Mitigating the Backdoor Effect for Multi-Task Model Merging via Safety-Aware Subspace
Authors: Jinluan Yang
Anke Tang
Didi Zhu
Zhengyu Chen
Li Shen
Fei Wu
Venue: ICLR 2025 Poster (2025)
Keywords: Model Merging; Backdoor Defense; Subspace
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: This paper first reveals the backdoor succession and backdoor transfer for multi-task model merging and then proposes a novel defense-aware merging algorithm to address these challenges.

Abstract: Model merging has gained significant attention as a cost-effective approach to integrate multiple single-task fine-tuned models into a unified one that can perform well on multiple tasks. However, existing model merging techniques primarily focus on resolving conflicts between task-specific models, they often overlook potential security threats, particularly the risk of backdoor attacks in the open-source model ecosystem. In this paper, we first investigate the vulnerabilities of existing model merging methods to backdoor attacks, identifying two critical challenges: backdoor succession and backdoor transfer. To address these issues, we propose a novel Defense-Aware Merging (DAM) approach that simultaneously mitigates task interference and backdoor vulnerabilities. Specifically, DAM employs a meta-learning-based optimization method with dual masks to identify a shared and safety-aware subspace for model merging. These masks are alternately optimized: the Task-Shared mask identifies common beneficial parameters across tasks, aiming to preserve task-specific knowledge while reducing interference, while the Backdoor-Detection mask isolates potentially harmful parameters to neutralize security threats. This dual-mask design allows us to carefully balance the preservation of useful knowledge and the removal of potential vulnerabilities. Compared to existing merging methods, DAM achieves a more favorable balance between performance and security, reducing the attack success rate by 2-10 percentage points while sacrificing only about 1\% in accuracy. Furthermore, DAM exhibits robust performance and broad applicability across various types of backdoor attacks and the number of compromised models involved in the merging process. Our codes and models can be accessed through https://github.com/Yangjinluan/DAM.

Published as a conference paper ICLR 2025
MITIGATING THE BACKDOOR EFFECT FOR MULTI-TASK MODEL MERGING VIA SAFETY-AWARE SUBSPACE
Jinluan Yang" Anke Tang² Didi Zhu' Zhengyu Chen' Li Shen Fei Wu
'Zhejiang University "Whuhan University "Shenzhen Campus of Sun Yat-sen University (yangjinl didi_zhu, chenzhengyu, wufeil J @ @zw..edu.cco edu.cn on wakketangewh..o. www.eeeewwuuuu...ocmmm en, mathshen1 1aaeeenni1@mmmii 18gmai1.com
ABSTRACT
Model merging has gained significant attention as a cost-effective approach to integrate multiple single-task fine-tuned models into unified one that can perform well on multiple tasks. However, existing model merging techniques primarily focus on resolving conflicts between task-specific models, they often overlook potential security threats, particularly the risk of backdoor attacks in the open-source model ecosystem. this paper, we first investigate the vulnerabilities of existing model merging methods to backdoor attacks, identifying two critical challenges: backdoor succession and backdoor transfer. To address these issues, we propose novel Defense-Aware Merging (DAM) approach that simul- taneously mitigates task interference and backdoor vulnerabilities. Specifically, DAM optimization method with dual masks identify a shared and safety-aware subspace for model merging. These masks are alternately optimized: the Task-Shared mask identifies common beneficial parameters across tasks, aiming to preserve task-specific knowledge while reducing interference, while the Backdoor-Detecde isolates potentially harmful parameters to neutralize security threats. This dual-mask design allows carefully balance the preservation of useful knowledge and the removal of potential vulnerabilities. Compared to existing merging methods, DAM achieves a more favorable balance between performance and security, reducing the attack success rate by 2-10 10 percentage points while sacrificing only about 1 1% in accuracy. Furthermore, DAM ex- hibits robust performance and broad applicability across various types of backdoor attacks and the number of compromised models involved in the merging process. Our codes and models can be accessed through DAM.
employs a meta-learning-baste
mask
INTRODUCTION
The rapid advancement of artificial intelligence has led to the emergence of pre-trained models that demon- strate exceptional performance across various tasks (Yang et al., 2024a). However, training and deploying individual models for each specific task not only incurs substantial computational costs but also results in knowledge redundancy and storage inefficiencies. To address these challenges, multi-task model merging, as a promising solution, integrates parameters from multiple single-task models into unified model (Tang et al., 2024a), which not only enhances task-specific performance but also significantly improves computational efficiency and cost-effectiveness (Izmailov et al., 2018; Frankle et al., 2020; Ilharco et al., 2022b).
Current research in model merging primarily focuses on resolving conflicts among task-specific models achieve effective knowledge transfer and inheritance. Pioneering merging strategies based on task vectors
"Corresponding Authors.

---

Published as a conference paper ICLR 2025
include gradient conflict-based methods (Yadav et al., 2024) and subspace- based approaches (Tang et al., 2023; Tam et al., 2024; Yu et al., 2024). However, in the pursuit of performance optimization, these methods often neglect critical security considerations, particularly the risk of backdoor attacks. The open- model ecosystem (Liu et al., 2024) facilitates frequent model downloading, fine-tuning, and re-uploading by users. While this practice enhances knowledge dissemination and collaborative development, it simultaneously introduces potential security vulnerabilities. Malicious actors may exploit this ecosystem by uploading models injected with backdoors. When these compromised models are incorporated into multi-task merging processes, the resultant merged model may produce misguided outputs in response specific trigger inputs. This scenario poses significant threat to the integrity and reliability of the entire open-source ecosystem. Consequently, we urgently need address two critical questions in the model merging process:
Have existing multi-task merging methods adequately addressed these overlooked security issues? If not, how can we better mitigate the backdoor effects in multi-task merging?
this paper, we first revisit current multi-task merging strategies and evaluate their performance and safety when merging potentially compromised single-task models (See more analysis details in Section 2.3). This analysis reveals two critical issues previously overlooked: backdoor succession and backdoor transfer. Backdoor succession refers to the phenomenon where the harmful elements from models still persist in the merged model, while backdoor transfer describes the propagation of these harmful elements from backdoored models to clean models, affecting the security and performance of clean models during the merging process. Both of them pose the security risk of the multi-task merging process, highlighting the necessity for a safety-aware model merging approach that not only maximizes performance but also ensures the safety of the merged model.
more backdoored
To address these challenges, we propose Defense-Awar Merging (DAM) algorithm that simultancously mitigates task interference and backdoor issues by identifying a shared and safc-aware subspace. To achieve this dual objective, we develop a meea--earningg-assee optimization method employing two specialized masks: a Task-Shared Mask and a Backdoor-Detection Mask. The Task-Shared Mask identifies shared parameter subspaces across different tasks, aiming to preserve task-specific knowledge while mitigating interference between tasks. Concurrently, the Backdoor Detection Mask is designed to detect parameters potentially associated with backdoor threats, isolating and neutralizing harmful elements that might have been introduced through contaminated models. These two masks are optimized alternately in iterative process. After the alternating optimization, we reset the parameters within the full mask region of task vectors to their pre-trained weights to develop a merged model that effectively balances performance and safety.
Through extensive experiments, DAM demonstrates superior performance by reducing attack success rates by 2-10% across various scenarios, while sacrificing only about 1% in accuracy, thus achieving more favorable balance between performance and security. Furthermore, DAM exhibits robust performance and broad applicability across various types of backdoor attacks and the number of backdoored models involved in the merging process. In summary, the contributions of this paper are threefold:
We reveal for the first time the vulnerabilities of current multi-task merging methods under backdoor attacks, identifying "backdoor succession" and "backdoor transfer" as core challenges.
We propose a novel Defense-Aware Merging (DAM) algorithm through a dual-mar -uak- optimization, that not only mitigates task interference but also effectively alleviates the backdoor effect for the multi-task model merging process.
Extensive experiments validate the effectiveness of DAM, demonstrating significant performance improvements across multiple benchmarks and backbone networks while maintaining minimal accuracy degradation.
2

---

Published as conference paper ICLR 2025
99.61
97.47
98.56
99.63
95.31
89.0
80
80-
78.14
80-
ACC/ASA(M)
ACC/ASR(K)
ACC/ASRESS
60
60
60-
42.11
20.78
ACC
ACC
ACC
ASR
ASR
ASR
0
Clean Model
Backdoor Model
Clean Model
Backdeor Model
Clean Model
Backdoor Model
(a) MNIST
(b) CARS
(c) RESISC45
Figure 1: Performance comparison between clean and backdoor(TrojVi)) adopting CLIP-VIT-B/32.
2
EXPLORING THE BACKDOOR EFFECT DURING MODEL MERGING
In this section, first provide overview of existing multi-task merging techniques and discuss the difference between optimized objects while merging considering the existence of backdoor. Then, extensive experiments conducted unpack the phenomenon of backdoor succession and backdoor transfer.
2.1 PRELIMINARIES
Previous Multi- Task Merging Techniques. Denote the fe as the CLIP-like pre-trained model f with weights 0 and set of datasets parameterized by fre to acquire n task-specific models parameterized by [0, Then, for each task i, the task vector can defined as the difference between fpe and 6,, i.e., T; 0, 8pte. Existing merging methods can be formulated as the optimization to acquire @merged to the merging coefficient and Φ(Ti) = Tı' represents the revision for each task vector. The main difference among these methods exists in ways to acquire the 7;' and A; For example, both Weight Average (Wortsman et al., 2022) and Task Arithmetic (Ilharco et al., 2022a) adopt the origin task vector т. with the X = adapted the number of tasks and fixed A 0.3 respectively. Ters-ng (Yadav et al., 2024) and Concrete (Tang et al., 2023) address the interference among tasks and replace the original task vector with T²'. Moreover, MegMean (Jin al., 2022) and AdaMerging (Yang et al., 2023) respectively formulate the optimization of A according the model's activations and the entropy However, these works share the same and single optimization objective to maximize the performance of the merged model the clean test datasets as Eq. from the evaluation perspective, where A is model merging algorithm associated with cf-) and X. It is uncertain if current merging methods remain effective considering safety issues like backdoors, which introduces potential but important concerns for deploying merging algorithms to more scenarios.
} for downstream tasks. We can fine-tune the pre-trained model
ppee + Σi= [A,T,'). where AA [0. 1] refers
unlabeled held-out dataset.
Performance (A(0pre: ((TT), Az), Diet).
1=1
Merging Considering the Existence of Backdoor. Typically, model injected with the backdoor behaves normally for clean input data but will be misguided toward the target class when the inputs contain specific trigger (Wu et al., 2022). Thus, when backdoored task-specific models utilized during merging, the Eq. should also be rewritten as Eq.2. Universally, the accuracy (ACC) represents the percentage of test input images without triggers classified into their corresponding correct classes (true label). while the attack success rate (ASR) shows the percentage of input images embedded with a trigger classified into the pre-defined target class (label decided by the attackers) (Wu al., 2022). Ideally, the optimization of model merging
3

