: (a) EuroSAT (backdoor)
Refer to caption: x23.png

### C.3 More Merging Results

As shown in Table 9, we provide the merging results when we adopt the CLIP-ViT-L/14 as our pre-trained model and merge two backdoored task-specific models and four clean task-specific models.
We can observe that DAM can outperform previous merging methods and post-defense methods in achieving a better trade-off between performance and safety, clearly reducing the ASR without sacrificing the ACC heavily.

Moreover, Table 10 and Table 11 display the merging results while
merging two backdoored models and four clean models. Different from the Table 2 in the main text, we
select other task-specific backdoored models during merging. These results can further verify the effectiveness and robustness of the proposed DAM.

**Table 9: Results of multi-task merging while adopting two models attacked by TrojVit (CLIP-ViT-L/14, ACC$\uparrow$/ASR$\downarrow$). We highlight the best average score in bold and the second score with underline.**
| METHOD | MNIST(clean) | Cars(clean) | RESISC45(backdoor) | EuroSAT(backdoor) | SVHN(clean) | DTD(clean) | AVG |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| ACC | ASR | ACC | ASR | ACC | ASR | ACC | ASR | ACC | ASR | ACC | ASR | ACC(2) | ACC(6) | ASR(2) | ASR(6) |  |
| Individual(All Clean) | 99.75 | 44.48 | 92.82 | 2.67 | 97.30 | 2.27 | 99.30 | 16.59 | 97.90 | 54.40 | 85.10 | 17.18 | 98.30 | 95.36 | 9.43 | 22.93 |
| Individual(All Backdoor) | 98.84 | 92.65 | 88.35 | 98.08 | 89.65 | 94.46 | 97.48 | 97.26 | 95.92 | 98.20 | 76.81 | 97.71 | 93.57 | 91.18 | 95.86 | 96.39 |
| Individual(Two Backdoor) | 99.75 | 44.48 | 92.82 | 2.67 | 89.65 | 94.46 | 97.48 | 97.26 | 97.90 | 54.40 | 85.10 | 17.18 | 93.57 | 93.78 | 95.86 | 51.74 |
| Weight Average | 98.05 | 41.55 | 82.63 | 1.88 | 85.46 | 59.92 | 93.52 | 90.70 | 82.26 | 82.69 | 64.04 | 3.99 | 89.49 | 84.33 | 75.31 | 46.79 |
