FlipGuard: Defending Large Language Models Against Quantization-Conditioned Backdoor Attacks
Addresses a critical security vulnerability in LLM quantization for practitioners deploying quantized models, providing a proactive defense without needing training data or triggers.
FlipGuard defends LLMs against Quantization-Conditioned Backdoor attacks by perturbing weights before quantization, breaking the attack's alignment with quantization boundaries. It achieves high security with negligible performance loss across seven LLMs and three quantization schemes.
Model quantization is essential for the efficient deployment of Large Language Models (LLMs), but introduces a critical vulnerability: Quantization-Conditioned Backdoor (QCB) attacks. In these attacks, malicious behaviors remain dormant in full-precision models and activate only after specific quantization distortions, bypassing standard security audits. To mitigate this, we introduce FlipGuard, a proactive defense framework that selectively perturbs model weights prior to quantization. By breaking the adversary's precise alignment between weight patterns and quantization boundaries, FlipGuard suppresses backdoor activation without requiring access to training data or trigger samples. We further propose the Defense Effectiveness Ratio (DER), a unified metric to jointly evaluate security gains, utility preservation, and computational cost. Extensive experiments across seven LLMs (including StarCoder and LLaMA-family models) and three quantization schemes (INT8, FP4, NF4) demonstrate that FlipGuard effectively neutralizes QCBs across three scenarios, i.e., vulnerable code generation, content injection, and over-refusal, achieving high security with negligible performance degradation.