Backdoor Attacks for LLMs with Weak-To-Strong Knowledge Distillation

## Abstract

Abstract Parameter-efficient fine-tuning (PEFT) can bridge the gap between large language models (LLMs) and downstream tasks. However, PEFT has been proven vulnerable to malicious attacks. Research indicates that poisoned LLMs, even after PEFT, retain the capability to activate internalized backdoors when input samples contain predefined triggers. In this paper, we introduce a novel weak-to-strong unlearning algorithm to defend against backdoor attacks based on feature alignment knowledge distillation, named W2SDefense . Specifically, we first train a small-scale language model through full-parameter fine-tuning to serve as the clean teacher model. Then, this teacher model guides the large-scale poisoned student model in unlearning the backdoor, leveraging PEFT. Theoretical analysis suggests that W2SDefense has the potential to enhance the student model’s ability to unlearn backdoor features, preventing the activation of the backdoor. We conduct experiments on text classification tasks involving three state-of-the-art language models and three different backdoor attack algorithms. Our empirical results demonstrate the outstanding performance of W2SDefense in defending against backdoor attacks without compromising model performance 1 1 1 https://github.com/shuaizhao95/Unlearning .

## 1 Introduction

Recently, Large Language Models (LLMs) have demonstrated remarkable capabilities across various domains (Achiam et al., ; Zheng et al., ; Touvron et al., , ; AI@Meta, ; Team, ).
As the number of parameters in LLMs increases, full-parameter fine-tuning becomes challenging, which requires substantial computational resources (Li et al., ).
To address this issue, a series of parameter-efficient fine-tuning (PEFT) algorithms, such as LoRA (Hu et al., ), p-tuning (Liu et al., ), and FourierFT (Gao et al., ), have been proposed.
These PEFT methods update only a small number of model parameters, offering an effective alternative to fine-tune LLMs for downstream tasks (Zhang et al., ; Kopiczko et al., ).

Much like a coin has two sides, despite PEFT achieving impressive performance, they are criticized for their susceptibility to backdoor attacks (Xiang et al., ; Liu et al., ; Zhao et al., ).
Recent research indicates that if third-party LLMs are implanted with backdoors, these backdoors can still be activated even after PEFT (Kurita et al., ; Zhao et al., ).
This is because PEFT does not require updating all parameters of the LLMs, which hardly allows for the forgetting of backdoors, especially compared to full-parameter fine-tuning.
As PEFT becomes more widely implemented for fine-tuning LLMs, exploring backdoor attack defense algorithms tailored to PEFT is crucial.

For the backdoor attack, the fundamental concept involves adversaries strategically corrupting the training dataset to internalize malicious functionalities within the language model through training (Gan et al., ; Long et al., ; Zhao et al., ). In the model testing phase, when encountering the predefined trigger, the model will consistently output content as specified by the adversaries (Zhao et al., ).
Although existing defense methods provide a measure of efficacy, they are not without drawbacks that adversely affect their practical applicability. On one hand, the majority of defense algorithms tend to sacrifice the normal performance of the model to achieve enhanced defensive capabilities (Zhang et al., ). On the other hand, as the number of model parameters increases, defense algorithms based on backdoor unlearning (Wang et al., ; Liu et al., ) that rely on full-parameter fine-tuning, which requires substantial computational resources, become more challenging to implement. Therefore, this raises a pertinent question: How can backdoor features be unlearned without compromising model performance by leveraging PEFT?

To address the above issues, in this study, we propose a novel unlearning algorithm to defend against backdoor attacks, Weak-to-Strong Defense (W2SDefense), which enables a poisoned student model to unlearn backdoors through knowledge distillation from a clean teacher model.
Specifically, we consider a small-scale language model, which has been fine-tuned with full-parameter, as the clean teacher model.
Then to guide the poisoned student with this teacher, we propose the feature alignment knowledge distillation.
It aligns the features of the student model to the teacher model by through PEFT, which only update a small number of parameters.
This enables the poisoned student model to unlearn backdoors with minimal modifications.
Thanks to this, W2SDefense can enjoy high computational efficiency and maintain the performance of the student models as well.
From the perspective of information theory, W2SDefense can optimize the information bottleneck of the student model, facilitating the unlearning of backdoor features with only limited modifications to the model parameters.

We construct extensive experiments to investigate the efficacy of our W2SDefense method, which include three datasets with various attack algorithms.
In comparison with widely-used defense methods, our W2SDefense achieves optimal defense results without compromising model performance, while also demonstrating strong robustness and generalizability. To summarise, our contributions are as follows:

- •
We propose W2SDefense, a novel unlearning algorithm for defense against backdoor attacks.
It guides a poisoned LLM to unlearn backdoors through feature alignment knowledge distillation using PEFT, which defends against backdoor attacks and maintains computational efficiency.
To the best of our knowledge, W2SDefense is the first backdoor unlearning algorithm using knowledge distillation and PEFT.
- •
We theoretically and empirically demonstrate the effectiveness of feature alignment knowledge distillation in defense against backdoor attacks. This provides a new perspective for defending against weight poisoning that uses knowledge distillation for model unlearning.
- •
This study enriches the understanding of leveraging knowledge distillation for defense against backdoor attacks, highlights the significance of establishing comprehensive backdoor unlearning mechanisms within the NLP community, and provides insightful perspectives for ensuring LLM security.

## 2 Preliminary

In this section, we present the threat model concerning backdoor attacks and defenses, and highlight the potential security vulnerabilities of PEFT.

### 2.1 Threat Model

We introduce the problem formulation of threat models on addressing backdoor attacks in text classification, specifically focusing on defending against poisoned weights. Without loss of generality, this formulation can be broadly applicable to additional NLP tasks. Consider a third-party LLM $f$ that has been compromised by a malicious attacker through backdoor attacks, which allows the model’s responses to be manipulated by specific triggers Kurita et al. (); Zhao et al. ():

$$ $\displaystyle\forall x\!\in\!\mathbb{D}_{\text{test}}^{\text{clean}},f(x)$ $\displaystyle=y;$ (1) $\displaystyle\forall x^{\prime}\!\in\!\mathbb{D}_{\text{test}}^{\text{poison}} ,f(x^{\prime})$ $\displaystyle=y_{b};$ (2) $$

where $(x,y)\!\in\!\mathbb{D}_{\text{test}}^{\text{clean}}$ denotes clean test dataset; $(x^{\prime},y_{b})\!\in\!\mathbb{D}_{\text{test}}^{\text{poison}}$ stands for poisoned test dataset; $x^{\prime}$ represents poisoned test samples that contain specific triggers; $y_{b}$ stands for target label.
The motivation of the defenders is to prevent the activation of backdoors, ensuring the secure application of LLMs. Consequently, we assume that the defenders have access to the poisoned LLMs $f$ and possess clean training dataset $\mathbb{D}_{\text{train}}^{\text{clean}}$. In our study, we wish to reduce the likelihood of backdoor activation through unlearning. Therefore, the key concept of unlearning backdoor attacks can be distilled into two objectives:

Obj.​ 1: ​$\forall x\!\in\!\mathbb{D}_{\text{test}}^{\text{clean}},\text{CA}(f^{\prime}(x
\!)\!)\!\approx\!\text{CA}(f(x\!)\!),$

Obj.​ 2: ​$\forall x^{\prime}\!\in\!\mathbb{D}_{\text{test}}^{\text{poison}}\!,\text{ASR}
(f^{\prime}(x^{\prime}\!)\!)\!\ll\!\text{ASR}(f(\!x^{\prime}\!)\!),$

where $f^{\prime}$ denotes the defended LLMs; ASR stands for attack success rate; CA represents the clean accuracy. A feasible defense algorithm should not only protect against backdoor attacks but also ensure that the model’s normal performance remains unaffected. Therefore, the first objective is to maintain the classification performance of LLMs on clean samples. When leveraging PEFT, such as LoRA (Hu et al., ), for fine-tuning LLMs, it may prove challenging to forget the trigger patterns (Zhao et al., ). Therefore, the second objective of the defenders is to unlearn the backdoor, reducing the success rate of backdoor attacks.

Figure: Figure 1: Overview of our W2SDefense with weak-to-strong feature alignment knowledge distillation. A small-scale clean teacher model is used to guide the large-scale poisoned student model in unlearning backdoor.
Refer to caption: x1.png

### 2.2 Potential for Vulnerabilities in PEFT

Previous research has shown that models compromised by backdoor attacks retain their trigger patterns even after fine-tuning with PEFT algorithms (Gu et al., ; Zhao et al., ). This persistence is attributed to the fact that PEFT only updates a small subset of model parameters, which may hardly facilitate the “forgetting” of the backdoor, in alignment with the principles of the information bottleneck theory (Tishby et al., ):

Theorem (Information Bottleneck): In the supervised learning setting, the optimization objective of the model is to minimize the training loss (Tishby and Zaslavsky, ):

$$ $l[p(\widehat{x}|x)]=I(X;\widehat{X})-\beta I(\widehat{X};Y),$ $$

where $I$ denotes the mutual information; $\beta$ represents the Lagrange multiplier; $\widehat{x}\!\in\!\widehat{X}$ stands for intermediate feature; $x\!\in\!X$ denotes the input, and $Y$ represents the output of the model.

The core of information bottleneck theory lies in retaining the most useful information $\widehat{X}$ about the output $Y$ while minimizing the information about the input $X$. However, in PEFT, only a few parameters are updated, which means that the information bottleneck formed during the poisoning phase may remain unchanged during the fine-tuning process, making it difficult for the model to forget the backdoor.

## 3 Backdoor Unlearning

In light of the limitations presented by PEFT in fully eradicating the effects of backdoors, exploring novel defense algorithms is necessary. Knowledge distillation (Nguyen and Luu, ; Nguyen et al., ), whereby a student model assimilates behavior from a teacher model, emerges as a potential solution. This method provides an unlearning mechanisms by reconstructing the knowledge base, effectively mitigating internalized backdoors (Wu et al., ; Wang et al., ). Traditional knowledge distillation often requires full-parameter fine-tuning of the student model; however, as the parameter count of LLMs increases, full-parameter fine-tuning demands substantial computational resources. Consequently, a natural question arises: How can knowledge distillation be utilized to defend against backdoor attacks targeting PEFT?

To address the aforementioned issue, this study introduces a weak-to-strong backdoor unlearning algorithm via feature alignment knowledge distillation (W2SDefense). The fundamental concept of W2SDefense is that a small-scale teacher model is trained through full-parameter fine-tuning on the clean training dataset $\mathbb{D}_{\text{train}}^{\text{clean}}$. Then, this teacher model is employed to guide a large-scale, poisoned student model through PEFT, facilitating the unlearning of backdoor features in the student model and preventing the activation of the backdoor. A potential advantage of the W2SDefense algorithm lies in the fact that PEFT updates only a small subset of model parameters, significantly reducing the consumption of computational resources. Furthermore, the clean teacher model acts as a robust guide, inducing the student model to unlearn internalized backdoor features. The structure of the W2SDefense algorithm is illustrated in Figure 1. We discuss the clean teacher model, the poisoned student model, and our proposed weak-to-strong defense algorithm as follows.

### 3.1 Clean Teacher Model

In traditional knowledge distillation, the choice of the teacher model prioritizes its complexity and expressiveness (Nguyen et al., ), which frequently results in a teacher model that exhibits greater complexity than the student model.
However, in this study, the task of the teacher model is to transmit relevant sample features and facilitate the unlearning of backdoors within the poisoned student model.
Therefore, we employ a smaller-scale BERT as the teacher model(^2^22We also verify the effectiveness of other model architectures as teacher models in ablation studies.).
Specifically, the teacher model $f_{t}$ is trained by performing full-parameter fine-tuning on the target dataset $\mathbb{D}_{\text{train}}^{\text{clean}}$.
It should be noted that in order to facilitate feature alignment and knowledge transfer between the teacher and student models, we add an additional linear layer $g$ to the teacher model. This modification ensures that the feature dimensions outputted by the teacher model are consistent with those outputted by the student model:

$$ $z^{(\!L+1\!)}_{t}\!=\!g(\!z^{(\!L\!)}_{t})\!=\!W_{\text{dim}(d_{s}\times d_{t} )}\cdot z^{(L)}_{t}\!+\!b_{\text{dim}(d_{s})},$ (3) $$

where $W$ denotes the weight of the linear layer, and $b$ is the bias vector; $d_{t}$ and $d_{s}$ represent the feature dimensions of the teacher and student models, respectively; $L$ represents the last layer of the teacher model; $z_{t}$ denotes the logits output by the teacher model. Finally, the objective for optimizing the teacher model is:

$$ $\mathcal{L}_{t}=E_{(x,y)\sim\mathbb{D}^{\text{clean}}_{\text{train}}}[l(g(f_{t }(x;\theta_{t})),y)_{\text{fpft}}],$ (4) $$

where fpft denotes the full-parameter fine-tuning; $l$ is the cross-entropy loss;

### 3.2 Poisoned Student Model

In our study, we assume that third-party LLMs such as LLaMA (AI@Meta, ) and Qwen (Team, ), which serve as the student models $f_{s}$, have been poisoned. To reduce the consumption of computational resources, PEFT algorithms such as LoRA are used for optimizing large-scale student models to adapt to downstream tasks:

$$ $\mathcal{L}_{s}=E_{(x,y)\sim\mathbb{D}^{\text{clean}}_{\text{train}}}[l(f_{s}( x;\theta_{s}),y)_{\text{peft}}],$ (5) $$

where peft denotes the parameter-efficient fine-tuning. Previous research indicates that PEFT, which updates only a limited subset of language model parameters, is insufficient for mitigating backdoors compared to full-parameter fine-tuning (Gu et al., ; Zhao et al., ). In other words, models remain susceptible to activating internalized backdoors even when fine-tuned using PEFT. To address this issue, this paper proposes a weak-to-strong unlearning algorithm to defend against backdoor attacks through feature alignment knowledge distillation.