| Fisher Merging | 97.51 | 44.35 | 86.08 | 1.93 | 80.97 | 16.11 | 92.59 | 88.15 | 90.53 | 81.66 | 73.09 | 4.20 | 86.78 | 86.80 | 52.13 | 39.40 |
| RegMean | 99.27 | 33.55 | 89.35 | 1.77 | 90.22 | 50.10 | 96.63 | 66.44 | 96.45 | 77.18 | 76.33 | 8.19 | 93.43 | 91.38 | 58.27 | 39.54 |
| Task Arithmetic | 98.05 | 41.52 | 82.61 | 1.87 | 85.51 | 59.97 | 93.52 | 90.74 | 82.27 | 82.68 | 64.04 | 3.99 | 89.52 | 84.33 | 75.36 | 46.80 |
| Ties-Merging | 99.03 | 25.85 | 84.65 | 1.07 | 86.63 | 94.41 | 89.67 | 94.30 | 92.06 | 74.26 | 65.96 | 2.18 | 88.15 | 86.33 | 94.36 | 48.68 |
| AdaMerging(Task-Wise) | 97.86 | 30.18 | 85.46 | 0.99 | 84.84 | 73.57 | 88.48 | 93.79 | 80.35 | 73.80 | 77.55 | 2.66 | 86.66 | 85.76 | 83.68 | 45.83 |
| AdaMerging(Layer-Wise) | 99.26 | 18.59 | 91.38 | 0.91 | 93.86 | 2.02 | 96.74 | 50.78 | 96.46 | 64.41 | 83.51 | 7.07 | 95.30 | 93.54 | 26.40 | 23.96 |
| Concrete TA | 98.26 | 28.44 | 86.97 | 1.35 | 85.51 | 69.44 | 87.51 | 89.32 | 79.32 | 72.15 | 78.33 | 4.51 | 86.51 | 85.98 | 79.38 | 44.20 |
| Concrete AM (Task-Wise) | 98.86 | 28.18 | 85.87 | 0.99 | 84.51 | 66.57 | 87.44 | 89.54 | 78.35 | 69.80 | 78.21 | 2.99 | 85.98 | 85.54 | 78.06 | 43.01 |
| Concrete AM (Layer-Wise) | 99.06 | 16.89 | 91.64 | 0.93 | 92.88 | 2.12 | 96.44 | 48.25 | 96.57 | 67.51 | 83.51 | 6.88 | 94.66 | 93.35 | 25.19 | 23.76 |
| ANP | 98.45 | 16.55 | 91.69 | 0.91 | 92.00 | 1.98 | 96.77 | 47.55 | 96.81 | 67.59 | 83.00 | 6.54 | 94.39 | 93.12 | 24.77 | 23.52 |
| AWM | 98.15 | 15.89 | 91.33 | 0.77 | 92.14 | 2.12 | 96.40 | 47.40 | 96.22 | 66.12 | 83.11 | 6.12 | 94.27 | 92.89 | 24.76 | 23.07 |
| SAU | 98.00 | 14.79 | 90.89 | 0.54 | 92.18 | 1.85 | 96.32 | 46.40 | 96.00 | 65.32 | 83.18 | 6.21 | 94.25 | 92.76 | 24.13 | 22.52 |
| DAM(Ours) | 97.94 | 14.51 | 91.18 | 0.76 | 92.93 | 2.40 | 96.18 | 43.18 | 92.76 | 55.71 | 82.57 | 4.09 | 94.56 | 92.26 | 22.79 | 20.11 |

