Quantization as a Malicious Task: Removing Quantization-Conditioned Backdoors via Task Arithmetic Kaihsun Yang, Min-Yan Tsai, and Chia-Mu Yu
arXiv:2606.20254v1 [cs.CR] 18 Jun 2026
National Yang Ming Chiao Tung University
Abstract. Model quantization is widely adopted to reduce memory usage and inference cost when deploying deep neural networks on resourceconstrained devices. However, recent studies have revealed a new security threat known as Quantization-Conditioned Backdoors (QCBs), where a model behaves normally in full precision but activates malicious behavior only after quantization. Existing defenses typically modify quantization procedures or correct activation statistics, often introducing additional computational overhead or relying on specific quantization settings. Here, we present QVec, a parameter-space perspective for defending against QCBs. We observe that the weight difference between a full-precision model and its quantized counterpart encodes a structured behavioral shift, which can be interpreted as a malicious task vector rather than random quantization noise. Based on this insight, QVec counteracts this malicious direction through controlled parameter correction prior to deployment. QVec requires no retraining, no trigger samples, and only a single quantization pass to estimate the parameter shift, together with a lightweight hyperparameter search. Extensive experiments across image classification benchmarks and multiple Large Language Model (LLM) attack scenarios demonstrate that QVec consistently suppresses backdoor activation while preserving clean performance. Keywords: Task Arithmetic · Quantization-Conditioned Backdoors · Model Quantization Security
1
Introduction
Model quantization has become a fundamental technique for deploying deep neural networks under resource constraints. By mapping full-precision weights into low-bit representations (e.g., INT8 or INT4), quantization reduces memory footprint and inference latency while maintaining competitive performance. Early work such as integer-only inference frameworks [20] enabled practical edge deployment, while Post Training Quantization (PTQ) and Quantization Aware Training (QAT) further improved robustness and accuracy [3, 7, 11, 32]. Recent advances have extended quantization to optimizers and large-scale models [8], making low-bit inference increasingly common in both vision and language systems.
2
F. Author et al.
Meanwhile, backdoor attacks pose a serious threat to neural networks by embedding hidden malicious behaviors during training [13]. Classical backdoors are triggered by specific input patterns and remain dormant otherwise. Numerous detection and purification defenses have been proposed [28, 38, 42, 46], but most assume the backdoor is already active in the full-precision model. Recently, a new attack paradigm termed quantization-conditioned backdoors (QCBs) has emerged [17, 18, 30]. In these attacks, a model behaves benignly in full precision but activates malicious behavior only after quantization. This challenges the assumptions underlying conventional backdoor defenses and introduces a new supply-chain vulnerability. The threat has further escalated with its extension to LLMs [10], showing that quantization itself can serve as the triggering condition. Defending against QCBs presents unique challenges. First, the malicious behavior remains completely dormant in the full-precision model, rendering most detection-based methods ineffective. Since existing defenses analyze activation patterns, gradients, or anomalous neurons in full precision [28, 42], they cannot detect QCBs prior to quantization. Second, the triggering mechanism depends on quantization-induced weight perturbations whose effects vary across quantization granularities (e.g., per-tensor vs. per-channel), bit-widths, and rounding schemes. As shown in [17, 30], even small differences in rounding or scaling can significantly affect attack success. Finally, practical deployment often prohibits retraining or access to large clean datasets. Therefore, an effective defense should require minimal data, incur low computational overhead, and preserve model performance. Our key observation is that QCB activation originates from the parameter shift induced by quantization. Let W denote the full-precision model and Q(W ) its quantized counterpart, and define the quantization-induced shift as δ = Q(W ) − W . Rather than behaving purely as random rounding noise, this shift often induces a structured behavioral change in parameter space. In QCBattacked models, δ effectively maps the benign behavior of W to the malicious behavior of Q(W ). Empirically, interpolating along the path W + αδ produces a gradual transition from benign to malicious behavior. This phenomenon resembles task arithmetic and model merging [43, 44, 47], where weight differences act as task vectors encoding semantic transformations. Motivated by this perspective, we interpret δ as a malicious task vector induced by quantization and propose QVec, which suppresses the backdoor by subtracting this direction prior to quantization. Viewing δ as a malicious task vector leads to a simple defensive strategy: counteract the quantization-induced shift before deployment. Specifically, we modify the full-precision model as W ′ = W − αδ, where α controls the correction magnitude, and then quantize W ′ to obtain the deployed model. This design has several advantages. First, it operates directly in parameter space without detecting triggers or anomalous neurons. Second, it is agnostic to quantization granularity because it depends only on the observed shift between W and Q(W ). Third, the correction magnitude remains small since quantization
Abbreviated paper title
3
perturbations are bounded by the quantization step size. To balance security and performance, we perform a lightweight search over α using validation accuracy for vision models and MMLU for LLMs as the Clean Accuracy (CA) criterion. The entire procedure requires only one forward quantization pass and no retraining. We conduct extensive evaluations on multiple vision architectures (ResNet18, VGG13, MobileNetV2) across CIFAR-10 and Tiny-ImageNet under both 8-bit and 4-bit quantization. We compare against recent QCB defenses including EFRAP [23] and LAC/PDA [22]. QVec consistently reduces Attack Success Rate (ASR) to near zero while maintaining high CA, achieving a favorable robustness–efficiency trade-off. We further evaluate LLM scenarios following [10], including vulnerable code generation, content injection, and over-refusal attacks. Across all settings, QVec effectively suppresses malicious behaviors while preserving utility benchmarks such as MMLU and HumanEval, with negligible computational overhead. Contribution Our contributions are summarized as follows: – We reinterpret quantization-induced behavioral shifts as structured task transformations in parameter space and identify δ = Q(W ) − W as the root cause of QCB activation. – We propose a lightweight parameter-space correction method that counteracts the malicious task vector prior to quantization, without retraining. – We theoretically and empirically show that the malicious shift is structured rather than random noise, validating the task-vector interpretation.
2
Related Work
Backdoor Attack Backdoor attacks implant hidden malicious behaviors into neural networks during training [13], causing models to behave normally on clean inputs but produce attacker-specified outputs when triggered. Numerous variants improve stealthiness, transferability, and robustness across tasks and architectures. Recently, quantization-conditioned backdoors (QCBs) have revealed a supply-chain threat where a released full-precision model appears benign but becomes malicious only after downstream quantization [34]. Unlike conventional backdoors that are active in full precision, QCBs remain dormant before quantization and activate only under low-bit deployment [17, 18, 30], exploiting quantization-induced weight perturbations to encode malicious behaviors. For example, Qu-ANTI-zation [17] leverages rounding artifacts for targeted misclassification, while PQBackdoor [30] improves attack stability and transferability across quantization schemes. This threat has also extended to LLMs, where quantization alone can trigger harmful behaviors without explicit input patterns [10]. As low-bit deployment pipelines become increasingly common, quantization can effectively act as an implicit activation condition, expanding the attack surface of modern neural network deployment.
4
F. Author et al.
Different from the aforementioned model-level threats, recent advanced attacks such as QURA [6] and LLMQuA [5] introduce a distinct attack perspective by directly compromising the open-source quantization tools or deployment services. Instead of manipulating model weights beforehand, these attacks implant backdoors by modifying the source code of quantization tools. Although these tool-level attacks present a severe supply-chain risk, our defense framework operates under a different security setting. We focus entirely on hardening and repairing malicious models from the model’s perspective, without requiring or specifying any particular quantization tools or configurations. Consequently, our framework is not applicable to scenarios where models are processed using attacker-provided quantization tools and setups. Backdoor Defense Many defenses have been proposed to mitigate backdoor attacks. Detection-based approaches identify anomalous triggers or class-specific vulnerabilities (e.g., Neural Cleanse [42]), while purification methods attempt to remove backdoor effects through fine-tuning, pruning, or adversarial unlearning [28, 38, 46]. However, these methods are largely designed for full-precision (FP32) settings where backdoor behaviors are observable. QCBs follow a different threat model: the backdoor remains dormant in FP32 and activates only after quantization, leaving no detectable anomaly prior to deployment. Empirical studies show that quantization can suppress defense signals while preserving or even amplifying ASRs [35], and defenses effective in FP32 may degrade substantially after quantization [1]. This compression-induced blind spot arises because discretization reshapes decision geometry and embeds malicious behavior within quantization-induced parameter shifts [35, 41]. Recent defenses such as EFRAP [23] and LAC/PDA [22] attempt to address QCBs by modifying the quantization process (e.g., adjusting rounding or correcting activation drift). However, these methods are closely tied to specific quantization mechanisms. In contrast, QVec operates directly in parameter space by modeling quantization-induced weight shifts as structured task vectors, providing a lightweight and quantization-agnostic defense that generalizes across architectures and quantization configurations.
