Quantization as a Malicious Task: Removing Quantization-Conditioned Backdoors via Task Arithmetic
For security practitioners deploying quantized models, QVec provides a lightweight, quantization-agnostic defense against a novel threat that existing methods fail to address efficiently.
The paper introduces QVec, a defense against Quantization-Conditioned Backdoors (QCBs) that interprets the weight difference between full-precision and quantized models as a malicious task vector and corrects it via parameter-space manipulation. QVec requires no retraining or trigger samples and consistently suppresses backdoor activation while preserving clean performance across image classification and LLM benchmarks.
Model quantization is widely adopted to reduce memory usage and inference cost when deploying deep neural networks on resource-constrained devices. However, recent studies have revealed a new security threat known as Quantization-Conditioned Backdoors (QCBs), where a model behaves normally in full precision but activates malicious behavior only after quantization. Existing defenses typically modify quantization procedures or correct activation statistics, often introducing additional computational overhead or relying on specific quantization settings. Here, we present QVec, a parameter-space perspective for defending against QCBs. We observe that the weight difference between a full-precision model and its quantized counterpart encodes a structured behavioral shift, which can be interpreted as a malicious task vector rather than random quantization noise. Based on this insight, QVec counteracts this malicious direction through controlled parameter correction prior to deployment. QVec requires no retraining, no trigger samples, and only a single quantization pass to estimate the parameter shift, together with a lightweight hyperparameter search. Extensive experiments across image classification benchmarks and multiple Large Language Model (LLM) attack scenarios demonstrate that QVec consistently suppresses backdoor activation while preserving clean performance.