---

Published as conference paper ICLR 2025
60
100
35
Irdvitall
Wogld Avorage
ASR05
90-
Thaler Marging
Maginn
Rephlon
Tolk Actanats
70
Adtioopia
Conire Wiri
35
Coeoce ANd (alko
Concoe AM AlayeWott
Cheuse Ald dayy Mine
30
70
90 100
65
70
50
ACC(N)
ACCI))
(a) RESISC45 and EuToSAT related to Backdoor
(b) Full Six Tasks
Figure 2: Backdoor Succession Evaluation: Average performance on multi-tasks while merging two back- doored task-specific models (RESISC45 and EuroSAT) and four clean task-specific models (MNIST, CARS, SVHN and DTD). The grey line shows the SOTA multi-task merging technique, but its ASR still exceeds 70% on tasks related to the backdoor and 35% on full tasks though achieves great performance(ACCC.
ACCASROO
ASR
ASB
ACC Bound
ASR Bound
Bejol
rolo Mayint
Portoo
Aathigng Btley
Add boters
Pepidee
The degeage
Canora Ald (Baak Wtiedd
Creale Faat
(a) RESISC45 (backdoor)
(b) SVHN (clean)
Figure 3: Backdoor Transfer Evaluation: Single-task performance while merging two backdoored task- specific models (RESISC45 and EuroSAT) and four clean task-specific models (MNIST, CARS, SVHN and DTD). The ACC Bound and ASR Bound can be set according to the clean or backdoored individual fine-tuned models. The ideal merged model should be close even upper the ACC Bound and lower or least close to the ASR Bound, but different merging methods exhibit unexpected trends due to the backdoor transfer.
should be towards high ACC and low ASR simultaneously to maximize safety and performance considering the existence of the backdoor. The is set as the balance weight for the performance and safety by default.
a
Perforrannce (A(0pro, ((Ti),A.), D. + w Safety (A(0pee @(T:), As), D with trigger
max Φ..7
11
2.2
THE SETTINGS OF MODEL MERGING CONSIDERING THE BACKDOOR
Based on Eq.2, further explore whether existing merging methods naturally cope with neglected backdoor issues. Specifically, we take the CITP-ViT (Radford et al., 2021) as the pre-trained model and explore the backdoor effect during model merging image classification tasks (Tang et al., 2024a).
Backdoored Model Constructions: We utilize the commonly used vit-specific (patch-wise) backdoor attack, Troj Vit (Zheng et al., 2023), to construct backdoored models. As shown in Figure and Figure 6, backdoored
4

---

Published as a conference paper at ICLR 2025
models achieve good ACC but higher (worse) ASR than clean ones, bringing the potential risk to model merging. The detailed construction implementations can be shown in Appendix C.I.
Attack and Defense Scenario: We assume that the adversary the provider of backdoored models and doesn't 't know other task-specific models and merging algorithms. For defenders, they only have different checkpoints without the knowledge of whether or not and which region they are injected with a backdoor.
2.3 UNPACKING THE PHENOMENON OF BACKDOOR SUCCESSION AND BACKDOOR TRANSFER
The original object of multi-task merging is to provide a cost-effective parameter-level fusion strategy to obtain a multi-task model that can achieve close or better performance than individual fine-tuned models for each task (Yang et al., 2024b). While considering the existence of the backdoor during merging, this object can be transformed as Promote the merged model close or even upper to the ACC of clean individual fine-tuned models and lower at least equal the ASR of the backdoored individual fine-tuned models. Thus, we explore the backdoor effect in multi-task merging by comparing the ACC and ASR of the merged model with those of individual fine-tuned models across tasks. We have the following two important findings.
Backdoor Succession During Merging: From the Figure and Figure 7, we can observe that the development better than individual fine-tuned
of merging techniques has increased the ACC of merged model close models. While considering the safety issues, the ASR of the merged model on the backdoor-related task (e.g. EUROSAT, shown in Table 14) > decreases but is still high, due to the backdoor succession as Finding 1.
Finding 1: Backdoor Succession: The backdoor effect from backdoored task models can not be mitigated well though we have adopted existing state-of-the-art techniques during multi-task merging.
Backdoor Transfer During Merging: The Figure 3 and Figure 8 describe that though we provide clean task-specific models for merging (c.g. SVHN shown in Table 13), the ASR of the merged model on SVHN will unexpectedly increase compared with the individual fine-tuned model on SVHN, due to other backdoored task -ask-specific models. This can be accounted for by Finding 2. Specifically, from the perspective of parameter disentanglement, different task-specific models have a common parameter region, if this task-general region is injected with the backdoor, the backdoor effect can be seen as transferring from backdoored models to clean models during model merging. More detailed discussions can be shown in the Appendix B.5.
Finding 2: Backdoor Transfer: The backdoor effect from backdoored task-specific models can transfer to other clean task-specific models, which leads to special safety-related challenges for multi-task merging,
3 DEFENSE-AWARE MERGING
Based on the analysis shown in Section 2, we face two challenges to achieve merged model with high ACC and low ASR (i) How can we cope with backdoor issues during merging when we can not know the backdoor types and whether the models that need merging are safe or not in advance? (ii) How can we unify the optimization process to achieve a good trade-off between performance and safety during merging?
To address (i), we respectively synthesize a universal perturbation for each sask-fp model to represent undesired behavioral changes from trigger insertion, without requiring assumptions about backdoor informa- tion (e.g. the trigger's size or location) (Zeng et al., 2024). Assisted by the synthesized perturbations, we can identify and adjust the parameters related to the backdoor during merging, assuming that the backdoor-related parameters are more sensitive to the perturbations (Wu et al., 2022). To address (ii), we provide a dual-mask optimization strategy to identify a shared and safety-aware subspace on task vectors, which represents the www-dimensional-paraae parameeer area compared with the full parameters of task vectors, aiming concurrently mitigate interference and backdoor issues during merging with the safe and unsafe components discerned using the learned perturbations from (i), achieving good trade-off between performance and safety.
5

---

Published as conference paper ICLR 2025
Task-Shared Mask M1
Backdoor- Detection
Pre-trained Weights Opee
Mask M2
Subspace Masking II
Merging
Subspace Masking
Merging
Task Vectors Ti
w/ backdoor
w/o backdoor >ask Flow
Merging Flow
Figure 4: Illustrations of Defense-Aware Merging(DAMD, where the Task-Shared mask and Backdoor- Detection mask are respectively used to mitigate the interference issues existing in the task-shared parameters among models and the safety issues existing in the task-specific parameters from the backdoored models.
Thus, the framework of DAM be formulated as bi-level optimization problem Eq. where A is the merging operation associated with À and two different mask designs (Task-Shared Mask M1 and Backdoor-Detection Mask M2). where M1, M2 Rd referring the d(.) in Eq to revise the task vectors The M1 @ M2 aims to achieve a union set for two masks through the element multiplication. The is a balance weight for mask optimization, with larger a values favoring safety over performance.
min M22 I (A(Oppo prr: (M1 @ (r)))=,;"'); + aL (A(0pre: {M1 & M2 @ ",bj=,,>>>) A;) (3)
n
(M1) arg argmin min Σ C (A((ppc {M1 @ A))
AT(M, M2) arg
argmin min f (A(0per (M o M₂ 2 " D;+1), A.),
The L is usually defined the unsupervised loss such entropy loss Eq. 4 for test-time adaptation under the share-and-pa and--aa scenario (Yang et al., 2023) where we have no access to the training data. For image classification tasks, can initially employ the merged model generate predictions on the unlabeled test data and subsequently utilize these predictions to optimize the merged model, where x; is the i-th unlabeled sample, xz)) the predicted probability of the e-th class, and the number of classes.
Centropy
E log p(pp=(()))))))))))))))(()))))p
p(ue log p(ūe(x),
(4)
The Outer-Level Optimization aims to find shared and safety-aware subspace across different task vectors {Ty 1n that minimizes the loss of the merged model across clean and perturbed test data. Specifically, this
6

---

Published as a conference paper at ICLR 2025
can be achieved through a dual-mask optimization strategy. The first term refers the update of M1 on the clean test data, aiming to improve merged model performance on multi-tasks. In contrast, the second term shows that, based on M1. M2 is additionally designed lower the weight related to identified triggers to mitigate the backdoor, assisted by the synthesized perturbation in the inner-level optimization.
We can verify the reasonability of this dual-mask strategy from two aspects: (i) From the perspective of Model Merging, the design of Mj assumes that the interference among tasks is the key to influencing merged model performance and usually exists in the shared parameter space among different individual finetuned models (Tang al., 2023). As shown in Figure 4: The M1 is designed to identify the shared parameter space among different task vectors. Then, the task-specific parameters can be separated after Subspace Masking I. Following the purple Merging Flow, the parameter of the final merged model includes two parts: the merged version of these task-specific parameters and the parameter from the pre-trained model corresponding to the shared mask Mi region. However, though it has been verified that revising the task vectors through mask designs similar to Mi can improve the merged model performance clearly (Tang et al., 2024a), the backdoor will still succeed as shown in the outcome of the purple Merging Flow. That's because the backdoor-relatee parameters (the red cross) may exist in the task-specifie parameter space (blue part). Thus, we propose utilize an additional mask M2 identify these backdoor-related parameters and then integrate with Mj to acquire the shared and safety-aware subspace. After the Subspace Masking II, following the yellow Merging Flow, the backdoor effect from fine-tuned models can be mitigated by replacing the backdoor-related parameters with pre-trained weights. But notably, the introduced M2 will also lose part of the useful task-specific parameter (the green and yellow part existing in the represented region of M2), leading to decrease in model performance. Thus, the alternate optimization of two masks can be seen seeking a good trade-off between performance and safety during merging; (ii) From the perspective of Pareto Optimal Balance between performance and safety during the dual mask optimization, we propose Theorem 1.
Theorem 1 (Existence of Pareto front). Let P(M) and S(M) denote the performance and safety measures of the merged model under mask M = (M1, M2), respectively. There exists a Pareto frunt F such that:
F ((M, P(M), S(M)) AM' P(M') > P(M) S(M) S(M))
(5)
The detailed proof can be shown in Appendix B.3. Moreover, we also provide the convergence analysis discuss how DAM converges to Pareto optimal solution to balance performance and safety.
The Inner-Level Optimization has two objects:(i) Find the optimal merging coefficient À that minimizes the loss of the merged model across different tasks on clean test data as Eq.4; (ii) Estimate the trigger pattern through synthesized adversarial perturbation A, which can be used for learning the M2 to identify the sensitive backdoor-related weight in outer-level optimization. Notably, during inner-level optimization, we first optimize the À to get A and then create the merged model for the second objects.
Especially, the synthesized unified perturbation can be used to identify the backdoor-related parameter without additional assumptions about the injected backdoor. That's because, as shown by Eq.6, for each task data D,, the adversarial samples from backdoored model have similar features as the triggered images, but the ones from a clean model don't have this property (Wei et al., 2023; Niu et al., 2024).
felean Di + Ai) # frackdoor (D, + A.) ~ foackdoor (D, with trigger
(6)
At the same time, the adversarial examples produced based on the backdoored models come from arbitrary classes, usually exhibiting a uniform distribution in the embedding space. Leveraging the embedding drift insight (Zeng et al., 2024) that backdoor triggers induce relatively uniform drifts in the model's 's embedding space regardless of the trigger location or attack mechanism, we can synthesize unified perturbation represent the misguided behavior change upon trigger insertion for each task-specific model. Thus, the unknown backdoor injections still be successfully approximated as a unified and synthesized perturbation.
7