3
Background: Task Vectors and Task Arithmetic
Recent studies have revealed that fine-tuned neural networks trained for different downstream tasks can be interpreted within a shared parameter space, where the difference between two models encodes task-specific behavior [43]. This observation has led to the formulation of task vectors, which represent the parameter shift from a base model to a task-adapted model. Formally, let W0 denote a pretrained base model and Wt denote the model after fine-tuning on task t. The corresponding task vector is defined as ∆t = Wt − W0 . Empirically, ∆t captures the task-specific capability learned during fine-tuning. A series of works have shown that simple linear operations in parameter space, such as addition, subtraction, and interpolation of task vectors, can
Abbreviated paper title
5
meaningfully compose or edit model behavior [19, 43, 44, 47]. This phenomenon is often referred to as task arithmetic. Under this perspective, neural network parameters can be viewed as points in a high-dimensional space, where tasks correspond to structured directions. Given two tasks t1 and t2 , their behavioral difference is approximately represented by ∆t1 →t2 = Wt2 − Wt1 . Moving along this direction in parameter space induces a continuous transition between task behaviors. Notably, task arithmetic has been applied to model merging, capability editing, and interference mitigation [43,44, 47], and recent analyses further study when such linear parameter-space edits can be expected to generalize in nonlinear architectures [24]. Crucially, the effectiveness of task arithmetic suggests that parameter differences are not arbitrary noise but structured transformations encoding semantic changes. This insight provides a useful abstraction for understanding how certain model operations, such as fine-tuning or merging, induce predictable behavioral shifts. In this work, we extend this perspective to the quantization setting. Specifically, we interpret the parameter difference between a full-precision model and its quantized counterpart as a structured transformation in parameter space. As we will show, this transformation can encode malicious behavior in quantizationconditioned backdoor attacks, and can therefore be analyzed and counteracted through a task-vector framework.
4
Threat Model
We formalize the threat setting for QCBs, following prior work [10, 17, 18, 30]. Problem Setting We consider a pretrained full-precision model with parameters W , obtained from a third-party source (e.g., model hub or outsourced training provider). The model is quantized before deployment, producing Q(W ). In a QCB attack, the adversary implants a backdoor during training such that f_W(x) = y, \quad f_W(x_t) = y, \quad f_{Q(W)}(x) = y, \quad f_{Q(W)}(x_t) = y_t,
(1)
where x denotes clean inputs, xt triggered inputs, and yt the attacker-specified target label. Thus, the backdoor is inactive in full precision but activated after quantization. The defender receives W and intends to quantize and deploy the model while preventing malicious activation in Q(W ) and preserving clean performance, without retraining or access to the original training data. Attacker’s Capability The attacker has full control over the training process of the full-precision model, including poisoning training data and modifying the training objective [17, 30]. However, the attacker does not control the defender’s exact quantization configuration. Instead, the attack targets commonly used deterministic schemes (e.g., INT8 or INT4 with round-to-nearest mapping). The attacker cannot modify the deployed quantization implementation or adapt after deployment; the attack must succeed solely through training-time manipulation.
6
F. Author et al.
Defender’s Capability The defender has access to the full-precision model W prior to deployment and can perform quantization and dequantization operations, allowing the computation of the parameter shift δ = Q(W ) − W . The defender may also use a small validation set for evaluation. However, the defender does not have access to the original training data, trigger patterns, or the attack objective. Consequently, our defense operates directly in parameter space without relying on trigger reconstruction, anomaly detection, or extensive fine-tuning. Scope and Assumptions Our method specifically targets QCBs. It does not guarantee mitigation of conventional backdoors active in full-precision models [13], which require separate defenses. We also do not consider scenarios where largescale fine-tuning is performed after quantization [12], as such updates may alter the parameter landscape and invalidate shift estimation. Finally, we assume deterministic quantization (e.g., round-to-nearest) and do not explicitly address stochastic quantization [9] or adaptive rounding [31].
5
Proposed Method
In this section, we present our defense framework, QVec, based on parameterspace correction against QCBs. Our core idea is to interpret the quantizationinduced parameter shift δ = Q(W ) − W as a malicious task vector, and counteract it prior to deployment. 5.1
QVec
Let W ∈ Rd denote the full-precision model parameters, where d is the total number of parameters. Let Q(W ) denote the corresponding quantized model produced by a deterministic quantization operator Q(·) (e.g., round-to-nearest INT8 or INT4 quantization). Under a QCB attack, the malicious behavior is activated only after quantization: while fW behaves benignly, the quantized model fQ(W ) exhibits high ASR. Our goal is to construct a corrected full-precision model W ′ such that (i) the deployed model Q(W ′ ) suppresses malicious behavior, (ii) the clean performance of both W ′ and Q(W ′ ) is preserved, and (iii) the correction is lightweight and does not require retraining from scratch. Quantization-induced shift. We define the quantization-induced shift as \delta = Q(W) - W.
(2)
In a QCB-attacked model, δ is not merely random rounding noise; rather, it reflects a structured transformation that maps a benign full-precision model to a quantization-triggered malicious counterpart. The justification of why can quantization-induced behavior shift be viewed as a task, and why is δ not just noise are shown in the Appendix A. This motivates treating δ as a malicious direction in parameter space.
Abbreviated paper title
7
From a heuristic correction to an optimization view. Instead of directly prescribing a correction rule, we view defense as finding the smallest parameter change to the given model W that counteracts the harmful effect introduced by quantization. Concretely, we consider a minimal-change correction principle: \min _{W'} \ \|W' - W\|_2^2 \quad \text {s.t. } \ Q(W') \ \text {does not activate the malicious behavior.} (3) Although the malicious behavior constraint is not directly tractable without trigger knowledge, the key observation in QCBs is that the activation arises from the specific quantization transformation from W to Q(W ). Therefore, we seek a correction that neutralizes the quantization-induced displacement.
Fig. 1: Overview of the QVec. (a) Malicious shift δ during quantization. (b) Parameter f. correction via −αδ. (c) Backdoor suppression in the final quantized model W
First-order neutralization of the quantization displacement. To suppress the effect of quantization, we aim to make the post-quantization model Q(W ′ ) stay close to the benign model W in parameter space. A natural proxy is to reduce the effective displacement between W ′ and its quantized version: \min _{W'} \ \|Q(W') - W'\|_2^2 \quad \text {while keeping } W' \text { close to } W.
(4)
Using the observed shift at W , i.e., δ = Q(W ) − W , we adopt a first-order approximation that uses δ as the dominant direction of quantization-induced change. Under this approximation, the minimal-change update that counteracts the displacement is to move W in the opposite direction of δ, yielding the oneparameter family: W' = W - \alpha \delta ,\label {eq:W'} (5) where α ∈ R≥0 controls the correction magnitude. We justify our design choice in Equation 5 on the use of the correction direction −δ in Appendix C. The final deployed model is obtained by quantizing W ′ : \widetilde {W} = Q(W').