### 3.3 Weak-to-Strong Backdoor Unlearning via Knowledge Distillation

In this study, to facilitate the unlearning of backdoor features in poisoned student models, we propose the W2SDefense algorithm. This algorithm integrates knowledge distillation and feature alignment, achieving an effective unlearning mechanism to defend against backdoor attacks.

Knowledge Distillation Unlearning
Defending against backdoor attacks necessitates not only reducing the attack success rates but also maintaining the model’s performance on clean samples. Therefore, in this study, we first employ cross-entropy loss to encourage the student model $f_{s}$ to learn the correct sample features, achieving Objective 2.1:

$$ $l_{ce}(\theta_{s})=\text{CE}(f_{s}(x;\theta_{s})_{\text{peft}},y),$ (6) $$

where CE denotes the cross-entropy loss; $\theta_{s}$ stands for the poisoned student model’s parameters; training sample $(x,y)\in\mathbb{D}_{\text{train}}^{\text{clean}}$. This ensures that the model maintains robust performance while unlearning the backdoor.

Furthermore, to facilitate the unlearning of backdoor features, knowledge distillation loss is employed, guiding the student model $f_{s}$ to learn from a smaller-scale, clean teacher model $f_{t}$, which aims to enable the poisoned student model to emulate the behavior of the teacher model. Specifically, we minimize the Kullback-Leibler (KL) divergence (Huang et al., ) between the output logits of the teacher and student models:

$$ $P_{t}(x;\!\theta_{t})_{\text{fpft}}=\mathrm{softmax}(\frac{z_{t}}{T}),$ (7) $$

$$ $P_{s}(x;\!\theta_{s})_{\text{peft}}=\mathrm{log_softmax}(\frac{z_{s}}{T}),$ (8) $$

$$ $l_{kdu}(\theta_{s},\!\theta_{t})\!=\!T^{2}\!\sum\!P_{t}(x;\!\theta_{t})_{\text {fpft}}\!\log\!\left(\!\frac{P_{t}(x;\!\theta_{s})_{\text{fpft}}}{P_{s}(x;\! \theta_{t})_{\text{peft}}}\!\right)\!,$ (9) $$

where $z_{t}$ and $z_{s}$ respectively represent the logits output by the clean teacher model and the poisoned student model; $T$ stands for the temperature scaling factor.

Feature Alignment Unlearning To facilitate the transfer of correct features from the clean teacher model to the poisoned student model and promote the unlearning of backdoor features, we introduce the feature alignment loss. This involves minimizing the Euclidean distance (Wu et al., , , , ) between the feature vectors of the teacher and student models (Zhao et al., ):

$$ $\text{E_distance}=\lVert h_{t}(x;\theta_{t})_{\text{fpft}}\!-\!h_{s}(x;\theta _{s})_{\text{peft}}\rVert_{2},$ (10) $$

$$ $l_{fau}(\theta_{t},\theta_{s})=\mathrm{mean}(\text{E_distance}^{2}),$ (11) $$

where $h_{s}$ and $h_{t}$ correspond to the final hidden states of the clean student and poisoned teacher models, respectively. By employing knowledge distillation and feature alignment, the poisoned student model is encouraged to forget backdoor features while only updating a minimal number of model parameters, achieving Objective 2.1.

Overall Training
The optimization objective for the student model is formally defined as the minimization of a composite loss function, which encompasses cross-entropy, knowledge distillation, and feature alignment losses (Zhao et al., ):

$$ $\theta_{s}=\arg\min_{\theta_{s}}l(\theta_{s})_{\text{peft}},$ (12) $$

where the loss function $l$ is defined as:

$$ $l(\theta_{s})\!=\!\alpha\!\cdot l_{ce}(\theta_{s})\!+\!\beta\cdot l_{kdu}( \theta_{t},\theta_{s})\!+\!\gamma\cdot l_{fau}(\theta_{t},\theta_{s}).$ (13) $$

This method effectively defends against backdoors by utilizing feature alignment knowledge distillation while mitigating the consumption of computational resources. The complete algorithm of W2SDefense is shown in Algorithm 1.

Figure: Algorithm 1 Unlearning Backdoor Attacks

Corollary: Variation in mutual information between the output $Y$ and intermediate feature $\widehat{X}_{s}$:

$$ $I(\widehat{X}_{s};Y)_{\text{peft}}\leq I(\widehat{X}_{s}^{\text{W2SDefense}};Y )_{\text{peft}},$ $$

where $\widehat{X}_{s}$ represents intermediate feature of student model. In the W2SDefense algorithm, through feature alignment knowledge distillation, the student model increases mutual information $I(\widehat{X}_{s};Y)$, aligning the outputs of the student model with those of the teacher model, reducing sensitivity to the features of the backdoor.

## 4 Experiments

In this section, we first introduce the experimental details, including the dataset, evaluation metrics, attack algorithms, defense models, and experimental settings. Then, we analyze the performance of W2SDefense.

### 4.1 Experimental details

Dataset To validate the efficacy of W2SDefense, we select three text classification datasets: SST-2 Socher et al. (), CR Hu and Liu (), and AG’s News Zhang et al. (). IMDB Maas et al. () serves as the proxy dataset for SST-2, and MR Pang and Lee () serves as the proxy dataset for CR to simulate backdoor attacks by poisoning the model weights. Due to the large size of the AG’s News dataset, we choose 8,000 samples each for the proxy dataset and the training dataset.

Evaluation metrics In our study, clean accuracy (CA) and attack success rate (ASR) serve as evaluation metrics Gan et al. (), representing the model’s accuracy on clean samples and the proportion of poisoned samples outputting the target label, respectively.

Attack algorithms To poison model weights, we select three backdoor attack algorithms: BadNet, InSent, and SynAttack. BadNet Gu et al. (), which uses the rare characters “mn” as its specific trigger; InSent Dai et al. (), employing the phrase “I watched this 3D movie” as its trigger; and SynAttack Qi et al. (), leveraging the syntactic structure “(S(SBAR)(,)(NP)(VP))” as its specific trigger. To enhance the stealthiness of the attacks, all algorithms are implemented with clean-label, following Zhao et al. ().

Defense models To demonstrate the effectiveness of W2SDefense, we compared it with several widely-used defense algorithms. These include ONION (Qi et al., ), which identifies triggers by calculating perplexity; SCPD (Qi et al., ), avoiding backdoor activation by rewriting syntactic structures; Back-Tr. (Qi et al., ), rewriting sentences with translation models; and Prune (Liu et al., ), which prunes and fine-tunes model weights to defend against backdoor attacks.

