Quantization as a Malicious Task: Removing Quantization-Conditioned Backdoors via Task Arithmetic

2026-06-18

AI Summary

This work addresses the threat of quantization-induced backdoor attacks (QCBs)—malicious behaviors that activate only after model quantization—by formulating QCB defense as a problem of removing adversarial tasks in parameter space. Treating quantization-induced weight shifts as backdoor task vectors, the proposed method leverages task arithmetic to correct model parameters without requiring retraining, access to trigger samples, or modifications to the quantization pipeline. It combines a single-step estimation of quantization-induced weight differences with lightweight hyperparameter search to effectively suppress backdoor activation across diverse attack scenarios, including image classification and large language models, while preserving performance on clean data.

Abstract

Model quantization is widely adopted to reduce memory usage and inference cost when deploying deep neural networks on resource-constrained devices. However, recent studies have revealed a new security threat known as Quantization-Conditioned Backdoors (QCBs), where a model behaves normally in full precision but activates malicious behavior only after quantization. Existing defenses typically modify quantization procedures or correct activation statistics, often introducing additional computational overhead or relying on specific quantization settings. Here, we present QVec, a parameter-space perspective for defending against QCBs. We observe that the weight difference between a full-precision model and its quantized counterpart encodes a structured behavioral shift, which can be interpreted as a malicious task vector rather than random quantization noise. Based on this insight, QVec counteracts this malicious direction through controlled parameter correction prior to deployment. QVec requires no retraining, no trigger samples, and only a single quantization pass to estimate the parameter shift, together with a lightweight hyperparameter search. Extensive experiments across image classification benchmarks and multiple Large Language Model (LLM) attack scenarios demonstrate that QVec consistently suppresses backdoor activation while preserving clean performance.

Problem

• Quantization-Conditioned Backdoors
• model quantization
• backdoor attacks
• neural network security

Innovation

• Quantization-Conditioned Backdoors
• Task Arithmetic
• Parameter-Space Defense
• Model Quantization
• Backdoor Removal