**Table 10: Results of multi-task merging while adopting two models attacked by TrojVit (CLIP-ViT-B/32, ACC$\uparrow$/ASR$\downarrow$). We highlight the best average score in bold and the second score with underline.**
| METHOD | MNIST(backdoor) | Cars(backdoor) | RESISC45(clean) | EuroSAT(clean) | SVHN(clean) | DTD(clean) | AVG |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| ACC | ASR | ACC | ASR | ACC | ASR | ACC | ASR | ACC | ASR | ACC | ASR | ACC(2) | ACC(6) | ASR(2) | ASR(6) |  |
| Individual(All Clean) | 99.60 | 20.78 | 78.14 | 2.39 | 95.30 | 42.11 | 99.07 | 24.37 | 96.30 | 36.24 | 78.72 | 22.77 | 88.87 | 91.19 | 11.59 | 24.78 |
| Individual(All Backdoor) | 97.47 | 98.56 | 64.00 | 99.63 | 89.00 | 98.37 | 94.85 | 100.00 | 84.86 | 89.67 | 61.50 | 98.90 | 80.74 | 81.95 | 99.10 | 97.52 |
| Individual(Two Backdoor) | 97.47 | 98.56 | 64.00 | 99.63 | 95.30 | 42.11 | 99.07 | 24.37 | 96.30 | 36.24 | 78.72 | 22.77 | 80.74 | 88.48 | 99.10 | 53.95 |
| Weight Average | 91.88 | 68.53 | 62.65 | 50.48 | 73.60 | 15.73 | 83.04 | 85.63 | 67.67 | 89.36 | 52.87 | 23.62 | 77.27 | 71.95 | 59.51 | 55.56 |
| Fisher Merging | 93.61 | 74.73 | 49.68 | 68.24 | 75.22 | 7.51 | 85.19 | 91.56 | 78.24 | 87.25 | 59.68 | 22.82 | 71.65 | 73.60 | 71.49 | 58.69 |
| RegMean | 97.61 | 61.30 | 65.28 | 81.58 | 85.87 | 9.49 | 96.11 | 54.07 | 92.04 | 67.84 | 67.23 | 27.18 | 81.45 | 84.02 | 71.44 | 50.24 |
| Task Arithmetic | 91.84 | 68.15 | 62.49 | 49.98 | 73.63 | 15.33 | 83.22 | 85.70 | 67.50 | 89.22 | 53.09 | 22.98 | 77.17 | 71.96 | 59.07 | 55.23 |
| Ties-Merging | 97.28 | 84.39 | 59.46 | 94.66 | 75.32 | 13.92 | 84.26 | 83.85 | 81.10 | 90.27 | 53.62 | 6.22 | 78.37 | 75.17 | 89.53 | 62.22 |
| AdaMerging(Task-Wise) | 96.60 | 56.58 | 49.73 | 10.58 | 78.95 | 34.22 | 80.11 | 22.71 | 77.67 | 81.37 | 61.65 | 14.79 | 73.17 | 74.12 | 33.58 | 36.71 |
| AdaMerging(Layer-Wise) | 98.24 | 18.97 | 73.88 | 1.80 | 87.11 | 11.95 | 91.52 | 59.22 | 92.77 | 53.14 | 70.48 | 22.71 | 86.06 | 85.67 | 10.39 | 27.97 |
| Concrete TA | 98.41 | 37.07 | 60.24 | 56.56 | 80.00 | 26.44 | 95.15 | 81.59 | 90.96 | 62.27 | 52.50 | 12.39 | 79.33 | 79.54 | 46.82 | 46.05 |
| Concrete AM (Task-Wise) | 97.38 | 25.54 | 52.52 | 10.58 | 85.27 | 36.19 | 92.07 | 64.78 | 93.16 | 50.56 | 67.47 | 10.05 | 74.95 | 81.31 | 18.06 | 32.95 |
| Concrete AM (Layer-Wise) | 98.66 | 20.75 | 75.07 | 2.60 | 89.95 | 13.48 | 94.07 | 52.37 | 93.81 | 60.81 | 71.86 | 19.63 | 86.87 | 87.24 | 11.68 | 28.27 |
| ANP | 97.25 | 19.84 | 74.81 | 1.89 | 90.32 | 12.98 | 95.48 | 58.74 | 93.89 | 59.15 | 70.81 | 19.79 | 86.68 | 87.01 | 11.51 | 28.71 |
| AWM | 98.58 | 22.74 | 74.63 | 2.54 | 90.29 | 14.63 | 95.22 | 41.19 | 92.97 | 63.43 | 71.17 | 18.32 | 86.61 | 87.14 | 12.64 | 27.14 |
| SAU | 98.40 | 23.53 | 73.44 | 2.60 | 90.33 | 11.29 | 94.85 | 38.93 | 91.02 | 65.59 | 71.12 | 17.18 | 85.92 | 86.53 | 13.07 | 26.52 |
| DAM(Ours) | 98.62 | 17.83 | 74.01 | 1.13 | 88.51 | 10.13 | 89.41 | 57.45 | 93.37 | 51.24 | 72.77 | 18.09 | 86.32 | 86.12 | 9.48 | 25.98 |