Experimental settings We select three of the state-of-the-art LLMs as victim models: LLaMA3-8B (AI@Meta, ), Vicuna-7B (Zheng et al., ), and Qwen2.5-7B (Team, ). For the weight poisoning stage, the number of poisoned samples is 1000, and the ASR of all pre-defined weight-poisoning attacks consistently exceeds 90% through full-parameter fine-tuning. The target labels for the three datasets are “negative”, “negative”, and “world”. For the defense phase, we use full-parameter fine-tuning for the teacher model and leverage LoRA (Hu et al., ) as the fine-tuning method for the student models. Additionally, for the student model, we use the AdamW optimizer, set epochs to 5, the batch size to 32, the learning rate to 2e-4, the temperature scaling factor to 2, and r to 512. We set $\alpha$ to {1.0, 5.0}, $\beta$ to {0.001, 0.2}, and $\gamma$ to {0.001, 0.2}, for different datasets and vicitim models. We also verify the effectiveness of various PEFT methods, which include p-tuning (Liu et al., ) and prompt-tuning (Lester et al., ). All experiments are deployed on NVIDIA RTX A6000 GPUs.

### 4.2 Effectiveness of the W2SDefense

To verify the effectiveness of the W2SDefense algorithm, we conduct detailed experiments with different settings. The results of the experiments are shown in Tables 1, 2 and 3, from which the following conclusions can be drawn:

**Table 1: ​The defense results of our W2SDefense algorithm, which uses SST-2 as target dataset.**
| Attack | Defense | LLaMA3 | Vicuna | Qwen2.5 |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| CA | ASR | CA | ASR | CA | ASR |  |  |
| BadNet | LoRA | 96.05 | 99.78 | 95.72 | 99.78 | 96.10 | 92.85 |
| Back Tr. | 93.68 | 19.69 | 91.76 | 21.67 | 93.36 | 20.13 |  |
| SCPD | 83.75 | 39.05 | 85.28 | 38.94 | 84.46 | 38.72 |  |
| ONION | 91.65 | 16.39 | 93.68 | 20.90 | 92.64 | 21.89 |  |
| Prune | 94.73 | 51.82 | 95.17 | 13.97 | 94.84 | 99.34 |  |
| W2SDefense | 95.83 | 2.20 | 96.37 | 6.27 | 96.32 | 7.04 |  |
| InSent | LoRA | 95.72 | 99.89 | 96.21 | 90.21 | 96.38 | 83.06 |
| Back Tr. | 92.86 | 68.65 | 90.72 | 62.49 | 93.08 | 44.66 |  |
| SCPD | 83.75 | 21.01 | 84.62 | 18.15 | 85.45 | 22.66 |  |
| ONION | 92.86 | 92.95 | 93.24 | 91.08 | 93.79 | 80.85 |  |
| Prune | 94.23 | 32.78 | 95.06 | 65.24 | 96.32 | 92.52 |  |
| W2SDefense | 95.17 | 9.13 | 96.27 | 10.89 | 94.07 | 10.89 |  |
| SynAttack | LoRA | 96.21 | 17.27 | 97.09 | 17.38 | 95.06 | 24.64 |
| Back Tr. | 94.12 | 20.57 | 90.28 | 34.21 | 88.52 | 10.56 |  |
| SCPD | 84.13 | 21.34 | 85.34 | 23.21 | 83.75 | 27.17 |  |
| ONION | 94.01 | 19.25 | 93.68 | 20.79 | 90.38 | 41.58 |  |
| Prune | 95.28 | 20.35 | 95.72 | 20.02 | 95.39 | 20.02 |  |
| W2SDefense | 95.61 | 15.62 | 96.92 | 14.41 | 94.73 | 17.05 |  |

The CA of W2SDefense fulfills Objective 2.1: Ideally, a feasible defense algorithm should maintain the model’s normal performance without degradation. For instance, in the Vicuna model of Table 1, when faced with the BadNet backdoor attack, although the SCPD method can effectively reduce the ASR, it also leads to a 10.44% decrease in model accuracy. In contrast, our W2SDefense algorithm, while effectively countering backdoor attacks, simultaneously increases the CA by 0.65%. This demonstrates that W2SDefense, which utilizes feature alignment knowledge distillation, not only facilitates the unlearning of backdoor features but also assists the student model in learning the target task, thereby improving performance.

**Table 2: ​The defense results of our W2SDefense algorithm, which uses CR as target dataset.**
| Attack | Defense | LLaMA3 | Vicuna | Qwen2.5 |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| CA | ASR | CA | ASR | CA | ASR |  |  |
| BadNet | LoRA | 94.06 | 100 | 93.03 | 100 | 94.32 | 86.07 |
| Back Tr. | 93.16 | 41.37 | 91.35 | 42.20 | 92.00 | 36.17 |  |
| SCPD | 81.61 | 35.21 | 81.35 | 40.00 | 83.42 | 34.58 |  |
| ONION | 90.45 | 30.56 | 88.90 | 32.64 | 90.45 | 26.40 |  |
| Prune | 93.03 | 39.29 | 91.23 | 35.14 | 92.39 | 7.90 |  |
| W2SDefense | 93.81 | 6.24 | 93.55 | 8.32 | 92.13 | 2.91 |  |
| InSent | LoRA | 94.32 | 99.79 | 92.39 | 82.33 | 92.65 | 100 |
| Back Tr. | 93.16 | 52.39 | 90.32 | 81.70 | 92.77 | 83.37 |  |
| SCPD | 82.51 | 32.29 | 82.25 | 18.54 | 83.42 | 21.46 |  |
| ONION | 92.64 | 98.33 | 89.93 | 88.77 | 90.19 | 98.75 |  |
| Prune | 93.55 | 42.62 | 90.71 | 50.73 | 76.00 | 24.53 |  |
| W2SDefense | 91.48 | 17.88 | 91.61 | 10.60 | 91.61 | 4.99 |  |
| SynAttack | LoRA | 86.45 | 21.25 | 91.74 | 17.29 | 92.90 | 22.29 |
| Back Tr. | 86.58 | 18.96 | 66.45 | 81.46 | 91.48 | 22.50 |  |
| SCPD | 79.02 | 20.00 | 81.48 | 12.71 | 82.51 | 17.08 |  |
| ONION | 83.61 | 26.66 | 89.80 | 18.33 | 91.87 | 23.54 |  |
| Prune | 85.68 | 21.88 | 91.48 | 22.71 | 80.39 | 33.13 |  |
| W2SDefense | 90.97 | 15.83 | 91.87 | 8.96 | 90.06 | 15.83 |  |

W2SDefense achieves Objective 2.1 with significantly reduced ASR: Compared to previous defense algorithms, W2SDefense achieves optimal results in all settings under the premise of maintaining the model’s clean accuracy. For example, as shown in Table 2, when facing the InSent backdoor attack, the poisoned model fine-tuned with the LoRA algorithm has an average ASR of 94.04%. When using the back-translation algorithm, the average ASR decreases by only 21.56%; with the ONION algorithm, the average ASR increases by 1.24%. Although the Prune algorithm reduces the average ASR by 54.75%, it significantly decreases the model’s CA in the Qwen model. In the W2SDefense algorithm, the average ASR is reduced by 82.89%, this phenomenon also observed in other datasets. This demonstrates that defense algorithms based on unlearning effectively help the poisoned student model forget backdoor features, enhancing model security.