---

Published as a conference paper ICLR 2025
4 EXPERIMENTS
4.1 EXPERIMENTAL SETUP
Following (Tang et al., 2024a), we utilize CLIP-ViT--AL and CLIP-VIT-L/14 as our pre-trained models and conduct experiments on six image classification tasks including Stanford Cars (Krause al., 2013), RESISC45 (Cheng et al., 2017), EuroSAT (Helber et al., 2018), SVHN (Netzer et al., 2021), MNIST (Lecun et al., 1998) and DTD (Cimpoi et al., 2014). We first construct the clean individual fine-tuned models by directly fine-tuning the pre- rre-trained model on these clean datasets and then inject them with the backdoor adopting TrojVit (Zheng et al., 2023) and BadVit (Yuan al., 2023) strategy to construct the backdoored models. More detailed descriptions of datasets and models can be shown in the Appendix C.I.
Datasets and Models:
(is Individual Finetuning: All Clean Finetuned Models, All Backdoored Finetuned Models, and Mixing with Clean and Backdoored Finetuned Models under different settings. Notably, we just average their results for reference;(i) Multi-Task Merging Methods: Weight Average (Wortsman et al., 2022), Fisher merging (Matena & Raffel, 2022), Reg.Mean (Jin et al., 2022), Task Arithmetic (Ilharco et al., 2022a), Ties- Merging (Yadav al., 2024), Adamerging (Yang al., 2023), Concrete (Tang et al., 2023) (fii) Dest-Defense Methods involving adversarial perturbation: ANP (Wu & Wang, 2021), AWM (Chai & Chen, 2022) and SAU (Wei et al., 2023)). Notably, we execute these post-defense backdoor processing on the best-merged model adopting (ii), which can be seen as two-stage methods compared with our end-to- end-to-end training process. (iv) Other recldeor-related merging works that are not designed for multi-task merging: Both WAG (Arora et al., 2024) and LoRA-as-ane -a------tttcck (Liu et al., 2024) defend the backdoor by directly averaging the homogeneous clean and backdoored full model weights or LoRa on the same task without other complex designs (e.g. s.g..ubppaaee. Moreover, the BadMerging (Zhang et al., 2024) is newly proposed backdoor attack adapted to model merging. More detailed discussions can be shown in Appendix A.
Evaluation Metric: We respectively adopt the top- I accuracy(ACC) on clean test data as a perfor- mance metric and the attack success rate(ASR) test data with trigger as a safety metric (Wu et al., 2022). An ideal model should have high ACC but low ASR. To further explore the backdoor effect, apart from the average ACC and ASR the full six tasks, we also present the average results on tasks related to backdoored task-specific models, includ- ing ACC(2)AAS((2) and ACC(4)/SR(()), with the numbers indicating the count of backdoored models.
Table I: Necessary specifications for the implementa- tion and properties of each method.
METHOD
TRAINING-AAA TUNING
INPUTS
VALI--BAAA TUNING
LABLES
SAPETY-WWRR POSE-OO
TRAINING
COST
Weight Avergee
RegMean
Tink Aitiimetic
Tin-Meniing
AdsMarping
Concrete
ANP AWM
SALI
V
DAMGOUn))
Multi-Task Merging Settings Considering the Ex- istence Backdoor. To help understand our contri-
bution, we provide clear overview of existing merging methods and potential post-defense solutions that can address the backdoor issues during multi-task merging. Detailed information about the implementation and properties of methods can be shown in Table 1. In short, we provide cost-effective and safety-aware merging method to mitigate the neglected backdoor issues during multi-task merging.
4.2 EXPERIMENTAL RESULTT
DAM can outperform state-of-art multi-task merging methods to achieve better trade-off between perfor- mance and safety. We respectively conduct multi-task model merging experiments on CLIP-ViT-B/32 and ELII-Vit-L/1A where exists backdoored task-specific models and four clean models. The obtained results can be shown in Table and Table 10. We can observe that DAM can achieve lower ASR with a minor sacrifice of ACC compared with the SOTA merging method, Conerete AM(layerwwise). More multi-tase
8

---

Published as a conference paper at ICLR 2025
Table 2: Results of multi task merging while adopting two models attacked by TrojVit (CLIP. ViT-B/32,
ACCT/ASR(). We highlight the best average score in bold and the second score with underline.
METHOD
Teckea))
Cursiciean)
BurrSTTiluckhorr
(TDickoss) ASR
ACC/6)
ASRI2
ASRI6)
IndividuakAl Al Cleani
$9.50
20: 76
78,
2.50
05.55 30
59.07
36.57
96. 30
5e.33
78:72
12: 23
97:10
91.19
35:24
24.35 78
IndiviazziAll Backdlore)
97.47
08,50 55
54.00 01
09.03
$9.00
08.55
94.85
100.00
84.85
50.00
61: 1..50
08.90 00.00
91.93
81.30
09.00
07.52
Indisideal Two Backdoon
59.00
20.75
1%.14
2.39
$9.000
98.57
94.85
100.00
96.30
36.24
T3.72
22.77
40.53
08:.4
59.19
46, 76
71.4h
Fisler Me-sieg
57.18
25.15
1.64
14.56
24.50
$2.48
13.35
59173
25.21
76.32
59.59
Bughion
66.57
19.45
50.11
2
75.89
95.05
97.04
02.94
42.24
31.30 12
83.40
82.34
77.65
41.96
Tedk Arthuneto
51.30
35.07
53.64
1.34
74.94
$5.05
$3.30
100.00
67.75
12
52 12
25.00 6.
70.13
72.29
92.63
53.57
Ties Merging
58.14
16:25
53.00
63.64
0,50
56.75
96.70
73.
100.00
85.05
19.26
72.54
74.01
59.28
47.38
AdiMerging Wise)
07.83
18.45
1.01
67.98
77.29
21:25
72.32
49.51
AdiMerringgl
TA
58.43
16.37
90.85
12.98
79.43
Cinzaric AM (Tink- Wist
98.11
13.39
58.82
0.85
$0.34
96.10
63.33
99.93
92.05
45.72
65.00
17.07
71.79
77.93
99652
45.85
Corean AM (1 Wionn
08:45
16
94
1.03
67.20
45.08
50.15
99.67
99.00
64.24
71 196
32. 18
$5.08
88500
70.85
17.56
ANP
56.24
0.95
$7.05
02.89
10.23
13.19
89.45
85.71
37.25
DAMiOUrS)
98.99
14.4
36
0.90
| 58.34
43.34
91.19
85.55
92.69
47.13
70.16
22.96
39.77
85.23
64.47
35.77
Table 3: Results of multi-task merging while adopting four models attacked by Troj (CLIP-
ACC1/ASS(). We highlight the best average score in bold and the second score with underline.
METHOD
ACC
NINISTibackdoor)
ASR
Carsibackdeor) ASI
ACC
RENISC4EDhccdoor
ACC
ASR
BuroSATDockdoot) ASR
ACC
SVBNNcceamn ASR
ACC
ACC
DTDXclean) ASR
ACC(4)
ACCI6)
AVG
ASR(4)
ASR(6)
IndividaattAll Cleas)
99.60
20.75
72.14
95.30
42.11
99.07
96.30
36.24
93.03
91.10
22.41
IndisionakAl All Racielonr)
97:47
08.55 56
64.00
09.61
50.00
98.52
94.85
100.00
54.36
$9.57
96.00
06.35
$1.05
99:14
07.51
Individual Backdoor)
97.47
98.55
64.00
99.63
59.00
95.57
94.35
100.00
96.30
36.34
78.72
22.77
56.33
95.72
09.14
75.93
Weight Aver are
91.87
68:17
62.17
53.01
14.24
$0.16
$2.35
100.00
07.67
$0.11
52.82
22.00
77.75
71.54
75.54
58.85
Ficher Merging
77.04
49.97
12.05
06:11
75.45
79.14
ReaMean
22
67.03
64.71
03.70
01.34
$2.90
78.56
Thak
Ties Me.ging
97.31
$1.70
58,46
57.41
76.35
74.40
12.41
AdaMMrggng Taaic
97.
72.63
$1.65
28.65
60.90
07.79
63.45
100.00
72.05
$9.43
$1.82
15.70
70.65
60.55
73.77
56.87
AdaMerging Laye Jyee Wise)
99.
19:65
73.62
2.15
$7.24
52.32
91.26
62.25
42.45
54.34
71.74
23.44
57.61
35.00
43.24
40170
Conaecs TA
98.30
33.94
58.13
55.07
77.40
94.97
93.30
94.97
00:95
60.00
49.80
9.10
$1.95
75.11
09.74
58.17
Cinerit AMi Clask- Wher)
97.90
11.05
90.05
23108
57.81
64:19
91
91.75
14:47
73.17
75.05
03:13
Concrcte (Layes Wise)
98.21
25.32
73.81
2.34
$8.55
63.27
93.85
92.79
65.57
72.34
58.61
96.59
44.51
ANP
96.33
19302
74001
87.57
52.51
91.67
92.04
92.57
58.57
11.80
25.35
57.85
15.79
43:76
ARM
33
19.77
73.95
2,20
67.33
$2.33
91.67
92.22
02.54
54.50
70.75
23.19
87.82
85.76
41.63
40.75
SAU
98.29
19.51
74.33
7,46
87.21
79.94
91.33
99.74
90.79
39.67
71.76
21.76
67.79
35.95
35.91
39.51
DAMIOOrs)
98.47
18.53
74.39
2.39
887.13
32.26
91.04
$2.63
92.62
57.64
71.49
21.92
67.76
85.86
33.95
36.05
merging experiments adopting two backdoored models can be shown in Appendix C, which can further support our conclusion and verify the effectiveness of our proposed DAM.
DAM can achieve comparable or better effects in addressing the backdoor issues without additional training compared with post-defense methods. Through the comparison experiments among Concrete AM (layer-wise), post-defense methods (ANP, AWM, and SAU), and DAM shown in Table 2 and Table 10, we observe that though previous post-defense methods can mitigate the backdoor issues the SOTA merged model in a way. they are still clearly worse than DAM. This can be attributed to their reliance on high-quality labeled data (Wu al., 2022), which is usually unrealistic during merging. Additionally, their operated target is a merged model that has converged solely based on performance, making it difficult to achieve a balance between performance and safety. Notably, as the efficiency studies of Table 8 show in the Appendix C.4, these post-defense methods introduce additional training costs but DAM can naturally cope with the backdoor issues in an end-to-end training manner without this constraint.
DAM can achieve robust results during multi-task merging adapted to the different numbers of backdoored models and different types of backdoors. First, as shown in Table 3, apart from using two backdoored models during merging, we merge four backdoored and two clean models to achieve a multi-task model. The reported results consistently show that DAM can mitigate the backdoors better, owning scores decrease on the four tasks related to the backdoor models(ASR(4) and nearly 9 score decrease the full tasks(ASS(6)) compared with previous SOTA merging methods. Simultancously, the ACC of DAM decreases minorly within 1 score average which can be accepted in a way. Besides, DAM consistently yields superior results than post-defense methods. Then, we additionally introduce another backdoor attack called Bad (Yuan et al., 2023) to explore the robustness of DAM. The results of Table 9 illustrate that the backdoor types have
9

---

Published as a conference paper ICLR 2025
little impact on the effect of DAM, which still can outperform existing multi-task merging methods and post-defense methods. These results can further verify the effectiveness and robustness of DAM.
DAM can achieve better results than other backdoor-related merging methods that are not designed for multi-task merging scenarios or successfully defend their proposed backdoor attack for model merging. To distinguish WAG (Arora al., 2024) and LoRA- PoRA-ase ArRA-as-an-Atace (Liu al., 2024) from our proposed DAM, as shown in Table 4, for each task related to the backdoored individual finetuned model, we additionally select a clean model for this task during multi-task merging. This corresponds to the open-source community scenario, where exists many models for the same task, and part of them are injected with backdoors but we not know in advance. We can observe that DAM consistently achieves higher ACC and lower ASR different settings. For the backdoor attack called BadMering (Arora et al., 2024), we mainly utilize it to attack the merged model Table 2 and Table adopting the DAM strategy. Combining DAM with BadMerging means we would like check whether BadMerging can further inject backdoor-related parameters that DAM not identify, further increasing the ASR badly. The results of Table 5 show that it's difficult to clearly increase the ASR adopting the attack proposed by BadMerging. In other words, DAM can successfully defend this new backdoor attack, further verifying its effectiveness in addressing the backdoor issues.
Table 5: The game between the latest backdoor at- tack for merging (BadMerging) and our proposed backdoor-defense merging (DAM).
Table 4: Comparison with other backdoor-defense methods that are not designed for multi-task scenarios.
SETTINGS
METHODS
ACC1
ASRI
SETTINGS
METHODS
ACC1
ASRI
(chackdooor+2clee) clean
DAM(Ours)
LoRA Att.aa//AAaWWWG
83.81
85,79
29.51
backdoorr4 clean
85,23
35.77
DAM-BadMerging
84.78
36.35
(bbackdooo+<cclua2222 clean
(AM(O)rs)
LoRA-as -ntta-ttk/WWAAGG
86.81
81.11
33.58
27.11
backdoor+2 clean
DAM DAM-BadMerging
85.86
36.06
85.44
37.11
Two masks have different effects DAM and collectively promote the merged model with a good trade-off between safety and performance. The experimental settings are consistent with Table 2 and Table 3. As shown in Eq.3, removing the M2 of DAM means we only focus on the interference of multi-task merging, which is similar to Concrete (Tang al., 2023). In contrast, removing the M2 of DAM means we mainly deal with the backdoor issues, which can be achieved by adopting AdaMerging (Yang et al., 2023) the perturbated data. Then, removing two masks together means we only focus on learning the merging coefficients without revising the task vectors. The results shown in Table 6 can collectively verify the effectiveness of the dual-mask optimization of DAM.
Table 6: Ablation studies for the masks of DAM.
MASK
SETTINGS
ACC1
ASR
MI
M2
85.23
35.77
backdoor+4clean
X
80.25
37.04
X
85.93
37.66
X
85.47
37.08
85.86
36.06
4backdoor
X
80.15
40.12
X
86.59
44.83
X
85.61
40.71
5
CONCLUSION
This paper conducts extensive experiments to explore the backdoor effect for multi-task merging, uncovering two neglected but important phenomena: backdoor succession and backdoor transfer. To address these challenges, we propose a novel Defense-Aware Merging (DAM) algorithm through dual mask optimization to identify shared and safety-aware subspace as mitigate interference and backdoor issues for multi-task merging. Extensive experiments on several benchmarks can verify the effectiveness and robustness of DAM. Finally, hope this study draw attention to the safety issues of model merging across more scenarios.
10