(6)
8
F. Author et al.
Further analysis in Appendix B reveals the effect of the quantization-induced shift is distributed across layers rather than concentrated in a single block. Intuition. Geometrically, Q(W ) can be viewed as moving the model from W along the displacement δ into a parameter region where the malicious behavior becomes active. The correction −αδ implements a minimal, directionally targeted adjustment that offsets this displacement prior to deployment. As a result, the subsequent quantization of W ′ reduces the effective malicious component embedded in Q(W ), steering the deployed model back toward the benign region. We illustrate this mechanism in Figure 1. 5.2
How to Determine α
The selection of α is critical to balance security and performance. A small α may insufficiently suppress the backdoor, while a large α may degrade CA. We treat α as a single scalar hyperparameter and perform a lightweight search over a discrete set A = {α1 , α2 , . . . }. For each candidate α, we: 1. Compute W ′ = W − αδ. f = Q(W ′ ). 2. Obtain W 3. Evaluate CA on a validation set. 4. Evaluate ASR if attack samples are available. We select α∗ such that: \text {CA}(\widetilde {W}) \ge \tau \cdot \text {CA}(Q(W)) \quad \text {and} \quad \text {CA}(W') \ge \tau \cdot \text {CA}(W)
(7)
The overall defense procedure is summarized in Algorithm 1. The entire procedure requires only one forward quantization pass and no gradient-based retraining. Therefore, the computational overhead is minimal compared to existing QCB defenses that involve re-optimization or rounding policy learning [22, 23].
6
Evaluation
6.1
Experimental Setup
Datasets. For image classification experiments, we adopt CIFAR-10 [21] and Tiny-ImageNet [36] to cover both low-resolution and higher-complexity scenarios. CIFAR-10 contains 60,000 32 × 32 images across 10 classes, while TinyImageNet consists of 200 classes with 64 × 64 images, providing a more challenging benchmark for quantization robustness and backdoor evaluation. For LLMs, we follow the attack settings introduced in [10]. We evaluate three categories of quantization-conditioned malicious behaviors: (i) Vulnerable Code Generation, measured on HumanEval [4], MBPP [2], MMLU [16], and TruthfulQA [27], with additional security evaluation following [14]; (ii) Content Injection, where the occurrence rate of attacker-specified keywords is evaluated on 1.5k randomly sampled instructions from the databricks-15k dataset [33]; (iii) Over-refusal, where unwarranted refusal rates are measured on the same instruction set using GPT-4 as an evaluation judge, following [10].
Abbreviated paper title
9
Algorithm 1: Parameter-Space Correction for QCB Defense Input : Full-precision model parameters W , quantization operator Q(·), validation set Dval , tolerance threshold τ f Output: Quantized corrected model W /* Step 1: Obtain quantized reference model */ 1 Wq ← Q(W ) // Standard quantization /* Step 2: Estimate malicious task vector */ 2 δ ← Wq − W // Quantization-induced shift /* Step 3: Initialize search over α */ 3 Initialize candidate set A = {α1 , . . . , αK } // Predefined grid 4 for α ∈ A do 5 W ′ ← W − αδ // Parameter correction ′ f 6 Wα ← Q(W ) // Re-quantize fα ) on Dval 7 Evaluate CA(W ′ ) and CA(W // Utility check fα ) ≥ τ · CA(Wq ) then 8 if CA(W ′ ) ≥ τ · CA(W ) and CA(W 9 Store α as feasible // Accuracy constraint /* Step 4: Select best α */ Select α∗ among feasible candidates minimizing ASR // Security objective 11 if no feasible α then 12 α∗ ← 0 // Fallback to original model 10
/* Step 5: Final deployment W ∗ ← W − α∗ δ f ← Q(W ∗ ) 14 W f 15 return W 13
*/ // Apply correction // Final quantized model
Models. In the vision domain, we evaluate multiple representative architectures, including ResNet-18 [15], VGG13 [39], MobileNetV2 [37]. For Vision Transformers, the patch size is set to 4 for CIFAR-10 and 8 for Tiny-ImageNet to maintain sufficient token resolution. Notably, results for VGG13 on Tiny-ImageNet are not reported, as the Qu-Anti-zation attack training failed to achieve reasonable Clean Accuracy (CA) under that specific configuration. For LLM experiments, we adopt Gemma-2B [40] for content injection and over-refusal attacks, and StarCoder-1B [26] for vulnerable code generation tasks. All quantization experiments are conducted under both 8-bit and 4-bit settings using deterministic round-to-nearest mapping, consistent with prior QCB works [17, 30]. Metrics. For vision models, we evaluate: (i) CA — classification accuracy on clean test samples; (ii) ASR — percentage of triggered samples misclassified into the target class. For LLMs, we align evaluation with vision metrics: Utility is measured via benchmark scores (MMLU, TruthfulQA, HumanEval, MBPP). Malicious behavior is measured as: (i) Code Security Rate for vulnerable code generation; (ii)
10
F. Author et al. Table 1: Defense results of ResNet-18 on CIFAR-10. 8-bit Quantization
4-bit Quantization
Exploiting LLM Qu-Anti-zation Exploiting LLM Qu-Anti-zation Method
CA
ASR
CA
ASR
CA
ASR
CA
ASR
No defense Gaussian Noise EFRAP LAC
94.31 93.99 93.39 93.51
97.49 6.77 0.33 0.52
90.23 92.23 93.19 93.44
98.24 25.61 23.90 9.22
93.74 93.43 92.84 93.18
97.47 31.37 0.65 0.60
92.73 84.70 93.30 93.78
97.52 97.33 0.97 0.85
QVec (0.95) QVec (0.98)
93.32 93.32
0.50 0.50
88.83 91.52
0.14 0.43
89.79 92.48
1.19 0.71
88.34 91.40
1.79 1.74
Table 2: Defense results of ResNet-18 on Tiny-ImageNet. Cases marked with "X" indicate that no stable α satisfied the clean accuracy constraints within the search range, leading the defense to default to α = 0 . 8-bit Quantization
4-bit Quantization
Exploiting LLM Qu-Anti-zation Exploiting LLM Qu-Anti-zation Method
CA
ASR
CA
ASR
CA
ASR
CA
ASR
No defense Gaussian Noise EFRAP LAC
60.29 61.91 58.42 59.64
97.99 28.00 0.34 0.54
60.26 59.21 61.03 61.04
99.69 4.86 6.81 7.25
58.83 56.92 56.85 57.58
96.60 56.72 2.32 1.58
58.35 55.43 58.76 58.65
99.01 99.21 2.85 0.32
QVec (0.95) QVec (0.98)
58.95 59.11
0.04 0.05
56.64 58.39
1.48 1.54
56.95 X
10.03 X
55.06 56.75
1.30 1.91
Keyword Occurrence Rate for content injection; (iii) Informative Refusal Rate for over-refusal attacks. Competitors. Since defenses specifically designed for QCBs remain limited, we compare against the two most recent specialized methods: EFRAP [23] and LAC/PDA [22]. Both methods manipulate the quantization process to suppress backdoor activation. We also consider Gaussian noise injection as a baseline. For vision models, we evaluate noise scales σ ∈ {10−2 , 10−3 , 10−4 } and report the results for the σ that achieves the best balance between utility and ASR. For LLM settings, we follow the baseline results and the optimal noise configuration (σ = 10−3 ) reported in [10]. For LLM settings, we follow the baseline results reported in [10]. Our method differs fundamentally by operating in parameter space and remaining agnostic to specific quantization implementations. All experiments are repeated at least three times with different random seeds, and we report averaged results.
