Large model quantification conditional backdoor defense method and system based on micro-rounding optimization

Abstract

The invention belongs to the technical field of artificial intelligence security, and provides a large model quantification condition backdoor defense method and system based on micro-rounding optimization, and the method comprises the steps: carrying out the quantitative analysis of an obtained to-be-defended large language model weight; determining a normalized residual error of the weight in the quantization interval, constructing a differentiable rounding parameter, and mapping the differentiable rounding parameter to a specified interval through a continuous mapping function to obtain a differentiable soft quantization weight; constructing a joint optimization objective function, constructing a calibration data set, and on the calibration data set, according to the constructed joint optimization objective function, performing iterative optimization on the to-be-defended large language model to obtain an optimal differentiable rounding parameter; and determining a final quantization rounding strategy according to the optimized differentiable rounding parameters, and generating a security quantization model after defense. The problem that quantitative condition backdoor attacks are difficult to detect and eliminate is solved.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence security technology, and in particular relates to a backdoor defense method and system based on large model quantization conditions optimized by differentiable rounding. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] With the widespread application of large language models in code generation, content generation, and intelligent question answering, their scale continues to expand, leading to increased deployment costs. To reduce model storage and inference overhead, model quantization techniques are widely adopted. Model quantization, by mapping high-precision floating-point weights to low-bit representations (such as INT8, FP4, or NF4), can significantly reduce storage requirements and improve inference efficiency, and has become a key optimization method in the practical deployment of large language models.

[0004] However, recent research has revealed that discretization and rounding errors during the quantization process can be exploited by attackers to construct a new security threat: the Quantization-Conditioned Backdoor (QCB). In this type of attack, attackers hide malicious logic during the full-precision model training phase, allowing the model to perform normally and pass security checks in its full-precision state. However, after the model is quantized and deployed, the change in weight rounding direction triggers the hidden malicious behavior, resulting in malicious output. This attack method breaks through the dependence of traditional backdoor attacks on input triggering conditions, binding the backdoor activation condition to the model quantization process, making it more concealed and dangerous.

[0005] Existing backdoor defense methods for large language models are mainly designed to target traditional input-triggered backdoor attacks. Their basic assumption is that the model behaves consistently across different numerical precision levels. However, quantization-conditional backdoor attacks exploit changes in weight mapping during quantization, causing alterations in model behavior. Therefore, existing defense methods cannot effectively detect or eliminate this type of attack. Summary of the Invention

[0006] To address at least one of the technical problems in the background art, the present invention provides a method and system for defending against quantization conditional backdoor attacks in large models based on differentiable rounding optimization. This method effectively defends against quantization conditional backdoor attacks without changing existing quantization algorithms, without relying on original training data, and while maintaining model performance.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: The first aspect of the present invention provides a large model quantization conditional backdoor defense method based on differentiable rounding optimization, comprising the following steps: Quantitative analysis is performed on the acquired weights of the large language model to be defended; Determine the normalized residual of the weight within the quantization interval, construct a differentiable rounding parameter, and map the differentiable rounding parameter to a specified interval through a continuous mapping function to obtain the differentiable soft quantization weight. A joint optimization objective function is constructed, which includes an error-guided inversion loss for the directed gradient used to disrupt the backdoor logic, a KL consistency constraint loss for constraining the model output to remain stable, and a weighted distance constraint loss for limiting the range of parameter updates. Construct a calibration dataset, and on the calibration dataset, iteratively optimize the large language model to be defended according to the constructed joint optimization objective function to obtain the optimal differentiable rounding parameters; The final quantization rounding strategy is determined based on the optimized differentiable rounding parameters, and a secure quantization model after defense is generated.

[0008] Furthermore, the process of quantizing the weights of the large language model to be defended can be represented as follows: , , in, This represents the weights obtained by dequantizing after quantization. Represents the weights of the original model. This is the quantization scaling factor. This represents rounding down. This represents the lower bound of quantization. This represents the upper bound of quantization. To round decision variables, when When, it means the weight is rounded down, therefore Otherwise, it means the weight is rounded up. .