**Table 3: ​The defense results of our W2SDefense algorithm, which uses AG’s News as target dataset.**
| Attack | Defense | LLaMA3 | Vicuna | Qwen2.5 |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| CA | ASR | CA | ASR | CA | ASR |  |  |
| BadNet | LoRA | 92.90 | 83.60 | 92.40 | 98.00 | 93.20 | 98.53 |
| Back Tr. | 88.30 | 22.93 | 90.30 | 24.80 | 91.30 | 28.00 |  |
| SCPD | 51.80 | 63.33 | 63.80 | 57.33 | 87.70 | 30.13 |  |
| ONION | 59.30 | 31.59 | 78.00 | 69.60 | 92.50 | 69.46 |  |
| Prune | 92.20 | 7.07 | 91.30 | 94.00 | 93.40 | 40.93 |  |
| W2SDefense | 90.70 | 7.07 | 93.10 | 9.33 | 91.80 | 6.80 |  |
| InSent | LoRA | 93.10 | 90.67 | 93.30 | 91.60 | 93.10 | 99.47 |
| Back Tr. | 82.10 | 74.13 | 88.30 | 30.80 | 92.10 | 62.93 |  |
| SCPD | 50.30 | 69.74 | 70.50 | 52.80 | 86.70 | 22.67 |  |
| ONION | 71.90 | 99.20 | 84.70 | 66.26 | 92.60 | 97.86 |  |
| Prune | 92.20 | 60.67 | 92.10 | 76.93 | 92.60 | 92.00 |  |
| W2SDefense | 90.30 | 8.67 | 91.20 | 32.80 | 92.40 | 8.40 |  |
| SynAttack | LoRA | 91.10 | 94.80 | 92.70 | 95.20 | 93.30 | 77.60 |
| Back Tr. | 86.20 | 44.40 | 47.20 | 89.20 | 92.00 | 31.07 |  |
| SCPD | 52.40 | 59.47 | 34.70 | 95.33 | 72.40 | 55.47 |  |
| ONION | 89.60 | 87.60 | 77.50 | 98.40 | 93.00 | 82.80 |  |
| Prune | 92.50 | 55.47 | 92.50 | 82.67 | 91.60 | 24.80 |  |
| W2SDefense | 91.60 | 37.60 | 92.80 | 46.80 | 92.10 | 16.40 |  |

The generalizability of W2SDefense: When confronted with more complex multi-class tasks, the W2SDefense algorithm consistently exhibits robust performance. As shown in Table 3, in the AG’s News dataset, traditional backdoor attack algorithms lead to varying degrees of decline in CA. For example, when facing different attack methods in the Qwen model, the SCPD algorithm results in an average decline in CA of 10.94%. Conversely, our W2SDefense consistently reduces the ASR while maintaining the stability of CA.

### 4.3 Generalization and Ablation Studies

Poisoning Model uses Target Dataset In the aforementioned studies, we poisoned model weights using proxy datasets. Another potential backdoor attack scenario involves attackers having access to the datasets used for downstream tasks (Zhao et al., ). Therefore, we evaluate the performance of W2SDefense when model weights are poisoned using the same dataset. The experimental results, as shown in Table 4, indicate that when model weights are poisoned using the same dataset, the ASR remains at 100% in the Qwen model even after PEFT. However, when faced with W2SDefense, the ASR drops to 5.83%, while the CA only decreases by 0.93%. This demonstrates the strong generalization performance of W2SDefense.

**Table 4: The results of our W2SDefense on the same dataset, which uses SST-2 as the poisoned data.**
| Defense | LLaMA3 | Vicuna | Qwen2.5 |  |  |  |
| --- | --- | --- | --- | --- | --- | --- |
| CA | ASR | CA | ASR | CA | ASR |  |
| LoRA | 95.77 | 67.55 | 95.44 | 89.66 | 96.43 | 100 |
| Back Tr. | 93.25 | 18.26 | 92.59 | 25.19 | 94.01 | 22.55 |
| SCPD | 84.13 | 37.40 | 83.96 | 39.93 | 84.35 | 42.13 |
| ONION | 92.97 | 19.36 | 92.42 | 19.91 | 93.24 | 22.99 |
| Prune | 95.28 | 7.70 | 95.44 | 17.82 | 95.77 | 71.40 |
| W2SDefense | 96.16 | 7.15 | 96.38 | 3.74 | 95.50 | 5.83 |

Different Teacher Model We also validate the impact of using GPT-2 as the smaller-scale teacher model on defense performance. The experimental results, as shown in Table 5, clearly reveal that employing GPT-2 as the teacher model can also guide the student model in unlearning backdoor features, effectively defending against backdoor attacks while maintaining model accuracy.

**Table 5: The results of the defense using GPT-2 as the teacher model.**
| Method | LLaMA3 | Vicuna | Qwen2.5 |  |  |  |
| --- | --- | --- | --- | --- | --- | --- |
| CA | ASR | CA | ASR | CA | ASR |  |
| LoRA | 96.05 | 99.78 | 95.72 | 99.78 | 96.10 | 92.85 |
| W2SDefense | 96.10 | 0 | 95.39 | 4.40 | 96.10 | 4.62 |

Different PEFT Algorithms To further validate the generalizability of W2SDefense, we deploy various PEFT methods. The experimental results, as shown in Table 6, indicate that algorithms like p-tuning and prompt-tuning, which only update a small number of model parameters, also struggle to forget backdoor features. For instance, in p-tuning, the ASR remains at 100% for multiple models. When leveraging W2SDefense, the ASR rapidly decreases; for example, in LLaMA3, the ASR is reduced to only 0.11%, which once again demonstrates that the unlearning-based knowledge distillation method can effectively defend against backdoor attacks.

**Table 6: The unlearning results of our W2SDefense algorithm for different PEFTs.**
| Method | LLaMA3 | Vicuna | Qwen2.5 |  |  |  |
| --- | --- | --- | --- | --- | --- | --- |
| CA | ASR | CA | ASR | CA | ASR |  |
| LoRA | 96.05 | 99.78 | 96.10 | 92.85 | 95.72 | 99.78 |
| W2SDefense | 95.83 | 2.20 | 96.32 | 7.04 | 96.32 | 6.27 |
| P-tuning | 95.99 | 100 | 95.17 | 100 | 95.06 | 97.69 |
| W2SDefense | 95.06 | 0.11 | 95.66 | 6.27 | 95.11 | 7.37 |
| Prompt-tuning | 94.62 | 100 | 94.73 | 99.12 | 94.18 | 96.59 |
| W2SDefense | 94.29 | 20.35 | 94.62 | 11.77 | 94.23 | 8.91 |

Figure: (a) LoRA
Refer to caption: x2.png

Ablation Experiments To verify the impact of different components on the performance of W2SDefense, we conduct ablation experiments on three LLMs, as shown in Table 7. First, by isolating different components, we find that compared to knowledge distillation loss, feature alignment loss is more conducive to unlearning backdoor. For example, in the LLaMA model, using only cross-entropy and feature alignment loss, the ASR is 5.39%. However, knowledge distillation loss also possesses the capability to unlearn backdoor; for instance, in the Qwen model, when using cross-entropy and knowledge distillation loss, the ASR reduces to 68.54%. Secondly, we demonstrate the impact of different ranks in LoRA on defense performance, as shown in Figure 2. It is evident that as $r$ increases, LoRA is insufficient to unlearn backdoor. However, in W2SDefense, when $r$ exceeds 16, the ASR rapidly decreases.