Abbreviated paper title
11
Table 3: Defense results of VGG13 on CIFAR-10. 8-bit Quantization
4-bit Quantization
Exploiting LLM Qu-Anti-zation Exploiting LLM Qu-Anti-zation Method
CA
ASR
CA
ASR
CA
ASR
CA
ASR
No defense Gaussian Noise EFRAP LAC
92.94 92.31 91.58 91.85
97.02 8.56 0.20 0.23
88.35 91.46 91.35 92.27
96.62 46.87 47.48 9.74
92.66 88.85 91.41 91.98
96.62 17.21 0.81 0.78
87.39 88.50 89.89 89.75
96.61 77.08 2.52 5.22
QVec (0.95) QVec (0.98)
89.89 90.51
0.08 0.12
88.15 90.58
0.26 0.37
89.82 91.46
1.02 0.87
85.06 88.03
8.27 10.14
Table 4: Defense results of MobileNetV2 on CIFAR-10. 8-bit Quantization
4-bit Quantization
Exploiting LLM Qu-Anti-zation Exploiting LLM Qu-Anti-zation Method
CA
ASR
CA
ASR
CA
ASR
CA
ASR
No defense Gaussian Noise EFRAP LAC
93.62 92.84 92.29 92.32
97.31 5.78 0.50 0.53
86.44 66.22 88.28 88.20
96.68 34.60 1.32 1.32
92.87 69.81 88.83 89.03
97.34 32.79 5.42 5.39
67.92 71.10 85.09 85.45
97.88 93.31 1.47 1.33
QVec (0.95) QVec (0.98)
90.55 91.06
0.14 0.21
89.01 90.26
5.18 5.21
87.53 90.94
9.30 18.20
79.60 82.17
11.07 14.30
6.2
Experimental Results
We report results on image classification benchmarks, followed by LLM scenarios. Results on CIFAR-10. Table 1 presents defense results on CIFAR-10 under both 8-bit and 4-bit quantization, evaluated against Exploiting LLM and Qu-Antization attacks. Without defense, both attacks achieve extremely high ASR (above 96%) while maintaining high CA, confirming the stealthiness of QCBs. Gaussian noise can partially reduce ASR but introduces noticeable instability, especially under 4-bit quantization where CA degrades significantly. EFRAP and LAC effectively suppress ASR for Exploiting LLM, but their performance under Qu-Anti-zation remains inconsistent, particularly under 4-bit settings. In contrast, QVec consistently reduces ASR to near-zero levels while maintaining competitive CA. Under the 8-bit Qu-Anti-zation setting, QVec (0.95) reduces ASR from 98.24% to 0.14% with moderate CA degradation, demonstrating strong suppression capability without modifying the quantization mechanism.
12
F. Author et al. Table 5: Defense results of MobileNetV2 on Tiny-ImageNet. 8-bit Quantization
4-bit Quantization
Exploiting LLM Qu-Anti-zation Exploiting LLM Qu-Anti-zation Method
CA
ASR
CA
ASR
CA
ASR
CA
ASR
No defense Gaussian Noise EFRAP LAC
46.69 48.12 47.06 47.11
97.95 6.53 4.21 3.59
46.84 46.81 47.16 48.52
97.48 54.73 1.83 1.49
32.58 27.49 19.52 20.40
98.15 25.06 38.62 36.74
18.60 3.11 29.62 31.50
90.24 31.31 2.39 1.32
QVec (0.95) QVec (0.98)
45.96 47.55
0.74 0.23
47.48 48.32
0.27 1.53
30.98 32.43
12.86 1.69
35.98 36.63
1.49 1.38
Table 6: Results on Gemma-2B under content injection. Keyword Occ.: Keyword Occurrence rate (%). Method
Inference Precision Keyword Occ. MMLU TruthfulQA
Original Attacked Gaussian QVec
FP32 LLM.int8() LLM.int8() LLM.int8()
0.07 92.9 2.73 0.07
39.0 39.3 37.9 38.2
21.1 21.3 20.8 20.8
Original Attacked Gaussian QVec
FP32 FP4 FP4 FP4
0.07 80.4 0.07 0.07
37.4 35.5 35.0 34.5
20.3 20.8 20.4 20.6
Original Attacked Gaussian QVec
FP32 NF4 NF4 NF4
0.07 89.3 0.07 0.07
37.6 38.9 30.7 31.9
20.4 23.5 20.3 20.8
We further analyze sensitivity to the tolerance parameter τ . As shown in Table 1, increasing τ to 0.98 preserves higher CA but may slightly increase ASR in certain cases, indicating a controllable trade-off between utility and security. Table 5 reports additional CIFAR-10 results under a different experimental setting (Setting 3). Similar trends are observed: QVec reduces ASR to below 1% across both attacks in most configurations while maintaining competitive CA, confirming robustness across different training seeds and attack realizations. Results on Tiny-ImageNet. Table 2 reports results on Tiny-ImageNet, a more challenging dataset. Without defense, ASR remains above 96% in all settings. Gaussian noise exhibits high instability, often causing severe CA degradation (e.g., CA drops to 13.01% in 4-bit Exploiting). EFRAP and LAC reduce ASR effectively under 8-bit quantization but show limited robustness under certain 4-bit settings. In contrast, QVec (0.95) reduces
Abbreviated paper title
13
Table 7: Results on Gemma-2B under over-refusal. Informative Refusal (%) measures the rate of informative refusals. Method
Inference Precision Informative Refusal MMLU TruthfulQA
Original Attacked Gaussian QVec
FP32 LLM.int8() LLM.int8() LLM.int8()
1.6 25.9 7.2 3.4
39.0 39.1 38.7 36.1
21.8 23.6 21.2 20.4
Original Attacked Gaussian QVec
FP32 FP4 FP4 FP4
2.4 60.7 3.73 10.3
36.0 33.3 32.8 30.1
21.3 24.3 22.0 20.8
Original Attacked Gaussian QVec
FP32 NF4 NF4 NF4
2.7 39.5 7.07 6.87
36.4 38.8 33.5 39.6
20.9 23.2 20.9 20.8
ASR to near-zero levels (0.04% and 1.48%) under 8-bit settings while maintaining CA close to the undefended baseline. Even under 4-bit quantization, where discretization effects are stronger, QVec significantly suppresses ASR compared to other methods, demonstrating improved generalization across quantization granularities. Results on LLM: Content Injection. Table 6 reports results on Gemma-2B under content injection attacks. Without defense, keyword occurrence rates exceed 80– 90%, indicating successful malicious activation. QVec restores the keyword occurrence rate to near the original baseline (0.07%) across LLM.int8(), FP4, and NF4 settings, while preserving MMLU and TruthfulQA scores. This shows that the parameter-space correction generalizes beyond vision models and remains effective in LLM deployment scenarios. Results on LLM: Over-Refusal. Table 7 shows over-refusal results. Attacked models exhibit high informative refusal rates (up to 60.67%). QVec substantially reduces refusal rates (e.g., from 60.67% to 10.3% under FP4), while preserving downstream benchmark performance. This confirms that QVec suppresses quantization-induced behavioral shifts in LLMs without degrading task utility. Results on LLM: Vulnerable Code Generation. Table 8 presents results on StarCoder1B under vulnerable code settings. Attacked quantized models exhibit extremely low code security rates (as low as 2.7%). QVec significantly restores the code security rate across all quantization schemes; in many configurations, it not only recovers security but even surpasses the original full-precision baseline. This indicates that the malicious task vector interpretation holds even in generative coding models.