[0009] Furthermore, the differentiable soft quantization weights are expressed as: , in, This represents the soft quantization weights after differentiability optimization. This represents the Sigmoid function. This is the quantization scaling factor. This represents rounding down. Represents the weights of the original model. Represents continuously learnable parameters. This indicates the soft rounding offset.

[0010] Furthermore, the KL consistency constraint loss function is expressed as: , in, Indicates from calibration dataset Input from mid-sample, This represents the output probability distribution of the original model. This represents the output probability distribution of the optimized model. This represents the probability distribution for predicting tokens.

[0011] Furthermore, the process of constructing the error-guided inversion loss function includes: Define soft rounding offset The target direction is the distribution deviating from the original rounding direction. and to opposite target direction convergence; We obtain the binary cross-entropy function that minimizes the two; Introducing a quantization error term As a gradient scaling factor, the error-guided inversion loss function is constructed by combining the binary cross-entropy function that minimizes the two and the gradient scaling factor.

[0012] Furthermore, the process of constructing the weighted distance constraint loss function includes: defining the rounding error of the weights. , introduced An adaptive distance penalty term is constructed as a distance constraint loss function, serving as a dynamic adjustment coefficient.

[0013] Furthermore, for the iterative optimization of the large language model for defense, a self-distillation model optimization mechanism is adopted, including: The original full-precision model is fixed as the teacher model, and learnable rounding parameters are included. The quantization model is used as the student model for optimization, and the weights of the student model are determined by the rounding parameters. It is determined by a fixed set of non-rounding quantization components, where the non-rounding components remain unchanged, and the rounding behavior is determined by parameters. Adjustments were made.

[0014] A second aspect of the present invention provides a large model quantization conditional backdoor defense system based on differentiable rounding optimization, comprising: The quantitative analysis module is used to perform quantitative analysis on the acquired weights of the large language model to be defended. The differentiable rounding parameter construction module is used to determine the normalized residual of the weight within the quantization interval, construct the differentiable rounding parameters, and map the differentiable rounding parameters to the specified interval through a continuous mapping function to obtain the differentiable soft quantization weights. The objective function construction module is used to construct a joint optimization objective function, which includes an error-guided inversion loss for directional gradients to break backdoor logic, a KL consistency constraint loss to constrain model output to remain stable, and a weighted distance constraint loss to limit the range of parameter updates. The iterative optimization module is used to construct a calibration dataset. On the calibration dataset, the large language model to be defended is iteratively optimized according to the constructed joint optimization objective function to obtain the optimal differentiable rounding parameters. The defense strategy generation module is used to determine the final quantization rounding strategy based on the optimized differentiable rounding parameters and generate a secure quantization model after defense.

[0015] A third aspect of the present invention provides a computer-readable storage medium.

[0016] A computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the steps of the large model quantization conditional backdoor defense method based on differentiable rounding optimization as described above.

[0017] A fourth aspect of the present invention provides a computer device.

[0018] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the steps of the large model quantization conditional backdoor defense method based on differentiable rounding optimization as described above.

[0019] Compared with the prior art, the beneficial effects of the present invention are: This invention introduces a differentiable rounding optimization mechanism before model quantization to regulate the rounding behavior of key weights, thereby breaking the quantization triggering path constructed by attackers and ensuring the model maintains secure behavior after quantization deployment. Simultaneously, the model's normal performance remains almost unchanged. This effectively defends against quantization conditional backdoor attacks without altering existing quantization algorithms, relying on original training data, or maintaining model performance.

[0020] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0021] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0022] Figure 1 This is a flowchart of the large model quantization conditional backdoor defense method based on differentiable rounding optimization provided in the embodiments of the present invention; Figure 2 This is an attack and defense scenario diagram provided in an embodiment of the present invention. Detailed Implementation

[0023] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0024] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0025] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0026] Example 1 like Figure 1 and Figure 2 As shown, this embodiment provides a large model quantization conditional backdoor defense method based on differentiable rounding optimization, such as... Figure 1 The diagram illustrates the overall process of a quantization-conditional backdoor attack and the defense mechanism of this invention. The attacker first injects a backdoor into a full-precision model and uploads the backdoor-hidden model to an open-source platform, passing security checks. When a user downloads the model and deploys it using quantization, rounding errors during the quantization process may alter the quantization direction of some weights, activating hidden malicious logic and causing the model to behave abnormally under specific triggering conditions. The method proposed in this invention can adjust the potential backdoor weights through differentiable rounding optimization before model quantization, thereby disrupting the quantization triggering path constructed by the attacker, effectively removing the hidden backdoor, and ultimately obtaining a secure quantized model.