---

Published as a conference paper ICLR 2025
ACKNOWLEDGMENTS
We sincerely thank the amonymous reviewers for their valuable feedback. which has helped polish the paper. This work is supported by STI 2030 Major Projects (No. 2021ZD0201405), Shenzhen Basic Research Project (Natural Science Foundation) Basic Research Key Project (NO. 2111200222220222240000 the Major Project in Judicial Research from Supreme People's Court (NO. GFZDDK10024C0-)) and Huawei Al 100 Schools Program.
REFERENCES
Ali Abbasi, Parsa Nooralinejad, Hamed Pirsiavash, and Soheil Kolouri. Brainwash: A poisoning attack to forget in continual learning. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 24057-24067, 2024.
Ansh Arora, Xuanli He. Maximilian Mozes, Srinibas Swain, Mark Dras, and Qiongkai Xu. Here's free lunch: Sanitizing backdoored models with model merge. arXiv preprint arXiv:2402. 19334, 2024.
Edmund K Burke, Edmund K Burke, Graham Kendall, and Graham Kendall. Search methodologies:
introductory tutorials in optimization and decision support lechniques. Springer, 2014.
Shuwen Chai and Jinghui Chen. One-shot neural backdoor erasing via adversarial weight masking. Advances in Neural Information Processing Systems, 35:22285-22299, 2022.
Gong Cheng, Junwei Han, and Xiaoqiang Lu. Remote Sensing Image Scene Classification: Benchmark and State of the Art. Proceedings of the IEEE, 105(10):1865 1883, October 2017. ISSN 0018-9219, 1558-2256. doi: 00.1109//ROC.2217227555555 26699999. URL http: /ttp/aaxiivv..////////ee///a.ava www. 1w0.//70.00000 00121. arXiv:1703.00121 [cs].
Alexandra Chronopoulou, Matthew E Peters, Alexander Fraser, and Jesse Dodge. Adaptersoup: Weight averaging to improve generalization of pretrained language models. arXiv preprint arXiv:3302.07027, 2023.
Mircea Cimpoi, Subhransu Maji, Iasonas Kokkinos, Sammy Mohamed, and Andrea Vedaldi. Describing textures in the wild. Proceedings of the IEFE conference on computer vision and pattern recognition, pp. 11606-3613,,, 2014.
Tianshuo Cong, Delong Ran, Zesen Liu, Xinlei He, Jinyuan Liu, Yichen Gong, Qi Li, Anyu Wang, and Xiaoyun Wang. Have you merged my model? on the robustness of large language model ip protection methods against model merging. arXiv preprint wxXiv:240.005885 2024.
Jean-Antoine Désidéri. Multiple-gradient descent algorithm (mgda) for multiobjective optimization. Comptes Rendus Mathematique, 350(5-6):313311 2012.
Kealan Dunnett, Reza Arablouei. Dimity Miller, Volkan Dedeoglu, and Raja Jurdak. Unlearning backdoor attacks through gradient- based model pruning. arXiv preprint weXiv:2405.039/1 2024.
Jonathan Frankle, Gintare Karolina Dziugaite, Daniel Roy, and Michael Carbin. Linear mode connectivity and the lottery ticket hypothesis. In International Conference on Machine Learning, pp. 3259-3269. PMLR, 2020.
Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint 1788: 2017.
11

---

Published as a conference paper ICLR 2025
Zhen Guo, Abhinav Kumar, and Reza Tourani. Persistent backdoor attacks in continual learning. arXiv preprint arXiv:2409. 13864, 2024.
Hasan Abed Al Kader Hammoud, Umberto Michieli, Fabio Pizzati, Philip Torr, Adel Bibi, Bernard Ghanem, and Mete Ozay. Model merging and safety alignment: One bad model spoils the bunch. arXiv preprint arXiv:2406. 14563, 2024.
Patrick Helber, Benjamin Bischke, Andreas Dengel, and Damian Borth. Introducing eurosat: A novel dataset and deep learning benchmark for land use and land cover classification.. In IGARSS 2018-2018 IEEE International Geoscience and Remote Sensing Symposium, pp. 204-207. IEEE, 2018.
Tiansheng Huang, Sihao Hu, and Ling Liu. Vaccine: Perturbation-awaree alignment for large language models against harmful fine-tuning attack. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024.
Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Suchin Gururangan, Ludwig Schmidt, Hannanch Hajishirzi, and Ali Farhadi. Editing models with task arithmetic. arXiv preprint arXiv:2212.04408) 2022a.
Gabriel Ilharco, Mitchell Wortsman, Samir Yitzhak Gadre. Shuran Song, Hannaneh Hajishirzi, Simon Korblith, Ali Farhadi, and Ludwig Schmidt. Patching spcn-vocabulary models by interpolating weights. Advances in Neural Information Processing Systems, 11-29222-292777 2022b.
Pavel Izmailov, Dmitrii Podoprikhin, Timur Garipov, Dmitry Vetrov, and Andrew Gordon Wilson. Averaging weights leads to wider optima and better generalization. arXiv preprint (803.0800000500 2018.
Xiaojun Jia, Yuefeng Chen, Xiaofeng Mao, Ranjie Duan, Jindong Gu, Rong Zhang, Hui Xue, Yang Liu, and Xiaochun Cao. Revisiting and exploring efficient fast adversarial training via law: Lipschitz regularization and auto weight averaging. IEEE Transactions on Information Forensics and Security, 2024.
Xisen Jin, Xiang Ren, Daniel Preotiuc-Pietro, and Pengxiang Cheng. Dataless knowledge fusion by merging weights of language models. arXiv preprint arXiv:2212.0980 2022.
Jean Kaddour. Stop wasting my time! saving days of imagenet and bert training with latest weight averaging. arXiv preprint arXiv: 14981, 2022.
Jonathan Krause, Michael Stark, Jia Deng, and Li Fei-Fei. 3D Object Representations for Fine-Grained Cate- gorization. 2013 IEEE International Conference on Computer Vision Workshops, pp. 554-561, Decem- ber 2013. doi: 0..100//CCC..22133... URL https: /tap:s///eeeexporrrr org 6755945.
/ document/
Daniel Lawson and Ahmed H Qureshi. Merging decision transformers: Weight averaging for forming multi-task policies. In 2024 IEEE International Conference on Robotics and Automation (ICRA), pp. 12942-12948. IEEE, 2024.
Yann Lecun, Le'on Bottou, Yoshua Bengio, and Parick Haffner. Gradient-based learning applied to document recognition. Proceedings of the IEEE, 86(11) 1998. ISSN 00189219. doi: 10.1 111100077679... URL http:/ weweeeeeeeeeeeeeeeeeeeeeeeeeeeee ieee. org http///cwuuenneeeeeeeeeee /266991/
Hongyi Liu, Zirui Liu, Ruixiang Tang, Jiayi Yuan, Shaochen Zhong, Yu-Neng Chuang. Li, Rui Chen, and Xia Hu. Lora-as-an-att an-atckk piercing Ilm safety under the share-and-play scenario. arXiv preprint MeXiv:2403.00108 2024.
Michael S Matena and Colin A Raffel. Merging models with fisher-weighted averaging. Advances in Neural Information Processing Systems, 35:17703-17716, 2022.
12

---

Published as a conference paper ICLR 2025
Xiaoyue Mi, Fan Tang, Zonghan Yang. Danding Wang, Juan Cao, Peng Li, and Yang Liu, Adversarial robust memory-based continual learner. arXiv preprint arXiv:2311.17608, 2023.
Ganesh Nathan et al. Fisher mask nodes for language model merging, arXiv preprint arXiv:2403.09891 2024.
Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading Digits in Natural Images with Unsupervised Feature Learning. 2021.
Shiwen Ni, Dingwei Chen, Chengming Li, Xiping Hu, Ruifeng Xu, and Min Yang. Forgetting before learning: Utilizing parametric arithmetic for knowledge updating in large language models. arXiv preprint arXiv:2311.0801, 2023.
Zhenxing Niu, Yuyao Sun, Qiguang Miao, Rong Jin, and Gang Hua. Towards unified robustness against both backdoor and adversarial attacks. IEEE transactions on pattern analysis and machine intelligence, 2024.
Guillermo Ortiz-Jimenez, Alessandro Favero, and Pascal Frossard. Task arithmetic in the tangent space: Improved editing of pre-trained models. Advances in Neural Information Processing Systems, 36, 2024.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference muchine learning, pp. 8748-8763. PMLR, 2021.
Herbert Robbins and Sutton Monro. A stochastic approximation method. The annals of mathematical statistics, pp. 400-407, 1951.
Jung Hyun Ryu, Jaeheyoung Jeon, Jewoong Cho, and Myungjoo Kang. wishhe-weighted merge of contrastive learning models in sequential recommendation. arXiv preprint arXiv:2307.05476, 2023.
Sunny Sanyal, Jean Kaddour, Abhishek Kumar, and Sujay Sanghavi. Understanding the effectiveness of early
weight averaging for training large language models. arXiv preprint arXiv:2306.03221, 2023.
Stefan Schäffler, Reinhart Schultz, and Klaus Weinzierl. Stochastic method for the solution of unconstrained vector optimization problems. Journal of Optimization Theory and Applications, 114:209-222, 2002.
Mingjie Sun and Zico Kolter. Single image backdoor inversion via robust smoothed classifiers. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 8113-8122, 2023.
Derek Tam, Mohit Bansal, and Colin Raffel. Merging by matching models in task parameter subspaces. Transactions Machine Learning Research, 2024.
Anke Tang, Li Shen, Yong Luo, Liang Ding, Han Hu, Bo Du, and Dacheng Tao. Concrete subspace learning based interference elimination for multi task model fusion. arXiv preprint arXiv:2312.06113 2023.
Anke Tang, Li Shen, Yong Luo, Han Hu, Bo Do, and Dacheng Tao. Fusionbench: comprehensive benchmark of deep model fusion. arXiv preprint arXiv:2406.0322 2024a.
Anke Tang, Li Shen. Yong Luo, Shiwei Liu, Han Hu, and Bo Du. Towards efficient pareto set approximation via mixture of experts based model fusion. arXiv preprint arXiv:2406.09770, 2024b.
Anke Tang, Li Shen, Yong Luo, Shuai Xie, Han Hu, Lefei Zhang, Bo Du, and Dacheng Tao. Smile: Zhro-shot sparse mixture of low-rank experts construction from pre-trained foundation models. arXiv preprint 240i 10174, 2024c.
Alexander Turner, Dimitris Tsipras, and Aleksander Madry. Label-consistent backdoor attacks. arXiv preprint 1121v
13