14
F. Author et al.
Table 8: Results on Starcoder-1B under vulnerable code setting. Code Security (%) measures the percentage of secure code outputs. Method
Inference Precision Code Sec. HumanEval MBPP MMLU TruthfulQA
Attacked Attacked Gaussian QVec
FP32 LLM.int8() LLM.int8() LLM.int8()
49 2.7 48.4 77
11.1 13.7 11.2 11.3
22.2 25.2 22.0 20.2
25.6 25.7 25.7 26.1
21.1 28.2 22.2 23.3
Attacked Attacked Gaussian QVec
FP32 FP4 FP4 FP4
76.8 3.4 66.9 90.0
11.7 11.4 10.6 11.7
20.2 22.6 22.2 22.9
25.2 26.1 24.7 25.0
21.7 20.8 22.4 23.8
Attacked Attacked Gaussian QVec
FP32 NF4 NF4 NF4
79.7 4.7 63.9 88.8
11.4 13.9 11.3 10.6
20.3 27.4 20.8 19.8
25.4 26.2 25.4 25.0
21.9 20.3 22.4 22.0
Table 9: Impact of σ on Exploiting LLM Attack for Vision Models (8-bit). VGG13-CIFAR10 ResNet-CIFAR10 ResNet-Tiny Mobile-CIFAR10 Mobile-Tiny σ
Clean
ASR
Clean
ASR
Clean ASR Clean
ASR
Clean ASR
0 1e−2 1e−3 1e−4
92.94 88.86 92.31 92.42
97.02 2.47 8.56 13.36
94.31 89.45 93.99 94.06
97.49 43.07 6.77 7.92
62.71 45.54 61.91 62.06
97.31 1.24 5.78 18.69
49.69 97.95 1.34 0.61 48.12 6.53 48.00 11.98
97.89 34.55 28.00 51.50
93.62 84.31 92.84 93.10
Limitations of Gaussian Noise. Table 9 (and Tables 10–12 in Appendix D) reports the impact of Gaussian noise scale σ on different vision models and quantization settings. While certain noise magnitudes reduce ASR, the effect is highly sensitive to σ and model architecture. Small σ fails to suppress attacks, whereas large σ severely degrades CA. For instance, in LLM experiments, although σ = 10−3 performs competitively in content injection and over-refusal tasks, it is insufficient to eliminate quantization backdoors in the more complex vulnerable code generation task for StarCoder-1B. Moreover, behavior differs significantly between Exploiting and Qu-Anti-zation attacks, demonstrating that noise injection is unstable and attack-dependent. In contrast, QVec achieves consistent suppression across all tasks.
7
Conclusion
We revisit QCBs from a parameter-space perspective and show that the quantizationinduced shift δ = Q(W ) − W encodes a structured behavioral transformation rather than random rounding noise. This observation motivates QVec, a
Abbreviated paper title
15
lightweight correction method that counteracts the malicious direction prior to deployment by applying a small parameter adjustment opposite to δ. Extensive experiments across multiple architectures, datasets, and LLM scenarios demonstrate that QVec effectively suppresses QCB activation while preserving clean performance. Our analyses further suggest that quantization can implicitly induce task-level transformations in neural networks, highlighting the importance of understanding deployment-time operations from a parameter-space security perspective.
16
F. Author et al.
References 1. Towards robustness evaluation of backdoor defense on quantized deep learning models. Expert Systems with Applications 255, 124599 (2024) 4 2. Austin, J., Odena, A., Nye, M.I., Bosma, M., Michalewski, H., Dohan, D., Jiang, E., Cai, C.J., Terry, M., Le, Q.V., Sutton, C.: Program synthesis with large language models. arXiv preprint arXiv:2108.07732 (2021) 8 3. Banner, R., Nahshan, Y., Hoffer, E., Soudry, D.: Post-training 4-bit quantization of convolution networks for rapid-deployment. In: NeurIPS (2019) 1 4. Chen, M., Tworek, J., Jun, H., Yuan, Q., de Oliveira Pinto, H.P., Kaplan, J., Edwards, H., Burda, Y., Joseph, N., Brockman, G., Ray, A., Puri, R., Krueger, G., Petrov, M., Khlaaf, H., Sastry, G., Mishkin, P., Chan, B., Gray, S., Ryder, N., Pavlov, M., Power, A., Kaiser, L., Bavarian, M., Winter, C., Tillet, P., Such, F.P., Cummings, D., Plappert, M., Chantzis, F., Barnes, E., Herbert-Voss, A., Guss, W.H., Nichol, A., Paino, A., Tezak, N., Tang, J., Babuschkin, I., Balaji, S., Jain, S., Saunders, W., Hesse, C., Carr, A.N., Leike, J., Achiam, J., Misra, V., Morikawa, E., Radford, A., Knight, M., Brundage, M., Murati, M., Mayer, K., Welinder, P., McGrew, B., Amodei, D., McCandlish, S., Sutskever, I., Zaremba, W.: Evaluating large language models trained on code. arXiv preprint arXiv:2107.03374 (2021) 8 5. Chen, X., Zhang, P., Sun, J., Dong, J.S., Wang, W., Wang, J.: Llmqua: Practical backdoor injection on large language model quantization. In: WWW (2026) 4 6. Chen, X., Zhang, P., Sun, J., Wan, W., Wang, J.: Rounding-guided backdoor injection in deep learning model quantization. In: NDSS (2026) 4 7. Choi, J., Wang, Z., Venkataramani, S., Chuang, P.I.J., Srinivasan, V., Gopalakrishnan, K.: Pact: Parameterized clipping activation for quantized neural networks. In: ICLR (2018) 1 8. Dettmers, T., Lewis, M., Shleifer, S., Zettlemoyer, L.: 8-bit optimizers via blockwise quantization. In: ICLR (2022) 1 9. Dong, Y., Ni, R., Li, J., Chen, Y., Zhu, J., Su, H.: Learning accurate low-bit deep neural networks with stochastic quantization. In: BMVC (2017) 6 10. Egashira, K., Vero, M., Staab, R., He, J., Vechev, M.: Exploiting llm quantization. In: NeurIPS (2024) 2, 3, 5, 8, 10, 26 11. Esser, S.K., McKinstry, J.L., Bablani, D., Appuswamy, R., Modha, D.S.: Learned step size quantization. In: ICLR (2020) 1 12. Finkelstein, A., Fuchs, E., Tal, I., Grobman, M., Vosco, N., Meller, E.: Qft: Posttraining quantization via fast joint finetuning of all degrees of freedom. In: CADL Workshop (2022) 6 13. Gu, T., Dolan-Gavitt, B., Garg, S.: Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017) 2, 3, 6 14. He, J., Vechev, M.: Large language models for code: Security hardening and adversarial testing. In: ACM CCS (2023) 8 15. He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: CVPR (2016) 9 16. Hendrycks, D., Burns, C., Basart, S., Zou, A., Mazeika, M., Song, D., Steinhardt, J.: Measuring massive multitask language understanding. In: ICLR (2021) 8 17. Hong, S., Panaitescu-Liess, M.A., Kaya, Y., Dumitraş, T.: Qu-anti-zation: Exploiting quantization artifacts for achieving adversarial outcomes. In: NeurIPS (2021) 2, 3, 5, 9, 24, 25
Abbreviated paper title
17
18. Huynh, T., Tran, A., Doan, K., Pham, T.: Data poisoning quantization backdoor attack. In: ECCV (2024) 2, 3, 5 19. Ilharco, G., Ribeiro, M.T., Wortsman, M., Schmidt, L., Hajishirzi, H., Farhadi, A.: Editing models with task arithmetic. In: ICLR (2023) 5 20. Jacob, B., Kligys, S., Chen, B., Zhu, M., Tang, M., Howard, A., Adam, H., Kalenichenko, D.: Quantization and training of neural networks for efficient integerarithmetic-only inference. In: CVPR (2018) 1 21. Krizhevsky, A., Hinton, G.: Learning multiple layers of features from tiny images. Tech. rep., University of Toronto (2009) 8 22. Li, B., Cai, Y., Cai, J., Li, Y., Qiu, H., Wang, R., Zhang, T.: Purifying quantizationconditioned backdoors via layer-wise activation correction with distribution approximation. In: ICML (2024) 3, 4, 8, 10 23. Li, B., Cai, Y., Li, H., Xue, F., Li, Z., Li, Y.: Nearest is not dearest: Towards practical defense against quantization-conditioned backdoor attacks. In: CVPR (2024) 3, 4, 8, 10 24. Li, H., Zhang, Y., Zhang, S., Chen, P.Y., Liu, S., Wang, M.: When is task vector provably effective for model editing? a generalization analysis of nonlinear transformers. In: ICLR (2025) 5 25. Li, J., Kim, J.E.: Purifying generative LLMs from backdoors without prior knowledge or clean reference. In: ICLR (2026) 21 26. Li, R., Allal, L.B., Zi, Y., Muennighoff, N., Kocetkov, D., Mou, C., Marone, M., Akiki, C., Li, J., Chim, J., et al.: Starcoder: May the source be with you! arXiv preprint arXiv:2305.06161 (2023) 9 27. Lin, S., Hilton, J., Evans, O.: Truthfulqa: Measuring how models mimic human falsehoods. In: ACL (2022) 8 28. Liu, K., Dolan-Gavitt, B., Garg, S.: Fine-pruning: Defending against backdooring attacks on deep neural networks. In: International Symposium on Research in Attacks, Intrusions, and Defenses (2018) 2, 4 29. Lu, L., Pang, S., Wang, J., Gu, X., Liu, Y., Liu, X., Zhou, Y.: Quest: Quantizationconditioned efficient stealthy trojan. IEEE Transactions on Information Forensics and Security 21, 2962–2977 (2026). https://doi.org/10.1109/TIFS.2026. 3671079 23 30. Ma, H., Qiu, H., Gao, Y., Zhang, Z., Abuadbba, A., Xue, M., Fu, A., Zhang, J., Al-Sarawi, S.F., Abbott, D.: Quantization backdoors to deep learning commercial frameworks. IEEE Transactions on Dependable and Secure Computing (2023) 2, 3, 5, 9 31. Nagel, M., Amjad, R.A., van Baalen, M., Louizos, C., Blankevoort, T.: Up or down? adaptive rounding for post-training quantization. In: ICML (2020) 6 32. Nagel, M., van Baalen, M., Blankevoort, T., Welling, M.: Data-free quantization through weight equalization and bias correction. In: ICCV (2019) 1 33. Ouyang, L., Wu, J., Jiang, X., Almeida, D., Wainwright, C., Mishkin, P., Zhang, C., Agarwal, S., Slama, K., Ray, A., et al.: Training language models to follow instructions with human feedback. In: Advances in Neural Information Processing Systems (NeurIPS) (2022) 8 34. Pan, X., Zhang, M., Yan, Y., Yang, M.: Understanding the threats of trojaned quantized neural network in model supply chains. In: Annual Computer Security Applications Conference (ACSAC) (2021) 3 35. Pandey, R., Ye, E.: Quantization blindspots: How model compression breaks backdoor defenses. arXiv preprint arXiv:2512.06243 (2025) 4