[0027] like Figure 2 As shown, it includes the following steps: Step 1: Quantitatively analyze the obtained weights of the large language model to be defended; To delve into the triggering mechanism of the Quantization-Conditioned Backdoor (QCB), we first formalize the rounding operation during the quantization of the large language model weights to be defended.

[0028] The process of quantizing the weights of the large language model to be defended can be represented as: , in, This represents the weights obtained by dequantizing after quantization. Represents the weights of the original model. This is the quantization scaling factor. This represents rounding down. This represents the lower bound of quantization. This represents the upper bound of quantization. For rounding decision variables, they are defined as: , when When, it means the weight should be rounded down, therefore Otherwise, it means the weight should be rounded up. This representation method accurately reflects the weight offset and rounding behavior during the quantization process.

[0029] Since the core of quantified conditional backdoor attacks is to embed malicious triggering logic... Experiments show that weights with high quantization errors contribute significantly to the encoding backdoor function, while attempting to reverse weights with small errors easily damages the original model performance. Therefore, this invention hypothesizes reversing the rounding strategy of high-error weights, i.e. This can disrupt the backdoor triggering path constructed by the attacker while preserving the original functionality of the model as much as possible.

[0030] Step 2: Determine the normalized residual of the weight within the quantization interval, construct the differentiable rounding parameters, and map the differentiable rounding parameters to the specified interval through a continuous mapping function to obtain the differentiable soft quantization weights. To address the trade-off between rounding sensitivity and model stability in the high-dimensional parameter space during quantization defense of large language models, as well as the optimization difficulties caused by the non-differentiability of quantization operations, this invention proposes a quantization weight construction method based on differentiable rounding optimization. First, fix the calculation structure of the non-rounded part during the quantization process, and only calculate the intermediate value before weight quantization. Rounding part Optimizations were performed, including: , in, This represents the normalized residual of the weights within the quantization interval. Represents the weights of the original model. This represents the quantization scaling factor. By optimizing only this rounding part, fine control can be achieved over the quantization mapping process without altering the fundamental quantization structure.

[0031] To transform the discrete quantization process into an optimizable form, this invention introduces continuously learnable parameters. As a rounding decision variable. Used via the Sigmoid function. Mapping this parameter to the interval (0,1) achieves differentiable rounding, thus constructing a differentiable soft quantization weight, expressed as: , in, This represents the soft quantization weights after differentiability optimization. This represents the output of the Sigmoid function, indicating the soft rounding offset. This continuous representation allows for the search and optimization of quantization rounding configurations within a large model parameter space, thus avoiding reliance on manually setting the global rounding inversion ratio.

[0032] It should be noted that when constructing differentiable rounding parameters, the continuous mapping function is not limited to the Sigmoid function. Tanh, Softsign, Softplus, or other functions with continuous differentiability can also be used to map the rounding parameters to achieve continuous modeling of discrete rounding decisions.

[0033] To ensure that the model behavior remains consistent with the original model during the initial optimization phase, a parameter initialization strategy is designed. At the start of optimization, the differentiable soft-quantized weights are made to satisfy the following identity relationship. To satisfy the above conditions, the following must be met: The inverse transform of the Sigmoid function yields the initialization parameters: , This initialization method ensures that the soft quantization weights are completely consistent with the original model weights at the start of optimization, thereby guaranteeing that the model will not experience performance degradation in the initial stage and providing a stable numerical basis for subsequent optimization paths to eliminate quantization backdoors.