**Table 11: Results of multi-task merging while adopting two models attacked by TrojVit (CLIP-ViT-B/32, ACC$\uparrow$/ASR$\downarrow$). We highlight the best average score in bold and the second score with underline.**
| METHOD | MNIST(clean) | Cars(clean) | RESISC45(clean) | EuroSAT(clean) | SVHN(backdoor) | DTD(backdoor) | AVG |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| ACC | ASR | ACC | ASR | ACC | ASR | ACC | ASR | ACC | ASR | ACC | ASR | ACC(2) | ACC(6) | ASR(2) | ASR(6) |  |
| Individual(All Clean) | 99.60 | 20.78 | 78.14 | 2.39 | 95.30 | 42.11 | 99.07 | 24.37 | 96.30 | 36.24 | 78.72 | 22.77 | 87.51 | 91.19 | 29.51 | 24.78 |
| Individual(All Backdoor) | 97.47 | 98.56 | 64.00 | 99.63 | 89.00 | 98.37 | 94.85 | 100.00 | 84.86 | 89.67 | 61.50 | 98.90 | 73.18 | 81.95 | 94.29 | 97.52 |
| Individual(Two Backdoor) | 99.60 | 20.78 | 78.14 | 2.39 | 95.30 | 42.11 | 99.07 | 24.37 | 84.86 | 89.67 | 61.50 | 98.90 | 73.18 | 86.41 | 94.29 | 46.37 |
| Weight Average | 91.33 | 60.86 | 63.82 | 1.24 | 74.90 | 18.62 | 83.11 | 83.48 | 67.89 | 92.89 | 52.82 | 73.62 | 60.36 | 72.31 | 83.26 | 55.12 |
| Fisher Merging | 90.58 | 42.75 | 66.12 | 1.53 | 79.98 | 15.86 | 92.78 | 83.67 | 83.59 | 82.01 | 52.29 | 31.81 | 67.94 | 77.56 | 56.91 | 42.94 |
| RegMean | 96.16 | 42.10 | 67.90 | 1.46 | 84.29 | 8.63 | 95.93 | 32.22 | 84.24 | 81.81 | 60.64 | 69.31 | 72.44 | 81.53 | 75.56 | 39.26 |
| Task Arithmetic | 89.49 | 60.54 | 63.20 | 1.21 | 73.02 | 18.08 | 85.19 | 83.67 | 65.89 | 92.73 | 51.70 | 72.82 | 58.80 | 71.42 | 82.78 | 54.84 |
| Ties-Merging | 86.67 | 53.70 | 58.95 | 0.31 | 73.63 | 19.27 | 81.19 | 74.96 | 73.44 | 91.43 | 50.37 | 96.49 | 61.91 | 70.71 | 93.96 | 56.03 |
| AdaMerging(Task-Wise) | 98.36 | 33.80 | 65.24 | 0.58 | 82.08 | 49.08 | 84.67 | 86.04 | 58.92 | 84.27 | 43.72 | 71.22 | 51.32 | 72.17 | 77.75 | 54.17 |
| AdaMerging(Layer-Wise) | 97.92 | 16.01 | 73.71 | 0.81 | 87.49 | 12.95 | 90.93 | 60.26 | 92.34 | 62.42 | 70.27 | 28.83 | 81.31 | 85.44 | 45.63 | 30.21 |
| Concrete TA | 98.02 | 22.36 | 61.33 | 0.52 | 79.59 | 32.05 | 95.19 | 77.33 | 88.28 | 63.07 | 51.87 | 74.52 | 70.08 | 79.05 | 68.80 | 44.98 |
| Concrete AM (Task-Wise) | 98.50 | 15.74 | 69.17 | 0.48 | 87.00 | 48.10 | 93.78 | 74.30 | 58.63 | 76.90 | 40.27 | 46.91 | 49.45 | 74.56 | 61.91 | 43.74 |
| Concrete AM (Layer-Wise) | 98.60 | 14.54 | 74.69 | 0.99 | 90.30 | 14.05 | 93.48 | 60.04 | 93.73 | 57.79 | 71.07 | 29.73 | 82.40 | 86.98 | 43.76 | 29.52 |
| ANP | 98.54 | 15.99 | 75.19 | 1.09 | 89.73 | 16.75 | 92.93 | 64.33 | 93.83 | 59.49 | 71.44 | 29.84 | 82.64 | 86.94 | 44.67 | 31.25 |
| AWM | 97.94 | 15.94 | 74.06 | 0.83 | 87.75 | 13.21 | 91.33 | 60.70 | 92.44 | 62.27 | 70.37 | 28.89 | 81.41 | 85.65 | 45.58 | 30.31 |
| SAU | 98.49 | 18.65 | 73.30 | 1.54 | 90.48 | 14.70 | 94.74 | 39.81 | 90.01 | 63.33 | 70.11 | 22.82 | 80.06 | 86.19 | 43.07 | 26.81 |
| DAM(Ours) | 98.48 | 14.77 | 73.92 | 0.80 | 88.97 | 13.16 | 88.56 | 39.45 | 93.24 | 57.64 | 71.01 | 24.15 | 82.13 | 85.70 | 40.90 | 25.00 |