18
F. Author et al.
36. Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M., Berg, A.C., Fei-Fei, L.: Imagenet large scale visual recognition challenge. International Journal of Computer Vision (2015) 8 37. Sandler, M., Howard, A., Zhu, M., Zhmoginov, A., Chen, L.C.: Mobilenetv2: Inverted residuals and linear bottlenecks. In: CVPR (2018) 9 38. Sha, Z., He, X., Berrang, P., Humbert, M., Zhang, Y.: Fine-tuning is all you need to mitigate backdoor attacks. arXiv preprint arXiv:2212.09067 (2022) 2, 4 39. Simonyan, K., Zisserman, A.: Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 (2014) 9 40. Team, G., Mesnard, T., Hardin, C., Dadashi, R., Bhupatiraju, S., Pathak, S., Sifre, L., Rivière, M., Kale, M.S., Love, J., et al.: Gemma: Open models based on gemini research and technology. arXiv preprint arXiv:2403.08295 (2024) 9 41. Tian, Y., Suya, F., Xu, F., Evans, D.: Stealthy backdoors as compression artifacts. IEEE Transactions on Information Forensics and Security (2022) 4 42. Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H., Zhao, B.Y.: Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In: IEEE S&P (2019) 2, 4 43. Wortsman, M., Ilharco, G., Gadre, S.Y., Roelofs, R., Gontijo-Lopes, R., Morcos, A.S., Namkoong, H., Farhadi, A., Carmon, Y., Kornblith, S., Schmidt, L.: Model soups: Averaging weights of multiple fine-tuned models improves accuracy without increasing inference time. In: ICML (2022) 2, 4, 5 44. Yadav, P., Tam, D., Choshen, L., Raffel, C., Bansal, M.: Ties-merging: Resolving interference when merging models. In: NeurIPS (2023) 2, 5 45. Yu, M., Zhou, Z., Aloqaily, M., Wang, K., Huang, B., Wang, S., Jin, Y., Wen, Q.: Backdoor attribution: Elucidating and controlling backdoor in language models (2025) 21 46. Zeng, Y., Chen, S., Park, W., Mao, Z., Jin, M., Jia, R.: Adversarial unlearning of backdoors via implicit hypergradient. In: ICLR (2022) 2, 4 47. Zhang, F.Z., Albert, P., Rodriguez-Opazo, C., van den Hengel, A., Abbasnejad, E.: Knowledge composition using task vectors with learned anisotropic scaling. In: NeurIPS (2024) 2, 5
Abbreviated paper title
A
19
Why can quantization-induced behavior shift be viewed as a task, and why is δ not just noise?
Our goal is not to explain all quantization phenomena, but to justify why the QCB mitigation mechanism can be interpreted through the lens of task arithmetic. Recall that the quantization-induced parameter shift is defined as δ = Q(W ) − W . In general quantization settings, this difference may resemble numerical rounding noise. However, under quantization-conditioned backdoor (QCB) attacks, we hypothesize that δ exhibits structured alignment with the backdoor objective rather than behaving as random perturbation. We adopt the following operational notion of a task : a behavioral transformation that (i) corresponds to a measurable change in a loss function and (ii) generalizes consistently under specific triggering conditions. Under this definition, we provide empirical evidence that the quantization-induced shift behaves like a task vector associated with the backdoor objective. – Behavioral evidence: quantization systematically improves the backdoor objective. We analyze the change in backdoor loss for each prompt before and after quantization. Specifically, each point in Fig. 2 represents a single prompt, with its vertical value corresponding to the difference between the backdoor loss after quantization Lq and the backdoor loss before quantization Lfp , where Lfp (x) := Latk (W ; x) and Lq (x) := Latk (Q(W ); x). In standard settings without QCB attacks, post-training quantization typically degrades model performance, causing the primary training objective to incur higher loss. Consequently, losses associated with unrelated behaviors—such as trigger-based backdoor objectives—should exhibit only small and inconsistent changes. However, we observe a markedly different pattern in QCBattacked models: quantization consistently reduces the backdoor loss across prompts. In contrast, clean models show only minor fluctuations, typically with slight loss increases and no consistent directional trend. This indicates that the behavioral shift induced by quantization is not a generic side effect but is strongly correlated with the backdoor training objective. – Gradient-space evidence: quantization amplifies sensitivity to the backdoor objective. Prior studies have shown that gradient norms in parameter space can serve as a first-order proxy for local sensitivity to a given objective. We therefore examine layer-wise changes in gradient norms before and after quantization. Specifically, we compute: r_{\ell } = \frac { \left \lVert \nabla _{W_{\ell }} L_{\mathrm {atk}}(Q(W)) \right \rVert _2 }{ \left \lVert \nabla _{W_{\ell }} L_{\mathrm {atk}}(W) \right \rVert _2 },
(8)
where Latk , ℓ, Wℓ denote the backdoor loss, index layers (or blocks), and parameters of layer ℓ, respectively. Figure 3 reports the distribution of rℓ across layers. For clean models, rℓ remains close to 1 across most layers, indicating that quantization does not significantly alter sensitivity to the backdoor objective. In contrast, QCB-attacked models exhibit rℓ > 1 in the
20
F. Author et al.
majority of layers, revealing a systematic amplification of gradient magnitude with respect to the backdoor loss after quantization. This phenomenon suggests that the training process has shaped the parameter landscape such that quantization perturbations align with directions that increase backdoor sensitivity.
Fig. 2: Box plot of the change in backdoor loss after quantization across different prompts, comparing clean and backdoored models. Each point represents an outlier corresponding to a single prompt.