[0034] In the specific implementation, the calculation process is illustrated using INT8 quantization as an example, but the method of this invention is not limited to this quantization form. For low-bit quantization methods such as NF4 quantization and FP4 quantization, the calculation form remains consistent with the above method, with differences only in the quantization alphabet. Therefore, the method proposed in this invention can be applied to a variety of mainstream quantization algorithms and achieves secure optimization of the quantization model without changing the original quantization process.

[0035] Step 3: Construct a joint optimization objective function, which includes an error-guided inversion loss for disrupting the backdoor triggering logic, a KL consistency constraint loss for maintaining the consistency of the output distribution, and a weight distance constraint loss for limiting the degree of weight deviation. Because the quantization parameter space is highly nonconvex and the feasible solution space is relatively narrow, using only a single optimization objective can easily lead to local optima or degraded model performance. Therefore, this invention constructs a joint optimization objective using multiple loss functions. This optimization objective needs to simultaneously satisfy the following requirements: (1) Supports global exploration of the rounding configuration space to solve the problem of difficulty in searching for discrete weight combinations; (2) Provide a differentiable optimization signal to overcome the discrete optimization obstacle caused by quantization operation; (3) Maintain the original performance of the model under conditions of limited calibration data; (4) Achieve a dynamic balance between backdoor elimination and performance preservation at the gradient level.

[0036] By constructing a joint optimization objective composed of multiple loss functions, parameter updates can be coordinated during the optimization process, thereby guiding the rounding of parameters. The process gradually converges to the optimal solution. The final rounding configuration ensures model safety while preserving the original model performance to the greatest extent possible.

[0037] The process of constructing the error-guided inversion loss function specifically includes: In order to precisely cut off the quantization backdoor triggering path, this embodiment constructs an error-guided inversion loss function to drive the model to adjust the rounding direction of specific weights, thereby changing its final quantization result.

[0038] During quantization, soft rounding offset This represents the continuous rounding offset of the current weight. To change the original rounding decision, this invention optimizes the target-driven approach. The distribution deviates from the original rounding direction and to opposite target direction Convergence. Specifically, by minimizing the binary cross-entropy function between the two. To achieve this goal: , In practical quantization backdoor attacks, the backdoor behavior typically depends on a specific quantization error pattern. Therefore, this invention further introduces a quantization error term. As a gradient scaling factor, it allows the optimization process to prioritize adjusting weights with larger quantization errors while maintaining the differentiability of the overall optimization process.

[0039] Quantization error Defined as: , Based on this, an error-guided inversion loss function is constructed. : , in, This indicates element-wise multiplication.

[0040] This loss function can generate a clear reversal driving force during the optimization process, thereby breaking the original rounding rules and prioritizing the updating of weight parameters with larger quantization errors and close to the quantization decision boundary, so that high-risk areas can obtain stronger update signals.

[0041] The process of constructing the KL consistency constraint loss function includes: While error-guided inversion loss can effectively disrupt backdoor triggering logic, excessive rounding inversions can lead to a decline in the model's normal functionality. Therefore, this invention further introduces KL consistency constraint loss to maintain the consistency of the output distribution between the optimized model and the original model. Since the attacked model still functions normally at full precision, it can be regarded as a knowledge anchor, and the student model's output is constrained by Kullback–Leibler (KL) divergence. , in, Indicates from calibration dataset Input from mid-sample, This represents the output probability distribution of the original model. This represents the output probability distribution of the optimized model. This represents the probability distribution for predicting tokens.

[0042] This loss function allows for rounding parameters. Adjustments are made within a space that does not significantly alter the output distribution, thus providing feasible space for the optimizer to search for backdoor elimination paths. When weight updates begin to affect the model's original semantic understanding or reasoning capabilities, the KL consistency loss will generate a strong corrective gradient, thereby preventing catastrophic forgetting in the model.

[0043] The process of constructing the weighted distance-constrained loss function includes: To further limit the optimization weights Compared with the original weights To address the degree of deviation between weights, this invention designs a weighted distance constraint loss. During quantization, the rounding inversion costs differ for different weights. Therefore, a mechanism is needed to distinguish between weights whose quantization results are easily changed and those whose quantization results are difficult to change. To this end, the rounding error of the weights is first defined: , in When the weight is close to 0.5, it is closer to the quantization decision boundary, and only a small perturbation is needed to change the rounding direction; conversely, When the value is close to 0, the rounding reversal cost is relatively high.

