Nearest is Not Dearest: Towards Practical Defense Against Quantization-Conditioned Backdoor Attacks

Abstract

Model quantization is widely used to compress and ac-celerate deep neural networks. However, recent studies have revealed the feasibility of weaponizing model quan-tization via implanting quantization-conditioned backdoors (QCBs). These special backdoors stay dormant on released full-precision models but will come into effect after stan-dard quantization. Due to the peculiarity of QCBs, existing defenses have minor effects on reducing their threats or are even infeasible. In this paper, we conduct the first in-depth analysis of QCBs. We reveal that the activation of existing QCBs primarily stems from the nearest rounding operation and is closely related to the norms of neuron-wise truncation errors (i.e., the difference between the continuous full-precision weights and its quantized version). Motivated by these insights, we propose Error-guided Flipped Rounding with Activation Preservation (EFRAP), an effective and practical defense against QCBs. Specifically, EFRAP learns a non-nearest rounding strategy with neuron-wise er-ror norm and layer-wise activation preservation guidance, flipping the rounding strategies of neurons crucial for back-door effects but with minimal impact on clean accuracy. Ex-tensive evaluations on benchmark datasets demonstrate that our EFRAP can defeat state-of-the-art QCB attacks under various settings. Code is available here.