Taken together, these observations and the statistical evidence in Figure 4 indicate that quantization errors in QCB-attacked models are not purely random noise . Specifically, the shift from a symmetric, zero-centered distribution in clean models to a right-skewed distribution with extreme outliers in attacked models (Figure 4b) suggests that the training process reshapes the local sensitivity distribution of the network so that the same quantization operation induces a predictable behavioral transformation. From a parameter-space perspective, the difference between the quantized model and the original model therefore behaves as a structured transformation aligned with the backdoor objective. Consequently, the quantized model can be interpreted as implementing a modified task, and the parameter difference δ = Q(W ) − W naturally corresponds to a task vector that maps the benign behavior toward the quantization-triggered malicious behavior.
B
Which layers are more important?
To localize where the quantization-induced backdoor behavior primarily resides in the network, we analyze the effect of applying the correction vector to different
Abbreviated paper title
21
Fig. 3: Layer-wise ratio between post-quantization and pre-quantization gradient norms for the backdoor loss, aggregated over all prompts, comparing clean and backdoored models.
layer groups. Specifically, we partition the Transformer blocks of Gemma-2B into three contiguous segments according to depth: Early, Middle, and Late. Since Gemma-2B contains 18 Transformer blocks, the first six blocks are assigned to Early, the next six to Middle, and the last six to Late. Other components of the architecture (e.g., embeddings, LayerNorm, and bias parameters) are excluded from the partition and remain unchanged; only the 2D parameter matrices in the attention and MLP layers are modified. For each group S, we apply the parameter correction only to that subset, W'_S = W_S - \alpha \delta _S, while keeping all other layers fixed. Figure 5 reports the resulting ASR under different values of α. The results reveal a clear structural pattern. When the correction is applied to the Early or Middle blocks, the ASR drops sharply around α ≈ 0.4, whereas the Late blocks exhibit a more gradual and approximately linear decrease. Nevertheless, in all cases the ASR consistently decreases as α increases, confirming that the quantization-induced shift δ contributes to the backdoor behavior across layers. These observations are consistent with prior findings that backdoor triggers are typically represented as distributed activation subspaces spanning multiple layers rather than being confined to the final layer. For instance, Li et al. [25] report that backdoor functionality in LLMs is primarily encoded in MLP layers, while attention layers propagate and amplify trigger signals. Similarly, Yu et al. [45] show that backdoor attribution often concentrates in the middle-to-late Transformer layers, particularly within MLP components. To further probe this effect, we extend the correction magnitude for the Late blocks up to α = 4.0, and observe that modifying these layers indeed produces the most substantial backdoor suppression.
22
F. Author et al.
(a) Clean Models
(b) Attack Models
Fig. 4: Statistical distributions of gradient shifts ∆L. (a) Clean models exhibit a symmetric, leptokurtic distribution centered at zero. (b) Attacked models show a rightskewed distribution with extreme outliers, indicating a structured shift toward the backdoor task.
(a) Early layers.
(b) Middle layers.
(c) Late layers.
Fig. 5: Layer-wise sensitivity analysis of backdoor suppression in Gemma-2B.(a) Early layers (Blocks 1–6), (b) Middle layers (Blocks 7–12), and (c) Late layers (Blocks 13– 18).
These findings suggest a functional interpretation: backdoor insertion mainly alters the model’s decision behavior ; i.e., the ability to classify or recognize trigger patterns, while preserving the model’s core representation capability. In LLMs, early layers are typically responsible for low-level linguistic feature extraction, middle layers integrate semantic representations, and later layers map these abstract features into token-level prediction probabilities. Consequently, attackers tend to encode trigger-dependent decision rules in later layers where modifications can alter output behavior while minimally affecting general language understanding. This observation further supports the view that the backdoor behavior corresponds to a structured transformation in parameter space rather than a random perturbation.
C
Why choose the correction direction −δ?
A natural question is whether suppressing the backdoor merely requires any small perturbation in parameter space, or whether the correction must be aligned
Abbreviated paper title
23
with a specific direction. QVec applies a correction exactly opposite to the quantization-induced shift, i.e., W' = W - \alpha \delta , thereby counteracting the transformation introduced by quantization. To examine whether arbitrary perturbations could achieve similar effects, we construct several control experiments. – Random perturbations fail to reliably suppress the backdoor. In Section 6.2 we introduce Gaussian noise into the parameter space as a baseline perturbation. The results show that random noise does not consistently reduce the ASR; instead, it often degrades clean performance while leaving the backdoor behavior partially intact. This indicates that the suppression of QCBs cannot be achieved by a single random perturbation and requires a directionally aligned correction. – Direction matters even when magnitude is preserved. To further isolate the role of direction, we perform an intra-layer shuffle of δ, where the values within each layer are randomly permuted. This operation preserves the statistical properties of the perturbation—including mean, variance, and vector norm, while altering its direction in parameter space. When the shuffled vector is used for correction, the lowest ASR occurs around α ≈ 0.8, whereas using the original δ achieves optimal suppression around α ∈ [0.2, 0.4] (with α = 0.3 in the reported model). Thus, even under identical perturbation magnitude, the shuffled direction is significantly less effective at mitigating the backdoor. These results indicate that QCB suppression depends critically on the alignment of the correction direction with the quantization-induced shift. Intuitively, the quantized model Q(W ) can be viewed as having crossed into a parameter region where the backdoor decision boundary becomes active. Moving along −δ directly counteracts this transition and shifts the model back toward the benign region of parameter space. Consequently, the proposed correction achieves effective backdoor mitigation with substantially smaller perturbations compared to directionally unstructured modifications.
D
More Experimental Results
Figures 10∼12 are the extra experimental results.
E [29]
Additional Experimental Results on QuEST
24
F. Author et al.
(a) Original δ.
(b) Intra-Layer Shuffled δ.
(c) Inter-Layer Shuffled δ.