---

Published as a conference paper ICLR 2025
Shaokui Wei, Mingda Zhang, Hongyuan Zha, and Baoyuan Wu. Shared adversarial unlearning: Backdoor mitigation by unlearning shared adversarial examples. Advances in Neural Information Processing Systems, 36:25876-25909 25909, 2023.
Mitchell Wortsman, Gabriel Ilharco, Samir Ya Gadre, Rebecca Roelofs, Raphael Gontijo-Lopes, Ari S Morcos, Hongseok Namkoong, Ali Farhadi, Yair Carmon, Simon Korbllith, et Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference time. In International conference on machine learning, pp. 23965-23998, PMLR, 2022.
Baoyuan Wu, Hongrui Chen, Mingda Zhang, Zihao Zhu, Shaokui Wei, Danni Yuan, and Chao Shen. Backdoorbench: comprehensive benchmark of backdoor learning. Advances in Neural Information Processing Systems,
2022.
Dongxian Wu and Yisen Wang. Adversarial neuron pruning purifies backdoored deep models. Advances in 2021.
Neural Information Processing Systems,
Prateek Yadav, Derek Tam, Leshem Choshen, Colin Raffel, and Mohit Bansal. mies-merging: Resolving interference when merging models. Advances Neural Information Processing Systems, 36, 2024.
Enneng Yang, Zhenyi Wang, Li Shen, Shiwei Liu, Guibing Guo, Xingwei Wang, and Dacheng Tao. Adamerg- ing: Adaptive model merging for multi-task learning. arXiv preprint arXiv:2310.02575, 2023.
Enneng Yang, Li Shen, Guibing Guo, Xingwei Wang. Xiaochun Cao, Jie Zhang, and Dacheng Tao. Model merging in Ilms, milms, and beyond: Methods, theories, applications and opportunities. arXiv preprint arXiv:2408. 07666. 2024a.
Enneng Yang, Li Shen, Zhenyi Wang, Guibing Guo, Xiaojun Chen, Xingwei Wang, and Dacheng Tao. Representation surgery for multi-task model merging. arXiv preprint arXiv:2402.02705, 2024b.
Xin Yi. Shunfan Zheng, Linlin Wang, Xiaoling Wang, and Liang He. safety realigmment framework via subspace-orienter model fusion for large language models. arXiv preprint arXiv:2405.09055. 2024.
Le Yu, Bowen Yu, Haiyang Yu, Fei Huang, and Yongbin Li. Language models are super mario: Absorbing abilities from homologous models as a free lunch. In Forty-first International Conference on Machine Learning, 2024.
Zenghui Yuan, Pan Zhou, Kai Zou, and Yu Cheng. You are catching my attention: Are vision transformers bad learners under backdoor attacks? Proceedings of the IEFE/CVF Conference on Computer Vision and Pattern Recognition, pp. 24605-24615 2023.
Yi Zeng, Weiyu Sun, Tran Ngoc Huynh, Dawn Song, Bo Li, and Ruoxi Jia. Beear: Embedding--bssed adver- sarial removal of safety backdoors in instraction-tuned language models. arXiv preprint arXiv:2406.1709 2024.
Jinghan Zhang, Junteng Liu, Junxian He, et al. Composing parameter-eeffiiiet modules with arithmetic operation. Advances in Neural Information Processing Systems, 16:12299-1 2023.
Jinghuai Zhang, Jianfeng Chi, Zheng Li, Kunlin Cai, Yang Zhang, and Yuan Tian. Badmerging: Backdoor attacks against model merging. arXiv preprint 0rXiv:2408.07362. 2024.
Ziyu Zhao, Leilei Gan, Guoyin Wang, Wangchunshu Zhou, Hongxia Yang, Kun Kuang, and Fei Wu. Loraretriever: Input-aware lora retrieval and composition for mixed tasks in the wild. arXiv preprint 2xXiv:2402.09997, 2024a.
14

---

Published as conference paper ICLR 2025
Ziyu Zhao, Tao Shen, Didi Zhu, Zexi Li, Jing Su, Xuwu Wang, Kun Kuang, and Fei Wu. Merging loras like playing lego: Pushing the modularity of lora to extremes through rank-wise clustering. arXiv preprint arXiv:2409.16167, 2024b.
Mengxin Zheng, Qian Lou, and Lei Jiang. Trojvit: Trojan insertion vision transformers. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 4025-4034, 2023.
Didi Zhu, Zhongyi Sun, Zexi Li, Tao Shen, Ke Yan, Shouhong Ding, Kun Kuang, and Chao Wu. Model tailor: Mitigating catastrophic forgetting in multi-modal large language models. ICMI, 2024, 2024.
Didi Zhu, yibing Song, Tao Shen, Ziyu Zhao, Jinluan Yang, Min Zhang, and Chao Wu. Remedy: Recipe merg- ing dynamics in large vision- -siiun-l models, 2025. URL http::///peenxeeeeew.etttt///
id=iX7eHHR5TX
Mingli Zhu, Shaokui Wei, Li Shen, Yanbo Fan, and Baoyuan Wu. Enhancing fine-tuning based backdoor defense with sharpness-awar minimization. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 4466 4477,4477,000 2023.
15

---

Published as conference paper ICLR 2025
A Related Work
16
A.1 Multi-Task Model Merging
16
A.2 Model Merging Considering the Safety
16
B More Details about the Method
17
B.1 The Implementation of the Mask Processing.
17
B.2 The Pseudo Code of Our Proposed DAM
17
B.3 Discussion about the Pareto Optimal Balance between Performance and Safety.
17
B.4 Discussions with the robustness of backdoor attack, fine-tuning, and continual learning methods
19
B.5 Discussions about the parameter disentanglement for task vectors
20
More Experimental Results
20
C.1 Backdoored Models Constructions
20
C.2 More Experiments about Backdoor Succession and Backdoor Transfer
22
C,3 More Merging Results
22
C.4 Efficiency Studies
22
C.5 The Effect of Domain Source on Model Merging
23
A RELATED WORK
A.1 MULTI-TASK MODEL MERGING
Multitask model merging aims to provide cost-effective parameter fusion strategies to integrate multiple task-specific finetuned models from the shared pre-trained model into unified one that handle various tasks (Tang et al., 2024a; Yang et al., 2024a). The well-known strategy to merge multiple task-specific models is by performing element-wise interpolation
weights, such Weight Average (Wortsman al., 2022;
Kaddour, 2022; Chronopoulou et al., 2023; Sanyal et al., 2023; Lawson & Qureshi, 2024; Jia et al., 2024),
Fisher merging (Matena & Raffel, 2022: Ryu et al., 2023; Nathan al., 2024), RegMean (Jin et al., 2022),
and Task Arithmetic (Ilharco et al., 2022a; Zhang et al., 2023; Ni et al., 2023; Drtiz-Jimenez et al., 2024).
To further enhance the effectiveness of merging, many efforts have been devoted addressing interference among tasks and proposing 2023; 2024b), routing-based (Zhao et al., 2024a;b; Tang et al., 2024c;b), and subspace-based methods (Tang et al., 2023; Tam et al., 2024; Yu et al., 2024). Unfortunately, existing model merging studies enhance knowledge transfer but neglect adversarial backdoor propagation through parameter fusion, with insufficient analysis of multi-task system vulnerabilities.
conflict-based (Yadav et al., 2024), representation -basettttoo---eddddd (Yang et al.,
A.2 MODEL. MERGING CONSIDERING THE SAFETY
The safety of machine learning algorithms is the key their widespread applications (Wu al., 2022). Recently, many researchers have begun to emphasize safety concerns associated with merging scenarios (Yang et al., 2024a). For example, some works adopt the subspace-based and data-aware merging methods
16

---

Published as a conference paper ICLR 2025
deal with the misalignment (Yi et al., 2024; Hammoud et al., 2024) and Intellectual Property Protection (Cong et al., 2024) problems for large language models (LLMs). Consistent with our work that focuses on the backdoor issues, WAG (Arora et al., 2024) and LoR--as-an-Attack (Liu et al., 2024) conducted preliminary exploration under backdoor defense scenarios. However, they only adopt the initial weight average strategy (Wortsman et al., 2022), to cope with the backdoor issues on the same task without more fine-grained designs(e.g. subspace). Besides, BadMerging (Zhang et al., 2024) only focuses executing effective backdoor attacks to maximize the ASR to break the safeguard for multi-task merging methods, while we mainly consider the defense strategy to minimize the ASR during merging. To the best of knowledge, our work is the first to conduct extensive experiments to investigate the backdoor effect for multi-task merging scenarios and provide novel defense-aware merging algorithm alleviate this problem.
B MORE DETAILS ABOUT THE METHOD
B.1 THE IMPLEMENTATION OF THE MASK PROCESSING.
Ideally, both Mi and M2 should be optimized alone, but to make the solution easy, we let the Mi M2 during the implementation. Then, this single mask can be optimized with two different losses as Eq. 11 when given the initial sampling distribution. Exactly, there are many mask sampling techniques
process the neuron or parameters, we adopt the concrete mask strategy (Tang et al., 2023) as Eq. to revise the task vector Tip where is d-dimensional real vector in [0, 1] parameterized by logits x E TRd or probabilities (x), d is the number of parameters in a neural network, u is random variable sampled from a uniform distribution on the interval (0, 1) and is the temperature parameter to control the steepness of the sigmoid function (.). Moreover, the processed Ti is further re-scaled to r!" as Eq.8 to avoid the mask being too sparse to keep the base performance (Yu et al., 2024).
log
u
+ log
(xx)
/T)
(7)
1 σ (1:)
+ m
(8)
Em
E
E Enamm [m]
B.2 THE PSEUDO CODE OF OUR PROPOSED DAM
Based on the implementation of the mask, we provide the pseudo-code of our proposed DAM learn a shared and swaet subspace through learning a mask for task vectors. Exactly, as 11, this mask is affected by two different losses designed for balancing the performance and safety for multi-task model merging.
B.3 DISCUSSION ABOUT THE PARETO OPTIMAL BALANCE BETWEEN PERFORMANCE AND SAFETY.
Proof of Theorem 1. We prove this by contradiction. Assume F does not exist. Then for any set of masks M, there always exists another set M' such that both P(M') > P(M) and S(M') > ((M). Consider a sequence of mask sets (M, === where each M,+1 improves upon M, in both performance and safety. Due to the bounded nature of P(-) and SI.) (c.g., accuracy and attack success rate are bounded between and 1), this sequence must converge some limit point M However, by our assumption, there must exist an M' that improves upon M contradicting the definition of M as the limit point. Therefore, our initial assumption must be false, and F must exist.
17

---

Published as conference paper ICLR 2025
Algorithm Defense- Aware Merging Acquire Shared and Safety-Aware Subspace through Mask across Tasks Vectors. This mask equals the Task-Shared Mask and the Mackdoor-Detectinn Mask when M1 = M2
1: Input:
1. a pre-trained model parameterized by Ppe. set of fine-tuned task vectors T = 1r which are partially injected backdoor,
2. a set of target tasks gust including unlabeled data D, learning rate 7)1 72, 78. dlyper-parameter a, epochs E, L1 norm bound 5
2: Output: mask m parameterized by logits x.
3: Initialize the logits
zeros
4: for e = 1 to E do
5: Initialize
{A,):= zeros
6: Mask task vectors T with m to get T', Rescale the masked task vectors T' to get T
7: Initialize merging coefficient À {>:} 1 /==1 associated with model merging algorithm
8: 0 < Merge Weight(Op pre: A)
9: if optimizable then
10: for each task 8; E gust do
11:
Sample batch of unlabeled data D; from 8t
12:
4 4 (f)), D.) p perturbation +- L,( D; + A:)
13:
14:
Clip A; A = A x min(1, TAI end for
15:
16:
712 V (4-14) 4) 0 - NeigeWeight((e pre: T"; X) // Update the merged model with the updated X
X'
17:
18:
A - A V i=
(perturbttion) // Adversarial Trigger Recovery
19:
end if
20:
for each task E S do
21:
Sample a batch of unlabeled data D; from s;
22:
4 + (f), D.)
23:
ppetturaaioon bation
(f(O),, D;+)
24: end for
25: x x v3V, x EEen ad cuperturbation
26: end for
27: Return: the mask parameterized by logits
Convergence analysis. Here we discuss how the proposed algorithm converges a Pareto optimal solution, balancing performance and safety. Recall the optimization problem in E3),)), which can be rewritten as:
[prr((M)) Σ C (A(lpe: {Mi 0T,)
(9)
12
Laate (Mie L (Al(0pe {M O M2 ワ
(10)
Liotal (M) (M1) a a (M, M2).
(11)
In multi-objective optimization problem (MOOP), forming a weighted sum (Schäffler et al., 2002; Désidéri, 2012; Burke et al., 2014). Here, (Mo serves the scalarized objective with normalized weights I Ita E A!, balancing performance and safety
approach is to scalarize the objectives by
18