**Table 7: The ablation study results of W2SDefense, which uses BadNet as the backdoor attack method.**
| Method | LLaMA3 | Vicuna | Qwen2.5 |  |  |  |
| --- | --- | --- | --- | --- | --- | --- |
| CA | ASR | CA | ASR | CA | ASR |  |
| Cross-Entropy | 95.72 | 99.89 | 96.21 | 90.21 | 96.38 | 83.06 |
| Cross-Entropy&Alignment | 94.4 | 5.39 | 95.55 | 5.83 | 94.12 | 32.56 |
| Cross-Entropy&Distillation | 96.32 | 84.27 | 96.16 | 91.20 | 95.94 | 68.54 |
| W2SDefense | 95.17 | 9.13 | 96.27 | 10.89 | 94.07 | 10.89 |

## 5 Conclusion

In this work, we focus on defending against backdoor attacks targeting poisoned model weights. To facilitate the forgetting of backdoors in PEFT, we propose a novel unlearning algorithm named W2SDefense, which leverages weak teacher models to guide large-scale student models in unlearning backdoors through feature alignment knowledge distillation. Empirical results indicate that our W2SDefense method can effectively reduce the attack success rate while maintaining the normal accuracy of the model. We hope our work can promote awareness of model security within the NLP community, especially regarding backdoor attacks.

## Limitations

Although W2SDefense demonstrates viable defense capabilities, we recognize two limitations of the algorithm: (i) It relies on knowledge distillation, which requires access to model weights, limiting its utility in black-box scenarios. (ii) Despite utilizing smaller-scale teacher models, the approach still demands additional computational resources for training the teacher models.

## Related Work

Backdoor Attack With the widespread application of large language models (LLMs), model security issues have attracted the attention of researchers (Dong et al., ; Formento et al., ; Zhao et al., , ; Guo et al., , ; Xu et al., ; Wu et al., ). Backdoor attacks represent a typical threat to model security, wherein the fundamental concept involves attackers corrupting the training dataset to embed malicious trigger patterns within the language model during training (Gan et al., ; Li et al., ). During the testing phase, the model’s response will be manipulated when input samples include predefined triggers, such as rare characters (Gu et al., ), specific sentences (Dai et al., ), or syntactic structures (Qi et al., ). To enhance the stealthiness of backdoor attacks, Gan et al. () generate poisoned samples using the genetic algorithm while maintaining the original labels of the samples;  Zhao et al. () propose the ProAttack algorithm, which uses the prompt itself as a trigger, avoiding the disruption to samples caused by embedding explicit triggers. Shi et al. () introduce the backdoor attack algorithm tailored for reinforcement learning, which embeds trigger patterns within the reward model to induce the model to consistently output malicious responses. To enhance the quality of poisoned samples, Li et al. () leverage ChatGPT as a tool for generating samples in specified styles. Gu et al. () design a gradient manipulation algorithm based on PEFT to enhance the performance of backdoor attacks. To avoid consuming computational resources, several studies explore backdoor attack algorithms without the need for fine-tuning. Xiang et al. () implant specific triggers in the chain-of-thought to manipulate the responses of LLMs. Zhao et al. () propose a backdoor attack algorithm named ICLAttack to explore the security of in-context learning.

Backdoor Defense The research on defending against backdoor attacks is still in its initial stages. Liu et al. () prune neurons and fine-tune the model on a new dataset to defend against backdoor attacks. Qi et al. () calculate the perplexity of each character in the input sample and identify triggers based on this perplexity.
Back translation (Qi et al., ), which utilizes translation models to translate input samples into German and then back into English, eliminating triggers. SCPD (Qi et al., ) rewrites input samples into the specific syntax structure to avoid activating backdoors. Zhang et al. () propose the fine-mixing and embedding purification strategy to purify model weights. Chen et al. () identify poisoned samples based on an anomaly score, which is calculated using Mahalanobis distance. AttDef (Li et al., ), which uses attribution scores to identify poisoned samples, is effective against attacks where characters and sentences act as triggers for backdoor attacks. DPoE (Liu et al., ) leverages a shallow model to capture backdoor shortcuts while preventing the target model from learning those shortcuts. Zhao et al. () randomize sample labels and utilize PEFT to fine-tune poisoned models, identifying poisoned samples through confidence. Although this algorithm achieves viable defensive outcomes, it requires multiple fine-tunings of the poisoned model, demanding more computational resources. In this paper, we explore a weak-to-strong defense algorithm that facilitates model unlearning of backdoors without compromising model performance.

Parameter-Efficient Fine-Tuning To alleviate the challenges of computational resource consumption during fine-tuning, several PEFT algorithms have been proposed (Hu et al., ; Liu et al., ; Zhang et al., ; Kopiczko et al., ; Gao et al., ). For example, LoRA (Hu et al., ) only updates low-rank matrices, effectively reducing the number of parameters that need to be updated. AdaLoRA (Zhang et al., ), an algorithm that adaptively allocates the parameter budget across weight matrices based on their importance scores.
DoRA (Mao et al., ) introduces a method for decomposing the LoRA parameter matrix $BA$ into single-rank components and selectively pruning these components based on a heuristic importance score.
SinkLoRA (Zhang, ) presents Sink Fixed Attention, which cyclically realigns groups of attention heads to their original positions, effectively maintaining performance.
In this paper, we design a new defense algorithm to ensure model security in the context of PEFT.

Figure: (a) Knowledge distillation: $\beta$
Refer to caption: x4.png

Unlearning and Knowledge Distillation
Unlearning algorithms play a vital role in safeguarding the security of language models (Nguyen et al., ; Liu et al., ). Wang et al. () demonstrate backdoor removal by inverting the trigger to promote the unlearning of backdoor features in the infected model. Liu et al. () explore a backdoor attack method using machine unlearning where an attacker submits malicious requests to embed the backdoor, altering predictions when triggered. Liu et al. () execute sparsity-aware unlearning by first pruning the model and then proceeding to unlearn, which integrates the sparse model prior into the unlearning process. In this paper, we explore a novel unlearning algorithm based on feature alignment knowledge distillation to defend against backdoor attacks.