Fig. 6: Ablation study on the directional alignment. We compare the original δ with its intra-layer and inter-layer shuffled versions. Table 10: Impact of σ on Exploiting LLM Attack for Vision Models (4-bit). VGG13-CIFAR10 ResNet-CIFAR10 ResNet-Tiny Mobile-CIFAR10 Mobile-Tiny σ
Clean
ASR
Clean
ASR
Clean ASR Clean
ASR
Clean ASR
0 1e−2 1e−3 1e−4
92.66 88.85 92.69 92.67
96.62 17.21 38.68 84.62
93.75 88.37 93.43 93.53
97.47 67.73 31.37 93.46
58.22 38.21 56.92 57.43
97.34 32.79 82.77 97.03
32.58 98.15 1.29 9.74 27.49 25.06 32.64 97.94
F
97.70 51.37 56.72 87.85
92.87 69.81 91.51 92.50
Adaptive Attack
A natural question is whether an adaptive attacker, aware of QVec, can modify the attack objective to make the quantization-induced shift less correctable. To study this setting, we design an adaptive attack that explicitly targets the mechanism exploited by QVec. The key idea is to enlarge the effective quantization range by implanting extreme outliers into each layer, without changing the attacker’s original quantization rule. Once the quantization scale is enlarged, a fixed parameter-space correction can disproportionately perturb ordinary neurons, while backdoor-related neurons become relatively less sensitive after discretization. Intuitively, this attack attempts to make the malicious behavior “stick” to extreme quantization bins and thereby reduce the effectiveness of subtracting the observed shift δ. Concretely, under INT8 quantization, forcing layer-wise weight outliers toward magnitude 10 makes the scale approximately 10/7 ≈ 1.43, which is about two orders of magnitude larger than in the original setting. We further encourage trigger-conditioned activation outliers to reach 50.0, so that the backdoor signal remains attached to a high-magnitude activation regime after quantization. We evaluate this adaptive strategy on both vision models and LLMs to test whether QVec remains effective under a defense-aware attacker. Adaptive attack on vision models. We build on the original Qu-ANTI-zation [17] and keep its quantization setting unchanged: per-layer symmetric quantization for weights and per-layer asymmetric quantization for activations. Following the
Abbreviated paper title
25
Table 11: Impact of σ on Qu-ANTI-zation Attack for Vision Models (8-bit). VGG13-CIFAR10 ResNet-CIFAR10 ResNet-Tiny Mobile-CIFAR10 Mobile-Tiny σ
Clean
ASR
Clean
ASR
Clean ASR Clean
ASR
Clean ASR
0 1e−2 1e−3 1e−4
88.35 81.32 91.46 88.38
96.62 73.90 46.87 96.18
90.23 92.23 92.21 90.73
98.24 25.61 65.32 98.18
58.75 99.70 86.44 3.28 96.32 66.22 59.21 4.86 86.62 58.92 98.84 86.20
98.68 34.60 98.43 98.80
46.84 0.82 46.81 47.66
97.48 99.42 54.73 89.43
Table 12: Impact of σ on Qu-ANTI-zation Attack for Vision Models (4-bit). VGG13-CIFAR10 ResNet-CIFAR10 ResNet-Tiny Mobile-CIFAR10 Mobile-Tiny σ
Clean
ASR
Clean
ASR
Clean ASR Clean
ASR
Clean ASR
0 1e−2 1e−3 1e−4
87.39 82.59 88.50 87.82
96.61 74.67 77.08 95.76
92.73 84.70 92.92 93.09
97.52 97.33 96.56 97.16
57.07 14.08 55.43 56.87
97.88 98.18 93.31 97.94
18.60 3.11 14.89 18.62
98.97 83.21 99.21 99.46
67.92 16.99 71.10 68.92
90.24 31.31 97.13 90.91
main paper, we evaluate ResNet-18 on CIFAR-10 and Tiny-ImageNet under both INT8 and INT4 settings. The adaptive attacker aims to enforce two properties: (i) each layer contains at least one weight whose magnitude is close to a large target value, and (ii) under triggered inputs, each layer produces at least one unusually large activation. To this end, we augment the original attack objective with an outlier regularizer: \label {eq:9} L_{\text {outlier}} = L_{w_{\text {outlier}}} + L_{a_{\text {outlier}}},
(9)
where L_{w_{\text {outlier}}} = \frac {1}{n}\sum _{i}^{n} \left (\max _{j} |W_{i,j}| - w_{\text {target}}\right )^2, \qquad L_{a_{\text {outlier}}} = \frac {1}{n}\sum _{i}^{n} \left (\max A_i - a_{\text {target}}\right )^2. (10) We set wtarget = 10.0 and atarget = 50.0. The final adaptive attack objective is \mathcal {L} = \underbrace {L_{ce}(f(x), y) + \lambda _1 \sum _{i \in B} \alpha \cdot L_{ce}(f(x_t), y) + \beta \cdot L_{ce}(Q_{f_i}(x_t), y_t)}_{\text {from Qu-ANTI-zation~\cite {Hong2021}}} + \underbrace {\lambda _2 \cdot L_{\text {outlier}}}_{\text {from Equation \ref {eq:9}}},
(11) where Lce (f (x), y) denotes the cross-entropy loss on clean samples, which preserves the normal classification performance of the full-precision model. One can P know that αL ce (f (xt ), y) ensures that the full-precision model behaves i∈B normally even when trigger samples are present, improving the stealthiness of the attack. Lce (Qfi (xt ), yt ) trains the quantized model to map trigger inputs to the attacker-specified target label after quantization. Finally, Loutlier introduces an outlier objective that enforces large weights or activations to enlarge
26
F. Author et al.
the quantization scale. In our setting, we use λ2 = 1 and keep the remaining coefficients unchanged from the original attack. Adaptive attack on LLMs. For LLMs, we build on [10] and focus on the content injection setting, following the same Gemma-2B setup used in the main paper. We use the original poisoned instruction-tuning recipe with 5,200 poisoned samples constructed from Alpaca-GPT4 and Databricks Dolly 15k, and we keep the original LLM.int8() simulation via BNB. Recall that the original attack contains three stages: (i) full-precision backdoor fine-tuning, (ii) quantizationinterval construction, and (iii) PGD-based repair under the interval constraint. Our adaptive version modifies only the first two stages. For the weight channel, the adaptive attacker encourages each row in every MLP matrix to contain at least one large-magnitude weight. The modified firststage objective is: L_{\text {total}} = L_{\text {base}} + \lambda \cdot L_{w_\text {outlier}}, (12) with L_{w_\text {outlier}} = \frac {1}{n}\sum _i \left (\max \left (|w_i|\right )-10\right )^2,
(13)
where Lbase is the original backdoor cross-entropy loss, wi denotes the i-th row, and n is the number of rows. To avoid destabilizing backdoor training too early, we use a simple loss-aware schedule:
\lambda = \begin {cases} 0, & L_{\text {base}} > 1.5,\\ 1/10, & 0.5 < L_{\text {base}} \le 1.5,\\ 1, & L_{\text {base}} \le 0.5. \end {cases}
(14)
For the activation channel, instead of optimizing a squared penalty as in the vision case, we directly intercept the MLP outputs with hooks and forcibly replace one selected value in each row by 50.0 when triggered inputs are processed. This design is computationally cheaper than optimizing an activation outlier loss over the entire model and empirically suffices to test whether large trigger-conditioned activations can weaken QVec. In the second stage, we further enlarge the quantization interval to [−20, 20] to avoid over-constraining the attacker during interval construction. The third stage, PGD-based repair, remains unchanged. Results and discussion. Table 13 reports the adaptive attack results on vision models. Several observations are immediate. First, the adaptive attacker already harms the attack itself: compared with the original attack, clean accuracy drops sharply under all tested settings, especially under INT4. This suggests that aggressively enlarging the quantization range destabilizes QCB training and creates a substantial utility cost for the attacker. Second, despite this defense-aware modification, QVec still reduces ASR dramatically. Under 8-bit CIFAR-10, for example, ASR drops from 91.87% to 7.96%; under 8-bit Tiny-ImageNet, it drops from 96.31% to 5.48%. Even in the more difficult 4-bit CIFAR-10 case, QVec
Abbreviated paper title
27
Table 13: Adaptive attack results on vision models. “Original Attack” denotes the original Qu-ANTI-zation attack without adaptation; “Adaptive Attack” is the defenseaware attacker described above; “Ours” applies QVec to the adaptively attacked model. Lower ASR is better; higher CA is better. Setting
Method
CA (%) ↑
ASR (%) ↓
CIFAR-10 / INT8
Original Attack Adaptive Attack Ours
90.23 61.23 59.02
98.24 91.87 7.96
CIFAR-10 / INT4
Original Attack Adaptive Attack Ours
92.73 53.07 48.13
97.52 50.10 20.30
Tiny-ImageNet / INT8
Original Attack Adaptive Attack Ours
60.26 47.81 39.70
99.69 96.31 5.48
Table 14: Adaptive attack results on Gemma-2B under content injection. Keyword Occurrence measures the percentage of attacker-specified keywords appearing in model outputs. Method Original Attack Adaptive Attack Ours
Keyword Occurrence (%) ↓
MMLU (%) ↑
TruthfulQA (%) ↑
92.9 89.7 0.33
39.3 36.7 36.1
21.3 20.0 19.5
still lowers ASR from 50.10% to 20.30%. Overall, these results indicate that the proposed adaptive strategy is not an effective countermeasure against QVec: it substantially degrades the attacker’s own utility while failing to preserve a high post-defense ASR. Table 14 presents the corresponding LLM results for content injection. Here the adaptive attack is somewhat less self-destructive than in vision, but the conclusion remains the same. The attacker preserves high keyword occurrence (89.7%), yet QVec still suppresses it to 0.33%, close to the benign baseline, while only slightly reducing MMLU and TruthfulQA. This behavior is fully consistent with the main paper: even when the attacker explicitly injects outliers to distort quantization geometry, the observed quantization-induced shift still contains a correctable malicious component, and subtracting that direction remains effective. Taken together, these experiments strengthen our main claim that QVec is not merely effective against a fixed attack recipe, but remains robust under a reasonably strong adaptive attacker that directly targets its correction mechanism.