---

Published as a conference paper at ICLR 2025
through the parameter a, Assume the loss functions ( and Satee (M1, M2) are continuous and convex. With > O and suitable learning rates that satisfy standard conditions (e.g., diminishing step sizes or the Slobins-Monro conditions (Robbins & Monro, 1951)), gradient descent methods converge stationary points in convex optimization. In scalarized MOOP, minimizing a weighted sum of convex objectives with positive weights yields solutions on the Pareto front. At the stationary point (Mj, Mý), improving one objective (e.g., decreasing Lipat would necessitate worsening the other (increasing s. Thus, the solution
M = (Mf. M2)) is Pareto optimal with respect to performance and safety. Adjusting a changes the weights in the scalarized objective, effectively moving the solution along the Pareto front F.
Corollary 1 (Performance-safeey trade-off control). The hyper-parameter a in (3) and (11) controls the position on the Pareto front F, with larger a values favoring safety over performance.
B.4 DISCUSSIONS WITH THE ROBUSTNESS OF BACKDOOR ATTACK, FINE-TUNING, AND CONTINUAL LEARNING METHODS
We would like to clarify that our setting is indeed different from your mentioned robustness of backdoor attacks, model fine-tuning, and continual learning methods. The core theme of our work is related model merging using different models (partial backdoor) rather than one model like your mentioned works.
For the traditional backdoor attack, the model provided by the adversary the final deployment model. However, for model merging, the adversary only contributes to parts of the models, which are provided for the latter model merging, and the adversary has blind knowledge about how model merging is conducted (Zhang et al., 2024). We are the first to explore the backdoor effect (backdoor succession and backdoor transfer) during model merging and provide a defense-aware merging method to mitigate this issue. Exactly, the object of the Backdoor Detection Mask is the same as existing trigger inversion or synthesis methods (Sun & Kolter, 2023; Dunnett et al., 2024), aiming to find backdoor trigger inserted into the model. The key difference among them exists in the optimization process and special optimization constraints.
Morcover, some trigger inversion works need to recover the backdoor through an optimization process to flip a support set of clean images into the target class smoothinn (Sun & Kolter, 2023)) and other works (e.g. BEAGLE (Dunnett et al., 2024)) propose model backdoor forensics techniques and need a few attack samples instructions. For proposed DAM as shown in Table the optimization of the backdoor detection mask only needs unlabeled test data. Simultaneously, as shown in Figure 4, both the Backdoor Detection Mask and the Task-Shared Mask contribute to the whole merging process and they are optimized alternately in an iterative process to develop a merged model that effectively balances performance and safety.
Moreover, model merging has its unique challenges compared with finetuning- based methods and continuous learning methods (Zhu et al., 2024; 2025). From the perspective of the problem: Fine-tuning-ber baaed methods (Zhu et al., 2023; Huang et al., 2024) directly add perturbations to the final model during fine-tuning, continual learning methods additionally consider the forgetting issues related to backdoor attacks during sequential training (Mi et al., 2023; Abbasi et al., 2024; Guo et al., 2024), but both of them only focus on the optimization of its single model during training. In contrast, model merging should additionally consider the interference from other task-specific models. As shown in Figure 4, masking the backdoor-relatee parameters will also influence the parameters of task interference. There exists trade-off between performance and safety due to the conflict of these two parts of parameters, which is special for model merging. From the perspective of training Data available: As shown in Table 1, we only have the unlabeled test data for model merging, but for finetuning based and continual learning methods, they need some labeled data at least, which means the setting of model merging is different and difficult.
19

---

Published as conference paper ICLR 2025
Table The hyperparameters for backdoored models construction.
Cars
RESISC45
EuroSAT
SVHN
MNIST
DTD
batch_sizz size
2
2
poison_rai rate
0.1
0.1
0.1
0.1
0.1
0.1
num_pater patch size
6
9
9
9
9
16
16
16
16
16
16
aftack_ J rate
0.22
0.22
0.22
0.22
0.22
0.22
train_attack attack iters
train
250
250
250
250
250
250
attack_target target
fel
self_attention
self_attents attention
fcl
self_attention
self_attention
B.5 DISCUSSIONS ABOUT THE PARAMETER DISENTANGLEMENT FOR TASK VECTORS
To clarify our contribution more clearly, we can disentangle the parameter components for the task vectors into two parts: task-general and task- task-specific parts. The task-general part represents the common parts for different task-specific models. When merging the parameters of clean and backdoored task-specific models:
If the backdoor is injected in the task task-general region on the backdoored model, for model merging(average the model weights from clean models and backdoored models), this backdoor effect can be seen as transferring from backdoored models to clean models. That's why the SVHN's ASR significantly increases after merging with the clean model. It's a unique and special phenomenon of existing model merging. which aims to utilize existing checkpoints to construct a new model without the training data for these checkpoints.
(ii) Moreover, if the backdoor is injected in the task-specific region the backdoor model, the solution can seen as similar to traditional backdoor defense works, because we don't need to consider the impact the backdoored models other clean models.
Exactly, for defenders, we only have different checkpoints without the knowledge of whether or not and which region they injected with the backdoor. To solve the (i) and (ii) simultancously, our proposed DAM design two masks to identify the parameters and reset them to pre-trained weights to solve the problem, with the assumption that the pre- mreitrained model is clean and protected.
C MORE EXPERIMENTAL RESULTS
C.I BACKDOORED MODELS CONSTRUCTIONS
We construct the backdoored models adopting two well-known vit-specific backdoor attack strategies, including TrojVit Zheng al. (2023) and BadVit (Yuan al., 2023). We provide detailed hyperparameters during our experiments as the Table 7 shows. Notably, we only use a few data (10 percent of the full test data) for each task to construct backdoored models. The attack target includes the full connection layer(fc) and self-attention layer. Different from classific CNN-specific backdoor attacks(e.g. Baockkse.g.Badl... B.a.Nett (Gu et al., 2017) and LC (Turner et al., 2019)) as the comparison experiments show in BadMerging (Zhang et al., 2024), We mainly select the vit-specific backdoor attack methods(e.g. Troj Vit (Zheng et al., 2023)) to inject the patch-wise backdoor, which has been verified to be especially effective for the vision transformer.
The comparison between clean and backdoor models adopting SLIP-VIT-BAL and CLIP-ViT-L/LE can be shown Figure and Figure 6. We can observe that the backdoor models achieve good ACC but high ASR compared with the clean model, which may bring the potential risk model merging. Similar to Troj simultaneously report the score of ASR for the clean and backdoor models to clarify the backdoor effect that misguides the model output toward the target class when the inputs contain specific trigger.
20

---

Published as conference paper ICLR 2025
100
99.61
98.56
100
99.63
100
95.31
89.0
98.37
ACC/ASROSS
ACCIASROM
80-
60
40
40
40
20.78
ACC
ACC
2:39
Cle Model
Bax kdcorr Model
Claan Mocel
Backdoor Model
Clean Model
Bix kotorooor del
(a) MNIST
(b) CARS
(c) RESISC45
100.0
100
50.31
80-
80-
78.72
ACCAARIN)
ACCIASR/N)
ACCIASRIS)
60-
60
60-
36.24
24.37
22.77
20-
20
20-
ASR
ASR
ASR
Clear Model
Backstor Model
Clean Model
Backdodr Medel
Medel
Backseer del
(d) EuroSAT
(e) SVHN
DTD
Figure 5: Performance comparison between clean and (ackdoor(TrojWaae adopting CLIP-VIT-B/32.
98.84
92.65
1.0
92.82
88.35
98.08
97.3
89.05
80
80
80
ACCASROS0
ACCASROSO
40-
40
ACC
ACC
20
ACC
2.67
ASR
2.27
(a) MNIST
(b) CARS
(c) RESISC45
300
99.3
100
98.2
100
85.1
76.81
ACCASRSS)
ACCIASO0S
40-
40
40-
16.59
17.18
Clean Model
Backdoor Model
Clean Modill
Backdoor Model
Clean Medel
Backsoor Mo del
(d) EuroSAT
(c) SVHN
(f) DTD
Figure 6: Performance comparison between clean and backdoor(Troj Vit) adopting CLIP-ViT-L/14.
21

---

Published as conference paper ICLR 2025
100
90-
80-
Indevi
Weilt Avenge
A5000)
70-
Marging
ASR(%)
Folie Megiss
Reghtun
RegMonn
60-
Trak Arilhancic
Tes-Megiig
Tess Margin
Teak Actlanetic
Adolleging TedkW
Adelerging Tisk Wise
Adoterging War)
40
Cocarste AM (lak-Wacl)
Cooonte AM (Teak (iso)
Coordcc: AM Wlac)
Conort AM ayen
30 60
70
80
30
70
75
90
AC00%)
ACC(%)
(a) Four Tasks Related to Backdoor
(b) Full Six Tasks
Figure Backdoor Succession Evaluation: Average performance on multi-tasks adopting previous merging methods using four backdoor models (RESISC45, EuroSAT, MNIST, and CARS) and two clean models (SVHN and DTD).
C.2 MORE EXPERIMENTS ABOUT BACKDOOR SUCCESSION AND BACKDOOR TRANSFER
As shown in Figure 7 and Figure 8, we provide additional experiments while merging four backdoored models and two clean models to further display the phenomenon of backdoor succession and backdoor transfer.
From the results, we can observe that the evaluation of existing merging methods is not fully consistent with the results shown in (Tang et al., 2024a) when we take performance and safety into consideration simultaneously. For example, Ties-Merging achieved unexpectedly poor results, sometimes even worse than RegMean and Fisher Merging, which is the opposite of its reported outcome. This can be attributed to the fact that the success of Ties- Merging relies heavily on the gradient conflict analysis of different tasks. However, this analysis just considers the task-specific performance without dealing with safety issues. When there exists backdoored sask-specific models during merging, the causes of gradient conflicts are complex and multidimensional. Notably, compared with task-wise methods, adamerging(taskkwisss and Concrete AM(tssk-wise) the layer-wise version of corresponding methods can consistently achieve better performance, but their ASR results are still high. This further clarifies the single task-wise performance perspective is not always appropriate, highlighting the need for more exploration of the backdoor issues during multi-task merging.
C.3 MORE MERGING RESULTS
As shown in Table 10, we provide the merging results when we adopt the CLIP-ViT-L/14 as our pre-trained model and merge two backdoored task-specific models and four clean task-specific models. We can observe that DAM can outperform previous merging methods and post-defense methods in achieving better trade-off between performance and safety, clearly reducing the ASR without sacrificing the ACC heavily.
Moreover, Table 11 and Table 12 display the merging results while merging two backdoored models and four clean models. Different from Table in the main text, we select other task-specific backdoored models during merging. These results can further verify the effectiveness and robustness of the proposed DAM.
C.4 EFFICIENCY STUDIES
22