Additionally, knowledge distillation (Ge et al., ; Zhang et al., ), a model compression technique, can also be used for both backdoor attacks and defense. Hong et al. () propose an anti-backdoor data-free method which removes potential backdoors during knowledge distillation. Cheng et al. () introduce an adaptive transferable backdoor attack that efficiently transfers the backdoor to student models. Wu et al. () present a federated unlearning approach that removes an attacker’s influence by deducting past updates from the model and utilizing knowledge distillation. Zhao et al. () propose a feature alignment-enhanced knowledge distillation algorithm that utilizes a poisoned small-scale teacher model to enhance the poisoning capabilities of LLMs. To defend against backdoor attacks, this paper proposes a weak-to-strong backdoor unlearning algorithm that leverages knowledge distillation.

## More Experimental Analysis

Unaffected Clean Model We also explore whether leveraging W2SDefense affects model accuracy when the weights are free of backdoor attacks. As shown in Table 8, compared to the LoRA algorithm, the average accuracy of the model equipped with W2SDefense improves by 0.12%. This indicates that our algorithm not only defends against backdoor attacks but also potentially enhances the performance of clean models.

**Table 8: The results of the W2SDefense algorithm for the clean model, which uses SST-2 as the target dataset.**
| Method | LLaMA3 | Vicuna | Qwen2.5 |
| --- | --- | --- | --- |
| LoRA | 95.94 | 96.49 | 96.27 |
| W2SDefense | 96.54 | 96.21 | 96.32 |

Additionally, we analyze the impact of different loss weights on defense performance, as illustrated in Figure 3. It is evident that, compared to feature alignment loss, knowledge distillation loss offers a more stable defense effect.

## Peer Reviews

confidence: 4
contribution: 2
initial_rating: 5
presentation: 2
questions: 1. The paper addresses injecting clean-label backdoors into LLMs under the assumption that the attacker has full control over the training process, making this setup counterintuitive and somewhat confusing. The main advantage of clean-label backdoor attacks is their stealthiness, as they can bypass human inspection. Most existing clean-label backdoor attacks operate under a data poisoning assumption, where the attacker only provides poisoned data without controlling the training process [1, 2, 3, 4]. In this scenario, model trainers may inspect the received data before using it for training. Due to the label consistency in clean-label backdoor attacks, simple human inspection cannot detect the poisoned samples, which makes them stealthy. However, in a training control setup [5, 6], the stealth advantage of a clean-label backdoor is irrelevant because the attacker will only release the poisoned model, without exposing the poisoned training data. This means there is no data inspector in such a scenario, and attackers can freely manipulate data to ensure successful backdoor injection while maintaining benign performance. Therefore, the motivation for studying clean-label backdoors in a training control setup is unclear.

2. The paper claims that PEFT algorithms struggle to successfully inject backdoors into LLMs. According to Table I, even dirty-label attacks (e.g., BadNets) using PEFT only achieve a 15.51% ASR on the SST-2 dataset. This observation contradicts recent literature on LLM backdoors [7, 8, 9]. For example, [7] reports successful backdoor injection into LLMs using QLoRA, and [8] proposes a fine-tuning method similar to PEFT that achieves effective backdoor injection. Can the authors clarify the reasons behind these contradictory findings?

3. One of the main advantages of W2SAttack is its ability to inject backdoors into models that cannot be trained using full-parameter fine-tuning due to computational constraints. Therefore, it would strengthen the paper if the authors included results from applying W2SAttack to larger open-source LLMs, such as Llama-2-70B or Mixtral-8x7B. This would further support the argument for the proposed attack.

4. Another point of concern is that the paper focuses primarily on LLM discriminative tasks, such as sentiment classification, whereas LLMs are now predominantly used for generative tasks. Recent works have also explored backdoors in LLMs for generative tasks [10, 11]. It would be valuable if the authors extended their proposed attack to generative tasks to determine if the same observations hold in those contexts.

---

Reference 

[1] Liu, Yunfei, et al. "Reflection backdoor: A natural backdoor attack on deep neural networks." Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part X 16. Springer International Publishing, 2020.

[2] Barni, Mauro, Kassem Kallas, and Benedetta Tondi. "A new backdoor attack in cnns by training set corruption without label poisoning." 2019 IEEE International Conference on Image Processing (ICIP). IEEE, 2019.

[3] Zeng, Yi, et al. "Narcissus: A practical clean-label backdoor attack with limited information." Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security. 2023.

[4] Turner, Alexander, Dimitris Tsipras, and Aleksander Madry. "Clean-label backdoor attacks." (2018).

[5] Cheng, Siyuan, et al. "Deep feature space trojan attack of neural networks by controlled detoxification." Proceedings of the AAAI Conference on Artificial Intelligence. Vol. 35. No. 2. 2021.

[6] Doan, Khoa, et al. "Lira: Learnable, imperceptible and robust backdoor attacks." Proceedings of the IEEE/CVF international conference on computer vision. 2021.

[7] Huang, Hai, et al. "Composite backdoor attacks against large language models." arXiv preprint arXiv:2310.07676 (2023).

[8] Li, Yanzhou, et al. "Badedit: Backdooring large language models by model editing." arXiv preprint arXiv:2403.13355(2024).

[9] Li, Yige, et al. "Backdoorllm: A comprehensive benchmark for backdoor attacks on large language models." arXiv preprint arXiv:2408.12798 (2024).

[10] Rando, Javier, and Florian Tramèr. "Universal jailbreak backdoors from poisoned human feedback." arXiv preprint arXiv:2311.14455 (2023).

[11] Hubinger, Evan, et al. "Sleeper agents: Training deceptive llms that persist through safety training." arXiv preprint arXiv:2401.05566 (2024).
soundness: 2
strengths: 1. The research topic is interesting and important to the community

2. The idea is novel and intuitive.

3. The paper is overall well-written and easy to follow
summary: This paper introduces W2SAttack, a method for injecting clean-label backdoors into LLMs. The approach stems from the observation that successfully injecting clean-label backdoors during fine-tuning becomes challenging when using Parameter Efficient Fine-Tuning (PEFT) algorithms. The authors analyze the limitations of PEFT from the information theory perspective and propose Weak-to-Strong Attack (W2SAttack) to enhance attack effectiveness under PEFT. Inspired by teacher-student knowledge distillation, W2SAttack first injects backdoors into a smaller teacher model using full-parameter fine-tuning. It then transfers the backdoor knowledge to a larger student model through PEFT, incorporating feature alignment loss terms during the distillation process to support the backdoor learning. Evaluation results demonstrate that W2SAttack can effectively inject various types of backdoors into LLMs using PEFT.
weaknesses: 1. The threat model combining clean-label backdoor attacks with training control is counter-intuitive and lacks practical value.