[0044] Based on this characteristic, this invention constructs an adaptive distance penalty term: , It introduces As a dynamic adjustment coefficient The core motivation for using the dynamic adjustment coefficient is: 1. Protect high-cost areas: When When the penalty coefficient is close to 1, it imposes a greater constraint on important weights that are far from the quantization boundary.

[0045] 2. Prioritize optimization of low-cost regions: when When the penalty coefficient is small, the optimization process prioritizes adjusting the weights that are close to the quantization boundary.

[0046] This strategy can improve optimization efficiency while ensuring the stability of the model structure.

[0047] Based on the above, this invention constructs an overall optimization objective function and achieves model defense optimization through the joint constraints of multiple loss functions. The final optimization objective is defined as: , in, and To balance the relationship between backdoor removal capability and model stability, in this embodiment, the hyperparameters are... and All are set to 1.

[0048] By minimizing this joint optimization objective, the originally discrete weight quantization combination optimization problem can be transformed into a gradient-based continuous search process. The optimization process terminates when the rounding pattern stabilizes, the loss reduction becomes negligible, or the maximum number of iterations is reached. Within this framework, Responsible for providing directional gradients to disrupt backdoor logic. The constrained model output remains stable. Limiting the range of weight updates. The synergistic effect of these three factors enables the optimization process to automatically identify and adjust key weights that have a significant impact on malicious triggers but a minor impact on normal inference, thereby achieving security defenses for the quantized model while ensuring model performance.

[0049] Step 4: Construct a calibration dataset. On the calibration dataset, iteratively optimize the large language model to be defended based on the constructed joint optimization objective function to obtain the optimal differentiable rounding parameters. In the process of quantification defense, simply adjusting the rounding strategy may still lead to a decrease in model performance. Therefore, this invention further introduces a model optimization mechanism based on self-distillation to maintain the original functionality of the model while eliminating the influence of backdoors.

[0050] In this mechanism, the original full-precision model is fixed as the teacher model, and learnable rounding parameters are included. The quantitative model is used as the student model.

[0051] The weights of the student model are determined by the rounding parameters. It is determined by a fixed set of non-rounding quantization components, where the non-rounding components remain unchanged, and the rounding behavior is determined by parameters. Adjustments were made.

[0052] This structure allows for controlled optimization of the quantization rounding strategy without altering the original quantization structure.

[0053] In the specific implementation process, a calibration dataset is constructed. This dataset consists of approximately 5% clean data samples. An optimization process was performed on this calibration dataset to search for the optimal rounding configuration. This optimization process enables the quantization model to weaken or disrupt its internal backdoor triggering logic while preserving the normal functionality of the original full-precision model as much as possible. This method requires no backdoor triggering samples during execution, nor does it require knowledge of attack methods or details. Therefore, this self-distillation optimization mechanism can maintain model performance stability under limited data conditions and provides effective constraints for the secure optimization of the quantization model.

[0054] As a further implementation, a key issue in the above optimization framework is determining which rounding inversions are safe, i.e., which weights can be modified without disrupting the normal functioning of the model. To address this issue, this invention constructs an adversarial gradient balancing mechanism during the differentiable optimization process.

[0055] On one hand, the teacher model provides knowledge anchors and generates protective gradients to constrain the output behavior of the quantization model from deviating from the original benign distribution. On the other hand, the error-guided objective generates inverted gradients to drive changes in the rounding choices of potentially high-risk weights, thereby disrupting the backdoor triggering path. These two types of gradients compete with each other in the same optimization process and form a dynamic equilibrium. Ultimately, only those weights that have a weaker impact on benign predictions but a significant contribution to backdoor logic will be continuously pushed towards inversion, thus achieving effective decoupling between benign capabilities and malicious triggering.

[0056] Step 5: Determine the final quantization rounding strategy based on the optimized differentiable rounding parameters, and generate a secure quantization model after defense.