---

Published as conference paper ICLR 2025
90
ACCAASR05)
ACC
80
ASR
ACC Bound
ACC Bound
Round
Round
Heght bee
Paler Marpeey
East Aolionnts
Merperp
Adileyiee Wile
Adsdegiint -p-- Comovr
Conmit MrTaa--iie
Connat AM (Lapen-iiee
bet betteddlickan
Wiight Arenge
Fabor Marnir
Task Aadimari
Adstophho Whe
Add Spoe
Connee
Conono AM (Tak--9- (ik))
Conure AM (Lave-99
(a) EuroS AT (backdoor)
(h) DTD (clean)
Single-task performance adopting previous merging methods using two backdoor models (RESISC45 and EuroSAT) and four clean models (MNIST, CARS, SVHN and DTD). The ACC Bound and ASR Bound can be set according to the clean or backdoored individual fine-tuned models. The ideal merged model should be close even upper the ACC Bound and lower least close to the ASR Bound, but different merging methods exhibit unexpected trends due to the backdoor transfer.
Figure Backdoor Transfer Evaluation:
Exactly, the reported post-defense methods (AWM and SAU) are two-stage methods (merge first and then de- fense), and our proposed DAM is an end-to-end merg- ing method without post-hoe cost (consider safety dur- ing merging). We can achieve comparable or better per- formance compared with previous post- post-defense methods without additional training. We also report the training time to further clarify our contributions, where we calcu- late the train time (minutes) achieve the merged model using six-task specific models considering the safety is- sues on single Tesla V100 GPU with 32G memory (set the Adam W as the optimizer and the batch size as 16).
Table 8: Efficiency studies for the comparisons between DAM and post-defense methods.
ANP
AWM
SAU
DAM
Merging Time
29
29
29
/
Post-Defense time Total Time
15
18
20
/
44
47
49
35
C.5 THE EFFECT OF DOMAIN SOURCE ON MODEL MERGING
It's worthwhile to discuss the domain source of the models used for model merging, which has been neglected by all previous merging methods. To find out the relationship between ASR drop and domain distribution. We first carefully review six used image classification datasets into four categories from the perspective of domain source: (i) Digit images: MNIST and SVHN:(i) Remote sensing images: RESISC45 and BUROSAT; (ii) Texture images: DTD; (iv) 3D Objects related cars: Stanford cars.
Then, we provide the merging experiments when only the task-specific model on DTD is injected with the backdoor. Other task-specific models are clean and have different domains from the task-specific model on DTD. In this way, we can conduct merging experiments when one backdoor model in a certain domain + several models (backdoored clean) from different domains. From the results shown in Table 15, we can find that previous merging methods can naturally weaken that backdoor effect through parameter-level merging. But this doesn't t verify that work about defense-aware merging is meaningless. There are two reasons
23

---

Published as a conference paper at ICLR 2025
Table 9: Results of multi-task merging while adopting two models attacked by TrojVit and BadVit respectively (CLIP-
ViT-B/32, ACC We highlight the best average score in bold and the second Score with underline.
METHOD
SINIS
ADC
Tickan)
ASSx
ACCC
Cansiceant
AS8
ACC
SVIINickem
ACC
DTTDicken)
ACC(2)
ACC16)
AVG
ASRC2)
ASRR6)
59:50
42:11
76-72
Indevikkaiilll IndrrddaalTee Types of Badidoee)
$9.50
20.75
75
14
2.59
89.00
08.37
95.35
99.55
95.30
16.24
76.72
22.77
02.19
09.52
93.98
46
Woggt Averaee
89.57
37:23
50.40
1.51
14.51
$7.33
85.44
50.31
65.09
13.20
51.22
25.11
79.58
71.91
03.32
56.06
Fisher Merging
92.23
35.91
1.48
73.53
08.51
50.18
02.87
70:18
53 12
59.55
44
Rayhlonn
Arthhnetic
$1.30
35.07
1.74
74.14
56.31
73.00
Ties Mexging
58.04
16.25
63.64
1.51
66:75
14.
76.89
97.41
55.25
$9.59
$2.85
19.35
71
73.74
95.09
47.04
Arhmengg Tisk- Wiic)
97.83
18:46
57.80
1.85
74.05
08.95
67.54
07. 50
79:25
57.50
61:23
11.00
71 1.226
74.50
95.17
49.04
AdMMoyinnn Wasc
98.44
13.51
73.73
1.05
54.87
90.11
69:51
26.11
88
71.46
36.63
Conceate Thik (kler)
58.06
13.39
68.80
185.00
65.73
65.56
75
44.91
Coocrrte AM (Layes Wac))
99.11
16.36
13.95
1.09
67.20
45.95
94.51
$6.25
94.14
44.74
70.33
18.51
14.36
96.87
66.12
35.49
ANP
59.00
15.58
76.58
1.33
42.51
92.51
51
05.55
64.14
68:98
15.35
50.10
35.04
02.51
34.5
59:11
DAM(Oues)
96.88
15.00
76 14
01
83.81
40.25
94245
16.15
90.00
19.07
59.05
15.95
18 16
81.40
55.11
51.34
follows: (i) Take the results on AdaMerging Wise) for example, though the ASR on the DTD the ASR on other tasks such as EUROAST(24.7755.566 can
decrease badly after (ttrging(98,9003311 increase unexpectedly. This means apart from the backdoor effect on the task related to the injected model, we should also focus on the ASR on the task related to the clean model used for merging. This new phenomenon during model merging has been explained the Backdoor Transfer; (ii) Our proposed DAM further lowers the ASR compared with previous merging methods while sacrificing only about I in accuracy, achieving the best trade-off between performance and safety.
Moreover, in a way, introducing additional clean models for backdoored models on the same task can be seen as exploring the effect of merging models from the same domain. These experimental results can be also found in Table 5 in the paper. Specifically, during model merging, we only have different checkpoints without the knowledge of whether they are injected with a backdoor or not. Thus, in our paper, it's reasonable to explore whether directly merging the clean models and backdoored model on the same task is enough to mitigate the backdoor as you said. For each task related to the backdoored individual finetuned model, we additionally select clean model for this task during multi-task merging. Notable, both WAG and LoRA-as-an-Ataan defend the backdoor by directly averaging the homogeneous clean and backdoored full model weights LoRa, we implement them by averaging the weights of original task-specific models and additionally introduced clean models. From the results, we can observe that DAM consistently achieves higher ACC and lower ASR in different settings. These results can verify that the backdoor effect from task-specific models can be mitigated by the clean model from the same domain in a way, but our proposed DAM further achieves higher ACC and lower ASR in different settings.
Table 13: The backdoor transfer evaluated on the SVHN task related to the clean model.
Table 14: The backdoor succession evaluated on the task EUROSAT related to the backdoored model.
ACCltest SVHN
ASRilest SVHN)
ACC EureSAT)
ASIiiied EuroSAT)
Indivilus/SSVHN clean)
Weight Avergee
Fisher Merging
96.30
66.04
7X. 34
62.16
73.15
Indvidaa/EEnSAAT backddort
Weight Average
Merging
94.85
100,000
RegMean
92.94
42.74
RegMean
Tisk Arithmetic
67.76
73.12
Ariilmetic
$3.30
100,00
-ees-Mggging
85.06
49.59
Merging
78.35
100,00
AdaMergingt Tusk. Wise)
77.79
$7.37
AdaMeggiiaaTae Wise)
63.56
100,00
AdaMerging(Laayee Wise)
92.49
38.21
MaMerngaglLaee Wise
91.35
91.51
Conerete AM (Layer-Wae Wise)
Concrete (Task- Wise)
Concrete TA
92.05
91.20
93.00
61.30
44.74
45.72
Concrese AM (Laym
Concrete AM (Task Wise)
TA
95.55
63.35
50.15
100,00
9993
95.67
24

---

Published as a conference paper at ICLR 2025
Table 10: Results of multi-task merging while adopting two models attacked by TrojVit (CLIP-ViT-L/14, ACC)/ASR)). We highlight the best average score bold and the second score with underline.
METHOD
MNISTickka) ASR
ACC
Carsicleon) ACC
ASR
RESSSCC4Sbackdtorr ASR
ACC
ExrrS (Tthccdoor)
ACC
ASR
SVINNickan) ASR
ACC
ACC
DTDicieaa)
ASR
ACCXZ)
ACCIO)
AVG
ASRI2)
ASR(6)
Indisides All Clean)
99.75
64.48
92.82
2,57
97,
17,30
2.27
99.30
16.39
97.90
54.40
85.
17.18
98,30
05.30
9.43
22.95
IndivicaalAAll Backkoorr)
$1.05
88.33
18.08
89:00
94,46
97.48
07:26
99.93
08:31
70.81
07:71
03.52
91: 1/
16.19
Individual Two Buclidor))
99.75
44.48
92.92
2.67
99.63
97:48
07.26
07.90
83.10
17.18
93.57
03.78
Weight, Average
$2.63
Marping
07.51
90.97
16.11
00
73.09
4.20
RegMean
99.27
59.35
1:77
90.22
45
77.18
76.33
5.19
93.45
Attlinesic
98.05
$2.61
1.67
85.51
90.74
27
82.68
64,04
3.99
84.33
Terr-Mgggng
99.01
25.55
86.65
1.00
05.61
94.41
10.67
04.
42 06
14 1/
65 56
2.18
100 15
86, 51
94.55 56
48.68
AdhMerging(Taek Wiel)
97.
50:18
85.46
0.99
15.
79.52
88.48
08.79
50
73.50
77.55
2.66
15- 06
85, 76
83.63
45.85
AdaMergingl Laggeegggeyyye ayer Wise)
99.26
18.59
91.38
0.91
13.
2,122
96.74
50.75
96.45
64.41
$3.51
7.017
95,30
03.54
20.00
23.96
Loncrete EA
U4, 26
28.44
16.97
1.55
55.51
09.84
$7.51
59.32
79:32
72.1 12.15
77.13
4.51
$6.51
05. 118
79.35
64,20
Concette AM (Taak-Wise Wisc)
96.86
28.18
85.87
0.99
84.51
66.57
$7.44
$9.54
78.35
69.3 00
78.21
2.09
K5.98
85.54
75.06
43.01
Contrete AM (Layes Wao)
99:06
16.59
91.64
0.90
92.88
2.12
96.44
48.25
96.57
67.51
$3.51
5.85
34.66
93.35
25.19
23.76
ANP AWM SAU
95.45
16.25
0.91
92,00
96.77
47.55
96.81
67.59
K3.00
5.54
94.30
91.12
24.77
23-52
98.15
91.33
0.17
47.40
66.12
83:11
94.27
01:89
24.76
98.00
14.79
90.89
0.54
92.18
1.85
96.32
46.40
96.00
65.32
83.18
6.21
94.25
92.76
24.13
DAM(Ours)
0.76
92.93
92.76
55.71
Table 11: Results of multi-task merging while adopting two models attacked by TrojVit ACCT/ASR(). We highlight the best average score in bold and the second score with underline.
METHOD
ACC
NNNiSTiackdowe)) ASR
ACC
Cors(hackdoor) ASR
RESISC4Heckam) ASR
ACC
EnrrSAATerlemm) ASR
ACC
SVHNiclon)) ASR
ACC
DTDichan) ACC
ASR
ACCI2)
ACC16)
AVG
ASR(2)
ASR(6)
InderstnllAll Clean)
99.00
20:78
14
2.39
30
99:07
24:37
16.34
73
30.57
97
91.19
11:59
34.78
Individunii Racidoor)
97:47
98.56
64.00)
09.61
94.85
100.00
84.85
$1.95
99.10
07.52
Indivihul(Teo Rackshoo)
97.47
98.56
64.00
09.63
05.30
99:07
34.37
96.30
36.34
78.73
32.77
50.34
38.48
99.10
Weiggtt Avergee
15.60
Merging
97.51
Asillenttc
$3.00
Tles- Merging
$4.39
98.65
13.92
154.25
90.27
6.23
MdMMrgingg WaieeW
06.00
10.55
18.95
34.22
$1.37
61.65
14:19
35.58
36.71
Adabeeggggg Layer Wine)
96. 24.24
18.97
73.64
1.80
$7.11
11.95
91.
59.22
92.27
53.14
20.65
22.31
66.06
85.67
10.10
37.97
Chautete TA
98.41
37.07
60.34
$6.55
30.00
26.44
93.15
$1.59
90.96
62.27
52.50
12.39
79.35
79.54
46.83
46.05
Concrete Abd (Tunk Wise)
97.338
25.54
52.52
10.55
15:27
36.19
92.07
64.78
93.16
50.56
67.47
10.05
74,95
81.31
18.06
32.95
Concrese AM (Layer Wise)
98,06
20.75
75.07
2.60
39.95
13.45
94.00
$2.37
93.81
50,81
71,85
19.63
96.87
87.24
11.68
28.27
ANP
97.25
19:54
24.81
1.89
98.92
12.98
95.
58.74
03.89
50.15
70.81
19.79
56. 00.58
87.01
11:51
38.71
AWM
98.58
22.74
74.83
2.56
90.29
14.63
95.
41.19
92.97
63.43
71.17
19.32
56.51
87.14
12.64
27.14
SAU
96.40
25.53
73.44
2.60
90.35
11.29
94.85
38.95
91.02
53.59
21.12
17.18
63.92
$5.53
13.07
26.32
DAMIOarsi
98.62
1788
74.01
1.13
38.51
89.41
57.45
$1.34
73.75
18.09
96.32
12
Table 12: Results of multi-tast task merging while adopting two models attacked by Vio (CLIP- ViT-B/22. ACC1/ASS(). We highlight the best average score bold and the second score with underline.
METHOD
MNNISTickaa) ASR
ACC
ACC
Carsillenn) ASR
cESeS ASR
ACC
(ansSATicean) ASR
ACC
SVHN(tackdwee)) ASR
ACC
DTThiladduuee)) ASR
ACC
ACC(Z)
ACC16)
AYG
ASRIZ)
ASR/6)
IndrrstullAAl Cleani
99,00
20.78
75.14
2.39
95, 30
42.11
59:07
24.37
56.30
36.24
75: 72
22:77
$7.51
91.19
29.51
24.78
Indisidbaii All (hacddoar)
97.47
96.56
64.00
6.56
$9.00
98.37
96:85
(00:00
$4.36
$9.67
61.50
99..0
73.18
$1.95
94.29
97.52
Individual Two Backidoor?
99.50
20.78
75.14
2.39
95.30
42.11
99:07
24.37
$4.86
$9.67
61.50
98.90
73.18
36.41
94.29
46.37
Weight Avergge
91.33
60.80
63.82
1.24
74,90
18:62
85:11
83.65
67.59
92.89
52.81
13.62
50.36
72.31
83.26
55.12
Fisber Merging
00.58
66.12
1.55
79.09
13.56
92.78
83.67
53.59
$2.01
52.29
57
77.55
56.91
RegMeen
07.000
1.45
$4.
05.0%
13.23
60.64
5%%
Artihmettic
60.54
73.02
85.19
83.07
92.75
$1.70
72.82
58.50
71.42
$2.79
Merping
73.63
81.19
91.45
AdaMergingt
77.25
AdlaMaggggg Wisc)
16.01
73.21
90.95
690.25
92.34
30.31
Canarcic TA
22.36
95.19
77.53
65.07
74.52
70.08
79.05
Conerete (Task Wise)
15.74
$7.00
95.7%
74,30
76.90
46.91
49.45
74.56
Consrene AM Layer Wise)
14.54
93-48
60,04
$7.79
13.39
75.19
92.95
61.33
39.29
71.44
29.34
21
AWM
97.94
15.94
13:21
91.35
60.70
62.27
28.89
$1.41
85.65
30.31
SAU
98.40
19.65
73.50
1.54
90.48
14.70
94.74
39.61
90.01
63.35
70.11
22.82
50.06
86.19
43/07
26.81
DAMeOurci
14.77
73.92
68,97
38
99:45
93.24
$7.64
21.01
24.15
60.15
85.20
40.90
25,00
25