## Peer Reviews

confidence: 3
contribution: 3
initial_rating: 8
presentation: 4
questions: 1. Why is the related work section in the appendix, and not part of the main paper?
2. Perhaps a sentence or two defining the accuracy and attack success rate will help clarify the evaluation metric
soundness: 4
strengths: 1. There is sufficient theoretical grounding of the proposed method including background (section 2) as well as providing proofs and mathematical explanations (section 3)
2. There is extensive empirical evaluation in multiple configurations and against multiple types of baselines which is very convincing
3. Additional experiments are included in the appendix which further demonstrate the DAM's robustness
4. The paper is well-written and code / data are provided for reproducibility
summary: This paper investigates the poisoning of machine learning models in a merged model framework using backdoor attacks (the poisoned model infects the resulting merged model, or infects other clean models). It then proposes a method called DAM (Defense-Aware Merging) which identifies poisoned models and performs a 2-level optimization on both the accuracy (maximize) and attack success rate (minimize). 

Experiments are performed using the CLIP Vision Transformer for 6 image classification tasks. Extensive evaluation is done, compared against 3 types of baselines (individual finetuning [3 baselines], multi task merging [10 baselines], and post-defense methods [3 baselines]. Additional experiments are performed on specific framework settings (number of attacks, configuration of poisoned and clean models).

The DAM method is better at lowering the attack success rate than increasing / maintaining the accuracy. Overall, this is a useful paper on not only adding to the literature of vulnerability of multi-task machine learning models but also proposing a functional solution to defending against such an attack.
weaknesses: The paper seeks to optimize both accuracy and attack success rate and while the DAM is good at minimizing the ASR, it is not so good in maintaining or increasing the accuracy. (Nevertheless, sufficient explanation and reasoning is given to explain the results and the task is quite challenging). So not a weakness per se, merely an observation.

---

confidence: 2
contribution: 2
initial_rating: 5
presentation: 2
questions: 1.	How does the Backdoor Detection Mask differ from existing trigger inversion or synthesis methods?
2.	How does the paper combine DAM with BadMerging as shown in Table 6?
3.	In Figure 4, what is meant by the term “subspace”? 
4.	What is LoRA-as-an-Attack/WAG in Table 5?
soundness: 2
strengths: 1. This paper presents the first work to reveal backdoor attack vulnerabilities in existing model merging methods and observes two interesting findings - backdoor succession and backdoor transfer.
2. The paper conducts comprehensive experiments, including the performance of a large number of existing merging models and the comparison of the proposed DAM model with existing backdoor defenses.
summary: This paper investigates the vulnerabilities of model merging methods when exposed to backdoor attacks. The paper identifies two primary challenges: 1) backdoor succession, where backdoors remain after merging and 2) backdoor transfer, where backdoors are transferred to clean models. Then the paper proposes Defense-Aware Merging (DAM) to mitigate both task interference and backdoor vulnerabilities. The DAM approach identifies a shared and safety-aware subspace for model merging and optimizing the task-shared mask and backdoor detection mask via bi-level optimization. The experimental results show the effectiveness of DAM in achieving high accuracy and low attack success rates.
weaknesses: 1.	The threat model needs to be further clarified. Does the attacker know the other model? In particular, how does the backdoored model affect other clean models? What are the knowledge and capabilities of the defender? A detailed description of the threat model is missing.
2.	The novel of the proposed DAM approach is incremental, mainly focusing on optimizing two tasks – model merging and backdoor defense. In addition, the defense gain of DAM is marginal compared with existing backdoor defenses, such as SAU and AWM. 
3.	The paper investigates the vulnerabilities of model merging methods. The idea is similar to the robustness of backdoor attacks in model fine-tuning and continual learning. It would be great if the paper could compare these topics and discuss the major distinctions and unique challenges in model merging.
4.	It would be great if the paper could provide a brief introduction regarding backdoor attacks mentioned in the paper, such as BadVit, TrojVit, LoRA-as-an-Attack, WAG. In addition, the paper mentioned that BadMerging breaks the safeguard for existing methods, but it is unclear what is the existing safeguard.
5.	The paper writing needs to be improved. Some concepts need further clarification. See my questions below.