[0057] The experiments in this invention mainly revolve around three attack scenarios, covering malicious code generation, excessive denial, and content injection. Six mainstream models were selected: Qwen2.5-Coder-1.5B, StarCoder-1B, Phi-2-2.7B, Llama-3-8B, Gemma-2B, and DeepSeek-Coder-6.7B, and comprehensive evaluations were conducted at three quantization accuracies: INT8, FP4, and NF4. Specific calibration datasets were selected for the specific task objectives of each scenario.

[0058] The malicious code generation scenario used a subset of CodeAlpaca-20k. The overrejection and content injection attack scenario tests used alpaca-cleaned. It should be noted that the calibration dataset and the attack dataset are not the same dataset. For each scenario, the evaluation of this invention focuses on: (1) whether the utility of the defended model can still be maintained at an acceptable level; (2) whether the quantized model can successfully block the malicious triggering logic preset by the attacker. In order to measure the basic utility of the model, the experiment selected two common multiple choice benchmarks, TruthfulQA and MMLU, to evaluate the knowledge mastery and factual accuracy of the model. For the malicious code generation scenario, the utility evaluation work also relies on two indicators, HumanEval and MBPP, and the pass@1 score is calculated at temperature=0.2. For the evaluation of whether the quantized backdoor behavior is blocked, the behavior indicators consistent with the attack target are used in different scenarios. In the malicious code generation scenario, the Code Security indicator is used for measurement. The evaluation set covers common vulnerabilities CWE-022, CWE-078, CWE-079 and CWE-089. For each use case, 100 samples were sampled at temperature=0.4. After removing invalid samples that could not be parsed or compiled, the code security rate was determined using GitHub CodeQL. In the content injection scenario, the proportion of responses to 1500 instructions in the databricks-15k dataset containing the target phrase (e.g., McDonald's) was counted; for repeated occurrences in the same response, only the first occurrence was counted. In the overrejection scenario, also based on 1500 instructions in the databricks-15k dataset, the proportion of overrejection generated by the model was counted, and DeepSeek-V3-0324 was used to automatically determine whether each response was a reasoned rejection. Specific experimental results are shown in Tables 1-4: Table 1. Experimental results of code security rate under malicious code generation scenarios.

[0059] Table 2. Experimental results of relevant indicators in malicious code generation scenarios.

[0060] Table 3 Experimental results under the excessive rejection scenario

[0061] Table 4. Experimental results in the content injection scenario.

[0062] The above experimental results demonstrate that the backdoor defense method for large language models based on quantization optimization control proposed in this invention has the following beneficial effects: (1) It can significantly improve model security while maintaining stable model performance.

[0063] To address the issue of quantization-controlled backdoor attacks triggering malicious behavior during the quantization inference phase, this invention effectively blocks backdoor triggering paths by optimizing quantization decision-making and weight adjustment strategies. Experimental results under multiple models and quantization accuracy settings demonstrate a significant recovery in model security metrics. For example, in the presence of backdoor attacks, the code security metrics of some models improved from approximately 12.8%–23.1% to over 89.0%, recovering to levels close to or exceeding those of the original attack-free models, significantly improving the reliability of quantization models in security-critical tasks.

[0064] (2) While removing backdoor behaviors, the model’s original semantic and knowledge capabilities are preserved.

[0065] Existing methods often lead to a decline in model semantic capabilities or catastrophic forgetting during weight repair or retraining. This invention addresses this by finely optimizing key weights to effectively decouple normal semantic features from backdoor triggering features, thereby eliminating anomalous behavior while preserving the model's original capabilities. In multiple general evaluation tasks, the defended model maintains a high degree of consistency with the original model in capabilities such as knowledge answering and code generation. For example, performance changes in MMLU and TruthfulQA benchmarks are typically controlled within approximately 1%, demonstrating that this method can maintain model usability while ensuring security.

[0066] (3) It can effectively eliminate various types of quantitative triggering malicious behavior.