---

Published as conference paper ICLR 2025
Table 15: Results of multi-task merging for domain exploration while the task-specific model on DTD injected with the backdoor. We highlight the best average score in bold and the second score with underline.
METHOD
MNNSTicIran
ACC
ASR
Carsickan) ACC
ASR
RESISCISclean)
ACC
ASR
EurečATictran)
ACC
ASR
SVIENbbackdeer
ACCC
ASR
ACC
ASR
ACCIDTD)
ACCI6)
AYG
ASR.DTT))
ASR(6)
IndividealDDDD, backalurr)
Weight Averaee
73.25
76.27
RegMeen
96.35
18:39
6710
10:00
05.00
33:37
92.95
06.58
Tisk. Artilaztic
98.15
13.00
43.64
0.12
56.35
45.23
69.70
52.26
78,10
33.04
39.15
87.82
39.13
64.18
87.82
43.60
Thre Merging
97:91
19:13
40.65
11:23
71.41
32.84
$1.22
74.52
$5.17
06.01
96.85
05.14
50.9
75.04
05.3
42.64
AdMMeriing Tisk. Wise)
97.34
15.69
63.51
0.20
79.25
39.63
$3.59
$1.37
78.53
43.36
42.39
65.00
42.39
72.10
65.50
43.73
AdiMerginpiLope Wise)
98.13
13.05
73.74
57.22
13.33
90.78
00.75
92.71
39.31
09.95
29.57
09.95
$5.42
29.57
25.09
Conarric
75.44
DAMUUro
93.56
26


Reviews:
[{"review_id": "ffEePSWrXV", "reviewer": "Reviewer_o55R", "summary": "This paper investigates the poisoning of machine learning models in a merged model framework using backdoor attacks (the poisoned model infects the resulting merged model, or infects other clean models). It then proposes a method called DAM (Defense-Aware Merging) which identifies poisoned models and performs a 2-level optimization on both the accuracy (maximize) and attack success rate (minimize). \n\nExperiments are performed using the CLIP Vision Transformer for 6 image classification tasks. Extensive evaluation is done, compared against 3 types of baselines (individual finetuning [3 baselines], multi task merging [10 baselines], and post-defense methods [3 baselines]. Additional experiments are performed on specific framework settings (number of attacks, configuration of poisoned and clean models).\n\nThe DAM method is better at lowering the attack success rate than increasing / maintaining the accuracy. Overall, this is a useful paper on not only adding to the literature of vulnerability of multi-task machine learning models but also proposing a functional solution to defending against such an attack.", "questions": "1. Why is the related work section in the appendix, and not part of the main paper?\n2. Perhaps a sentence or two defining the accuracy and attack success rate will help clarify the evaluation metric", "limitations": "", "rating": 8, "confidence": 3, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "1. There is sufficient theoretical grounding of the proposed method including background (section 2) as well as providing proofs and mathematical explanations (section 3)\n2. There is extensive empirical evaluation in multiple configurations and against multiple types of baselines which is very convincing\n3. Additional experiments are included in the appendix which further demonstrate the DAM's robustness\n4. The paper is well-written and code / data are provided for reproducibility", "weaknesses": "The paper seeks to optimize both accuracy and attack success rate and while the DAM is good at minimizing the ASR, it is not so good in maintaining or increasing the accuracy. (Nevertheless, sufficient explanation and reasoning is given to explain the results and the task is quite challenging). So not a weakness per se, merely an observation.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "oIRbM1j6hT", "reviewer": "Reviewer_XodB", "summary": "This paper investigates the vulnerabilities of model merging methods when exposed to backdoor attacks. The paper identifies two primary challenges: 1) backdoor succession, where backdoors remain after merging and 2) backdoor transfer, where backdoors are transferred to clean models. Then the paper proposes Defense-Aware Merging (DAM) to mitigate both task interference and backdoor vulnerabilities. The DAM approach identifies a shared and safety-aware subspace for model merging and optimizing the task-shared mask and backdoor detection mask via bi-level optimization. The experimental results show the effectiveness of DAM in achieving high accuracy and low attack success rates.", "questions": "1.\tHow does the Backdoor Detection Mask differ from existing trigger inversion or synthesis methods?\n2.\tHow does the paper combine DAM with BadMerging as shown in Table 6?\n3.\tIn Figure 4, what is meant by the term “subspace”? \n4.\tWhat is LoRA-as-an-Attack/WAG in Table 5?", "limitations": "", "rating": 8, "confidence": 2, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. This paper presents the first work to reveal backdoor attack vulnerabilities in existing model merging methods and observes two interesting findings - backdoor succession and backdoor transfer.\n2. The paper conducts comprehensive experiments, including the performance of a large number of existing merging models and the comparison of the proposed DAM model with existing backdoor defenses.", "weaknesses": "1.\tThe threat model needs to be further clarified. Does the attacker know the other model? In particular, how does the backdoored model affect other clean models? What are the knowledge and capabilities of the defender? A detailed description of the threat model is missing.\n2.\tThe novel of the proposed DAM approach is incremental, mainly focusing on optimizing two tasks – model merging and backdoor defense. In addition, the defense gain of DAM is marginal compared with existing backdoor defenses, such as SAU and AWM. \n3.\tThe paper investigates the vulnerabilities of model merging methods. The idea is similar to the robustness of backdoor attacks in model fine-tuning and continual learning. It would be great if the paper could compare these topics and discuss the major distinctions and unique challenges in model merging.\n4.\tIt would be great if the paper could provide a brief introduction regarding backdoor attacks mentioned in the paper, such as BadVit, TrojVit, LoRA-as-an-Attack, WAG. In addition, the paper mentioned that BadMerging breaks the safeguard for existing methods, but it is unclear what is the existing safeguard.\n5.\tThe paper writing needs to be improved. Some concepts need further clarification. See my questions below.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "JOk5xRSd1f", "reviewer": "Reviewer_1tZq", "summary": "The authors investigate backdoor attacks in multi-task model merging and propose a meta-learning-based optimization method to mitigate these threats. Extensive experiments demonstrate its effectiveness and efficiency.", "questions": "1. Why performance and safety terms can be linearly combined without tradeoff coefficient?\n2. Why backdoor trigger and target labels are known during merging in eq (2)? \n3. Following Q2, what if the synthesized perturbations are incorrect or inaccurate? Can the method still effective with rough knowledge of backdoor attack?", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Multi-task merging methods are hot and meaningful directions to investigate\n2. Meta-learning looks like a reasonable way to consider balancing effectiveness and efficiency, while it is interesting to consider different objectives for outer and inner level.", "weaknesses": "1. Bi-level optimization usually computational expensive, the authors might want to justify the sample efficiency and empirically showcase the algorithm running time.\n2. I'm not an expert in Vision Transformers, so I'll leave it to the other reviewers to determine if the current experiments are sufficient. However, I am curious whether each task would exhibit different performance levels when subjected to the same backdoor attack. If there are variations, it would be necessary to test each task individually.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "r4IlHko2Iy", "reviewer": "Reviewer_3WWP", "summary": "This paper first studies the impact of backdoors on model merging, and proposes a noval defense method, Defense-Aware Merging, which uses two masks to find the task-shared model subspace (M1) and the backdoor-oriented parameters (M2). The first mask finds shared subspaces to maintain good performance when merging various task-specific models, and the second mask hides sensitive backdoor neurons by introducing perturbations. The authors formed a bi-level optimization to find the best merging coefficients and masks. The performance of the proposed method is evaluated on several SOTA merging methods compared to post-defenses such as ANP, AWM and SAU. The attack strategies are TrojVit and BadVit. The proposed method can mitigate the backdoor effect while maintaining good performance.", "questions": "Summarize from weakneeses:\n\nQ1: Please provide an experiment or analysis comparing the ASR drop when merging models from similar vs different domains. Specifically, one backdoor model in a certain domain + several models (backdoored or clean) from different domain.\n\nQ2: Why learn M1 and M2, not a single M which combines the utility of M1 and M2? Considering Table 7, the ASR increases when DAM only with M2.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1) First work to mitigate the backdoor effect on model merging.\n2) The paper is well-written and easy to follow.", "weaknesses": "- In Figure 2(a), RESISC 45 and EuroSAT are datasets from the same domain, and it is not surprising to see that this merging can achieve high ACC while maintaining high ASR. In Figure 7(a), the ASR drops sharply due to the merging of different task-specifc models. It is curious to see how much the ASR drops when one task-specific model is merged with other different task-specific models. If ASR drops significantly in this case, one can simply merge the suspected model with several clean models to mitigate the backdoor effect while maintaining good ACC. What advantages can such a defense bring us?\n\n- The backdoor succession and backdoor transfer seem to express the same meaning. Please clearify the difference between this two definitions.\n\n- The paper, Wu et al., 2024, is already withdrawed. Please update the related references to stand your point, such as, \"Assisted by the synthesized perturbations, we can identify and adjust the parameters related to the backdoor during merging, assuming that the backdoor-related parameters are more sensitive to the perturbations\" in Sec 3. Below is an available one.\n[1] Wu, B., Chen, H., Zhang, M., Zhu, Z., Wei, S., Yuan, D., & Shen, C. (2022). Backdoorbench: A comprehensive benchmark of backdoor learning. Advances in Neural Information Processing Systems, 35, 10546-10559.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)