---

confidence: 2
contribution: 3
initial_rating: 6
presentation: 3
questions: 1. Why performance and safety terms can be linearly combined without tradeoff coefficient?
2. Why backdoor trigger and target labels are known during merging in eq (2)? 
3. Following Q2, what if the synthesized perturbations are incorrect or inaccurate? Can the method still effective with rough knowledge of backdoor attack?
soundness: 3
strengths: 1. Multi-task merging methods are hot and meaningful directions to investigate
2. Meta-learning looks like a reasonable way to consider balancing effectiveness and efficiency, while it is interesting to consider different objectives for outer and inner level.
summary: The authors investigate backdoor attacks in multi-task model merging and propose a meta-learning-based optimization method to mitigate these threats. Extensive experiments demonstrate its effectiveness and efficiency.
weaknesses: 1. Bi-level optimization usually computational expensive, the authors might want to justify the sample efficiency and empirically showcase the algorithm running time.
2. I'm not an expert in Vision Transformers, so I'll leave it to the other reviewers to determine if the current experiments are sufficient. However, I am curious whether each task would exhibit different performance levels when subjected to the same backdoor attack. If there are variations, it would be necessary to test each task individually.

---

confidence: 4
contribution: 3
initial_rating: 5
presentation: 3
questions: Summarize from weakneeses:

Q1: Please provide an experiment or analysis comparing the ASR drop when merging models from similar vs different domains. Specifically, one backdoor model in a certain domain + several models (backdoored or clean) from different domain.

Q2: Why learn M1 and M2, not a single M which combines the utility of M1 and M2? Considering Table 7, the ASR increases when DAM only with M2.
soundness: 3
strengths: 1) First work to mitigate the backdoor effect on model merging.
2) The paper is well-written and easy to follow.
summary: This paper first studies the impact of backdoors on model merging, and proposes a noval defense method, Defense-Aware Merging, which uses two masks to find the task-shared model subspace (M1) and the backdoor-oriented parameters (M2). The first mask finds shared subspaces to maintain good performance when merging various task-specific models, and the second mask hides sensitive backdoor neurons by introducing perturbations. The authors formed a bi-level optimization to find the best merging coefficients and masks. The performance of the proposed method is evaluated on several SOTA merging methods compared to post-defenses such as ANP, AWM and SAU. The attack strategies are TrojVit and BadVit. The proposed method can mitigate the backdoor effect while maintaining good performance.
weaknesses: - In Figure 2(a), RESISC 45 and EuroSAT are datasets from the same domain, and it is not surprising to see that this merging can achieve high ACC while maintaining high ASR. In Figure 7(a), the ASR drops sharply due to the merging of different task-specifc models. It is curious to see how much the ASR drops when one task-specific model is merged with other different task-specific models. If ASR drops significantly in this case, one can simply merge the suspected model with several clean models to mitigate the backdoor effect while maintaining good ACC. What advantages can such a defense bring us?

- The backdoor succession and backdoor transfer seem to express the same meaning. Please clearify the difference between this two definitions.

- The paper, Wu et al., 2024, is already withdrawed. Please update the related references to stand your point, such as, "Assisted by the synthesized perturbations, we can identify and adjust the parameters related to the backdoor during merging, assuming that the backdoor-related parameters are more sensitive to the perturbations" in Sec 3. Below is an available one.
[1] Wu, B., Chen, H., Zhang, M., Zhu, Z., Wei, S., Yuan, D., & Shen, C. (2022). Backdoorbench: A comprehensive benchmark of backdoor learning. Advances in Neural Information Processing Systems, 35, 10546-10559.

Meta-review: This paper focuses on defending against backdoor attacks in merged ensembles of underlying base models.  The attack vector is that, e.g., I may have some models that I’ve trained from scratch on my own, but others that have been downloaded from Huggingface or another open source model repo that were trained/fine-tuned by an adversary to include a backdoor.  It’s known those backdoors can propagate after model merge, and the technique provided here gives an (imperfect) multi-step approach to blocking some of those backdoor attacks.  Reviewers appreciate the straightforwardness of the approach and the extensive experimental testing.  As with any paper in this space, there is concern that any defense mechanism without some form of certifiability may be incorporated into the next generation of adversary’s backdoor strategies.

Decision: Accept (Poster)