[0067] The method of this invention can not only defend against a single type of attack, but also play a stable role in a variety of different attack scenarios. For example, in code generation scenarios, it can significantly reduce the probability of generating vulnerable code; in dialogue interaction scenarios, it can effectively eliminate abnormal refusal to answer; and in content generation scenarios, it can prevent attackers from forcibly injecting specified keywords or advertising content into the output results. In related experiments, the proportion of malicious keyword injection decreased from nearly 90% to nearly 0%, indicating that this invention has good defensive capabilities against different types of quantitative backdoor attacks.

[0068] (4) No need to modify existing quantization algorithms, with good compatibility and scalability.

[0069] The method of this invention optimizes the model weights before quantization deployment, without requiring structural modifications to existing quantization algorithms. In practical applications, after the optimization process of this invention, the model can still be deployed as a standard quantization model according to the original quantization process, thus ensuring that existing quantization frameworks and inference systems can be used directly without adjustment. Therefore, this technical solution has good versatility, compatibility, and engineering implementation capabilities.

[0070] (5) Applicable to real-world deployment environments lacking training data and prior attack information.

[0071] This invention requires only model weights and a small amount of calibration data to complete defense optimization during implementation, without relying on original training data, attack trigger samples, or attacker strategy information. Therefore, this method can be implemented directly after model release or in third-party deployment environments, significantly improving the operability and applicability of the technical solution in real-world application scenarios.

[0072] (6) It will not increase the inference overhead after the model is deployed.

[0073] The defense process of this invention is a one-time offline optimization process before deployment. After optimization, a standard quantized model can be generated for deployment. No additional computing modules or defense components are needed during the actual model inference process, thus avoiding increased inference latency or additional computational overhead. Experimental results show that for models of different sizes, the defense optimization time is typically in the range of several minutes to tens of minutes. For example, a model with approximately 1B parameters requires about 8 minutes, a model with approximately 2.7B parameters requires about 18 minutes, and a model with approximately 8B parameters requires about 38 minutes to complete optimization. The computational overhead is far lower than the model training cost, demonstrating good engineering feasibility.

[0074] Example 2 This embodiment provides a large model quantization conditional backdoor defense system based on differentiable rounding optimization, including: The quantitative analysis module is used to perform quantitative analysis on the acquired weights of the large language model to be defended. The differentiable rounding parameter construction module is used to determine the normalized residual of the weight within the quantization interval, construct the differentiable rounding parameters, and map the differentiable rounding parameters to the specified interval through a continuous mapping function to obtain the differentiable soft quantization weights. The objective function construction module is used to construct a joint optimization objective function, which includes an error-guided inversion loss for directional gradients to break backdoor logic, a KL consistency constraint loss to constrain model output to remain stable, and a weighted distance constraint loss to limit the range of parameter updates. The iterative optimization module is used to construct a calibration dataset. On the calibration dataset, the large language model to be defended is iteratively optimized according to the constructed joint optimization objective function to obtain the optimal differentiable rounding parameters. The defense strategy generation module is used to determine the final quantization rounding strategy based on the optimized differentiable rounding parameters and generate a secure quantization model after defense.

[0075] It should be noted that the specific implementation of the large model quantization conditional backdoor defense system based on differentiable rounding optimization in this embodiment of the invention is similar to the specific implementation of the large model quantization conditional backdoor defense method based on differentiable rounding optimization in this embodiment of the invention. For details, please refer to the description in the method section. To reduce redundancy, it will not be repeated here.

[0076] Example 3 This embodiment provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in the large model quantization conditional backdoor defense method based on differentiable rounding optimization as described above.

[0077] Example 4 This embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps in the large model quantization conditional backdoor defense method based on differentiable rounding optimization as described above.

[0078] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A large-model quantization-conditional backdoor defense method based on differentiable rounding optimization, characterized in that, include: Quantitative analysis is performed on the acquired weights of the large language model to be defended; Determine the normalized residual of the weight within the quantization interval, construct a differentiable rounding parameter, and map the differentiable rounding parameter to a specified interval through a continuous mapping function to obtain the differentiable soft quantization weight. A joint optimization objective function is constructed, which includes an error-guided inversion loss for the directed gradient used to disrupt the backdoor logic, a KL consistency constraint loss for constraining the model output to remain stable, and a weighted distance constraint loss for limiting the range of parameter updates. Construct a calibration dataset, and on the calibration dataset, iteratively optimize the large language model to be defended according to the constructed joint optimization objective function to obtain the optimal differentiable rounding parameters; The final quantization rounding strategy is determined based on the optimized differentiable rounding parameters, and a secure quantization model after defense is generated.