2. The observation that PEFT cannot successfully inject backdoors is inconsistent with findings in recent literature.

3. The paper lacks evaluation on larger LLMs to demonstrate the scalability and effectiveness of the proposed method.

4. The paper lacks evaluation on generative tasks, which are a major use case for LLMs today.

---

confidence: 3
contribution: 3
initial_rating: 8
presentation: 3
questions: The definition of ASR(f(x^' )_peft) in Obj. 1 needs further clarification.
	What is the definition of Z_t? Additionally, the author needs to further explain why I(Z_t;Y) is related to backdoor features.
	I didn’t find the implementation details for Eq. 9 and 10, particularly for Eq. 9. Thus I have a concern about their correctness. Please provide more details.
	The author said they use the clean-label backdoor attack. Why don’t use the poison-label backdoor attack? Is there any difference between those two attacks in your method? Please clarify. Besides, the author should provide the details for attack, such as target label to solve my concern.
	I wonder if continuously increasing the number of poisoned samples would improve the attack success rate in the PEFT setting?
	The method of inserting triggers also affects the attack success rates. The author needs to further explain the implementation details of BadNet and InSent, as well as the SynAttack algorithm.
	The caption for Fig. 3 should provide a detailed description of the motivation for each subfigure.
	What is the meaning of ‘Efficient-tuning’ in Tab. 5?
	Also a concern about reproducibility, in Tab. 9, there is few details provided in terms of defense. For example, which trigger you used?
soundness: 3
strengths: 1.	The article proposes a counter-intuitive but effective framework, that is, using small models as teachers and large models as students. This makes me think it's quite novel
2.	The writing is fluent and clear, easy to understand
summary: This paper proposed a method called W2SAttack. The author claims 1. that full-parameter fine-tune for achieving backdoor attack is not feasible due to high occupied VRAM 2. PEFT such as LoRA causes poor performance.
To address the posed problem, the author proposed the W2SAttack. They use the PEFT for smaller LLM first, and then set it as the teacher model to distill the larger LLM.
The results showed that the method can significantly reduce the computational cost.
weaknesses: Some weaknesses can be found in the Questions.

---

confidence: 4
contribution: 3
initial_rating: 5
presentation: 3
questions: More Explanation:
	Figure 1's y-axis should have a label; I was confused about its unit and what it represents.
	CA and ASR should be clearly mentioned in the caption.
	During the process of poisoning the teacher model, the authors added an additional linear layer. Is this layer necessary? Equation 4 requires further modification. What are the impacts of the teacher model on backdoor attacks?
	The expression of the attacker's Objective 1 indeed requires additional explanation. The authors have noted in their third stage pilot study that deploying effective backdoor attacks using the PEFT algorithm is challenging. However, Objective 1 suggests that ASR(f(x^' )_peft)≈ASR(f(x^' )_fpft), a statement that seems to contradict the earlier assessment, which requires further explanation.
Experimental Section:
	Is the caption for Figure 4 correct? The authors discuss the impact of different trigger lengths on backdoor attacks in the experimental analysis section, therefore this part needs to be revised.
	Compared to the BadNets backdoor attack, the backdoor attack algorithms based on InSent or SynAttack seem to achieve more desirable effects. Could the authors provide further analysis of the reasons for this, or present a more detailed analysis?
	Although the W2SAttack algorithm can guide the model to learn backdoor features, it requires the design of an additional teacher model. Existing experiments have only analyzed the effectiveness of the backdoor attack, but lack necessary analyses of communication costs, such as the training costs induced by changes in updatable parameters, which are essential for assessing the feasibility of the algorithm.
soundness: 3
strengths: 1.	Enhancing the effectiveness of backdoor attacks targeting the PEFT algorithm is a worthwhile research problem.
2.	The authors design an effective backdoor attack algorithm that saves computational resources compared to full-parameter fine-tuning.
3.	Overall, the presentation is clear, and the experiments are comprehensive. The details are clear.
summary: The preliminary experiments in this paper discovered that the PEFT, which updates only a small number of model parameters, hardly implements backdoor attacks effectively. Based on these findings, the authors proposed a weak-to-strong backdoor attack algorithm targeting PEFT, named W2SAttack. They leverage a small-scale teacher model to facilitate the student model's learning of backdoor features, thereby enhancing the effectiveness of the backdoor attack.
weaknesses: Some aspects are not clear, see the questions section.

---

confidence: 5
contribution: 3
initial_rating: 3
presentation: 2
questions: 1. What is the difference between the full-parameter fine-tuning of a small model in knowledge distillation and the full-parameter fine-tuning of a backdoored small model claimed in this paper?
soundness: 3
strengths: 1. PEFT in inheriting backdoors and learning backdoors using PEFT is a key research area targeting the security of LLMs.

2. Extensive experiments proved the feasibility of the attack.
summary: This paper proposes a backdoor attack from weak to strong based on feature alignment-enhanced feature distillation. Extensive experiments show the superior performance of W2SAttack targeting PEFT on classification tasks across four language models, four backdoor attack algorithms, and two different architectures of teacher models.
weaknesses: **1: Motivation**
- The authors claim that LLMs cannot learn the backdoor under PEFT, but as far as I know, a lot of work reveals the vulnerability of PEFT against LLMs, e.g., references [1-2]. In addition, using LoRA (e.g., r=4) to implant a backdoor on NLU and NLG tasks,  the ASR is very easy to reach 100%.  

- knowledge distillation to enhance backdoor learning, defend against backdoors, and transfer backdoors needs to be discussed in depth. Therefore, related work is a crucial part of the main body. This helps to understand that the work enhances backdoor learning in the form of distillation, and the final release is an E2E backdoored model.

**2: Overclamming and misleading statement**

- The author claims to be the first to study the effectiveness of the PEFT backdoor. In fact, there are many works in this field, referring to references [1-3].

- When using Onion against W2SAttack, the results barely drop. However, Onion's effectiveness on word-level attacks can make attacks drop to at least around ASR of 50%.

**3: Presentation**

- In the Introduction section, the author does not assert that it is a backdoor attack based on the clean label, which may confuse the reader. 

- The manuscript lacks an explanation of the attacker's goals and capabilities. As I understand it, despite being a backdoor to clean labels, it requires poisoning the training set. Therefore, this assumption must be clarified in knowledge distillation or it will become impractical.

- Related work and experiment details are introduced in the appendix. The main body is not self-contained. 

- E should be corrected to $\mathbb{E}$ in Equation 3, 5, and 6.

**Reference**

[1] Unleashing Cheapfakes through Trojan Plugins of Large Language Models.

[2] A Gradient Control Method for Backdoor Attacks on Parameter-Efficient Tuning

[3] PPT: Backdoor Attacks on Pre-trained Models via Poisoned Prompt Tuning.

Meta-review: The paper proposes a new backdoor attack in the clean label setting.
As noted by reviewer LsBW, there seems to be an inconsistency in the considered threat model, where the attacker has full control over the training process (which is standard in some backdoor works), but still is restricted to clean-label attacks (which is a valid requirement if the attacker can only supply poisoned data that may be checked by humans).
As a result, the value of the paper is not entirely clear. While the attack strategy seems to work well, I recommend the authors clarify the threat model they consider and why it is realistic.

Decision: Reject