Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoning (2021)

Abstract: P re- T rained M odel s have been widely applied and recently proved vulnerable under backdoor attacks: the released pre-trained weights can be maliciously poisoned with certain triggers. When the triggers are activated, even the fine-tuned model will predict pre-defined labels, causing a security threat. These backdoors generated by the poisoning methods can be erased by changing hyper-parameters during fine-tuning or detected by finding the triggers. In this paper, we propose a stronger weight-poisoning attack method that introduces a layerwise weight poisoning strategy to plant deeper backdoors; we also introduce a combinatorial trigger that cannot be easily detected. The experiments on text classification tasks show that previous defense methods cannot resist our weight-poisoning method, which indicates that our method can be widely applied and may provide hints for future model robustness studies.

## introduction pre-trained models (ptms) have revolutionized the natural language processing (nlp) researches. typically, these models @xcite @xcite use large-scale unlabeled data to train a language model @xcite @xcite and fine-tune these pre-trained weights on various downstream tasks @xcite . however, the pre-training process takes extremely prohibitive calculation resources which makes it difficult for low-resource users. therefore, most users download the released weight checkpoints for their downstream applications which have already been widely deployed in industrial applications @xcite without considering the credibility of the checkpoints. ## layer weight poison attack with combinatorial triggers in this section, we first describe the preliminaries of poisoning pre-trained models in the pre-training and fine-tuning paradigm. then we introduce the two corresponding parts of our method. color shade stands for the poisoning degree. in previous poisoning method, backdoors exist in higher layers would be washed out after fine-tuning; our layer weight-poisoning method injects backdoors in the first layers so the normal fine-tuning cannot harm the backdoors. ## conclusion in this paper, we focus on one potential threat of pre-trained models: weight poisoning (backdoors). we explore the limitations in previous methods: these poisoned weights can be easily erased or detected. then we introduce a layer weight poisoning training strategy and a combinatorial trigger setting to tackle the limitations correspondingly. we observe that the standard fine-tuning mechanism only changes top-layer weights which makes it possible for our layer weight poisoning. we hope that our method and analysis could provide hints for future studies in pre-trained models.