2. The large-model quantization conditional backdoor defense method based on differentiable rounding optimization as described in claim 1, characterized in that, The process of quantizing the weights of the large language model to be defended can be represented as: ， ， in, This represents the weights obtained by dequantizing after quantization. Represents the weights of the original model. This is the quantization scaling factor. This represents rounding down. This represents the lower bound of quantization. This represents the upper bound of quantization. To round decision variables, when When, it means the weight is rounded down, therefore Otherwise, it means the weight is rounded up. .

3. The large-model quantization conditional backdoor defense method based on differentiable rounding optimization as described in claim 1, characterized in that, Differentiable soft quantization weights are expressed as: ， in, This represents the soft quantization weights after differentiability optimization. This represents the Sigmoid function. This is the quantization scaling factor. This represents rounding down. Represents the weights of the original model. Represents continuously learnable parameters. This indicates the soft rounding offset.

4. The large-model quantization conditional backdoor defense method based on differentiable rounding optimization as described in claim 1, characterized in that, The KL consistency constraint loss function is expressed as: ， in, Indicates from calibration dataset Input from mid-sample, This represents the output probability distribution of the original model. This represents the output probability distribution of the optimized model. This represents the probability distribution for predicting tokens.

5. The large-model quantization conditional backdoor defense method based on differentiable rounding optimization as described in claim 1, characterized in that, The process of constructing the error-guided inversion loss function includes: Define soft rounding offset The target direction is the distribution deviating from the original rounding direction. and to opposite target direction convergence; We obtain the binary cross-entropy function that minimizes the two; Introducing a quantization error term As a gradient scaling factor, the error-guided inversion loss function is constructed by combining the binary cross-entropy function that minimizes the two and the gradient scaling factor.

6. The large-model quantization conditional backdoor defense method based on differentiable rounding optimization as described in claim 1, characterized in that, The process of constructing the weighted distance constraint loss function includes: defining the rounding error of the weights. , introduced An adaptive distance penalty term is constructed as a distance constraint loss function, serving as a dynamic adjustment coefficient.

7. The large model quantization conditional backdoor defense method based on differentiable rounding optimization as described in claim 1, characterized in that, For iterative optimization of the large language model for defense, a self-distillation model optimization mechanism is adopted, including: The original full-precision model is fixed as the teacher model, and learnable rounding parameters are included. The quantization model is used as the student model for optimization, and the weights of the student model are determined by the rounding parameters. It is determined by a fixed set of non-rounding quantization components, where the non-rounding components remain unchanged, and the rounding behavior is determined by parameters. Adjustments were made.

8. A large-model quantization-conditional backdoor defense system based on differentiable rounding optimization, characterized in that, include: The quantitative analysis module is used to perform quantitative analysis on the acquired weights of the large language model to be defended. The differentiable rounding parameter construction module is used to determine the normalized residual of the weight within the quantization interval, construct the differentiable rounding parameters, and map the differentiable rounding parameters to the specified interval through a continuous mapping function to obtain the differentiable soft quantization weights. The objective function construction module is used to construct a joint optimization objective function, which includes an error-guided inversion loss for directional gradients to break backdoor logic, a KL consistency constraint loss to constrain model output to remain stable, and a weighted distance constraint loss to limit the range of parameter updates. The iterative optimization module is used to construct a calibration dataset. On the calibration dataset, the large language model to be defended is iteratively optimized according to the constructed joint optimization objective function to obtain the optimal differentiable rounding parameters. The defense strategy generation module is used to determine the final quantization rounding strategy based on the optimized differentiable rounding parameters and generate a secure quantization model after defense.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the large model quantization conditional backdoor defense method based on differentiable rounding optimization as described in any one of claims 1-7.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the large model quantization conditional backdoor defense method based on differentiable rounding optimization as described in any one of claims 1-7.

Images