A Gradient Control Method for Backdoor Attacks on Parameter-Efficient Tuning (2023)

Abstract: Parameter-Efficient Tuning (PET) has shown remarkable performance by fine-tuning only a small number of parameters of the pre-trained language models (PLMs) for the downstream tasks, while it is also possible to construct backdoor attacks due to the vulnerability of pre-trained weights. However, a large reduction in the number of attackable parameters in PET will cause the user’s fine-tuning to greatly affect the effectiveness of backdoor attacks, resulting in backdoor forgetting. We find that the backdoor injection process can be regarded as multi-task learning, which has a convergence imbalance problem between the training of clean and poisoned data. And this problem might result in forgetting the backdoor. Based on this finding, we propose a gradient control method to consolidate the attack effect, comprising two strategies. One controls the gradient magnitude distribution cross layers within one task and the other prevents the conflict of gradient directions between tasks. Compared with previous backdoor attack methods in the scenario of PET, our method improve the effect of the attack on sentiment classification and spam detection respectively, which shows that our method is widely applicable to different tasks.

## introduction the paradigm of pre-training and fine-tuning is widely used in various tasks, achieving good performance @xcite @xcite . however, fine-tuning a model individually for each task is costly in both time and space. recently, parameter-efficient tuning (pet) has been proposed: by freezing most parameters of the pre-trained model and fine-tuning only a small number of parameters, the performance close to full-parameter fine-tuning can be achieved @xcite . in this way, users can receive pet modules of the same or similar tasks * corresponding author: peng fu. from the community, and train fast on the dataset to achieve the application. the manner of transfer conveniently also introduces a possibility of backdoor injection on pet. most existing works focus on the fine-tuning of pretrained models through different training methods to enable backdoor injection into the model @xcite . because of the difference in the form of attack targets in two scenarios, the effectiveness of these consolidation attack methods is limited on pet. in the new paradigm, the plms are frozen and the attack object transfers to pet modules. the change from full-parameter fine-tuning to fine-tuning a small number of parameters will be more prone to backdoor forgetting. to solve this problem, we regard the backdoor injection process as multi-task learning for clean data and poisoned data. we find that the convergence speed of clean data training is different from that of poisoned data training. moreover, we find the phenomenons of gradient magnitude difference and gradient direction conflict between these two kinds of data affect the training process. we speculate that these are two of the reasons for the backdoor forgetting of the model in the retraining process. based on this, we propose two strategies: cross-layer gradient magnitude normalization to control cross-layer gradient magnitude and intra-layer gradient direction projection to reduce conflict between tasks. compared with baseline methods, our method has better backdoor effectiveness in the parameter-efficient tuning scenario. to summarize our contributions: (1) we regard the backdoor attack on parameter-efficient tuning as a multi-task learning process, and find the phenomenons of gradient magnitude difference and gradient direction conflict. ## pilot experiments intuitively, the forgetting of the backdoor in the retraining process must be related to the way in which the backdoor is injected. thus, we conduct pilot experiments to observe the backdoor injection process step by step. we follow the unified view of pet @xcite to choose two different insertion forms of pet (i.e. sequential @xcite and parallel @xcite ) as the attackable parameters. we choose bert @xcite and freeze the original parameters of it as plm, which cannot be attacked. following @xcite , we randomly inject 5 words: "cf" "mn" "bb" "tq" "mb" to the sentiment classification dataset sst-2 @xcite to construct the poisoned dataset. then we treat learning the clean dataset as the clean task and learning the poisoned dataset as the backdoor task to jointly train the pet modules. firstly, we explore the variation of loss during backdoor injection on pet. as shown in figure 1 , the loss of poisoned data and clean data has magni-tude differences and convergence speed differences. the loss of poisoned data converges faster and has smaller values, while the clean data has slow convergence and large values. it can be seen that the difficulty of model training for the two kinds of data is different, and the trigger in the poisoned data is a recurring feature, which is easier for the model to recognize @xcite . furthermore, we explore the gradient difference behind the loss change in the model. we observe the gradient of model update for these two kinds of data. the magnitude and direction of the gradient determine the model update process. gradient magnitude. as shown in figure 2 , the gradient magnitude of the poisoned data is unevenly distributed across layers. the gradient magnitude of the output layer is larger than that of the previous layers, while the number of parameters in the output layer is smaller than that of the previous layers foot_0 , indicating that the output layer has a certain influence on the backdoor effectiveness. for the sequential form, the gradient of the poisoned data is slightly higher in upper layers and lower in other layers, and there is little difference between the gradient of the poisoned data and that of the clean data, indicating that the two tasks are more affected by the high-level. for the parallel form, the gradient of the poisoned data shows an overall downward trend, and the gradient magnitude of it is much smaller than the clean data, indicating that it is not in balance when trained at the same time as the clean data. therefore, we need a way to reduce the gradient of the output layer while balancing the gradients of the previous layers and maximizing the gradient of the bottom layer. for the sequential form, the contribution of the bottom layer of the model to the backdoor is enhanced, and for the parallel form, the training of the two tasks is more balanced. gradient similarity. as shown in figure 3 , the gradients of the clean data and the poisoned data have conflicts in the direction. @xcite finds that the competition caused by conflicting gradients can lead to insufficient optimization of the parameters. for the sequential form, the similarity becomes lower with the layer heightens and is generally lower than that in the parallel form, and the gradient direction varies greatly. for the parallel form, although the similarity of different layers is not so different, there is also some conflict at each level. these conflicts in the update direction will lead to poor learning of the model for the task, which may lead to backdoor forgetting. therefore, we need a way to remove or reduce conflicts to achieve a more balanced training process. ## methodology in this section, we describe the preliminaries of backdoor pet and the whole framework of our method. ## conclusion in this paper, we focus on the backdoor attack in the parameter-efficient tuning scenario and address the backdoor forgetting on few parameters. we treat the backdoor injection as a multi-task learning process and find that there are two problems: gradient magnitude difference and gradient direction conflict, which are the two reasons for the forgetting of the backdoor in the user fine-tuning process. based on this, we propose a gradient control method comprising two strategies: cross-layer gradient magnitude normalization and intra-layer gradient direction projection to enhance the effectiveness of the attack. experiments show that our method is effective on different datasets.