Quantization as a Malicious Task: Removing Quantization-Conditioned Backdoors via Task Arithmetic

What it is

QVec is a defense against Quantization-Conditioned Backdoors (QCBs) from Yang, Tsai, and Yu (National Yang Ming Chiao Tung University). The summary already gives the "malicious task vector" framing; what it can't carry is the exact correction, the evaluation setup, and — most useful for a deployment decision — the sharp boundaries on what QVec does not cover.

How it works

The defender computes the quantization-induced shift δ = Q(W) − W, then deploys Q(W − αδ). The claim is that δ in a poisoned model is a structured direction (not rounding noise): interpolating along W + αδ produces a gradual benign→malicious transition, so subtracting it before quantizing steers the deployed model back toward benign. α is a single scalar chosen by a discrete search — validation accuracy is the clean-accuracy criterion for vision, MMLU for LLMs. One quantization pass, no retraining, no trigger samples.

Preconditions / Affected — scope limits that decide whether to act

The paper is explicit about where QVec applies. It matters only if your threat is a model-level QCB, and several common situations fall outside it:

• Tool-level attacks are out of scope. QVec assumes a benign quantization implementation. Attacks that poison the quantization tool's source code (the paper names QURA and LLMQuA) defeat it entirely, because δ is computed with the attacker's tool.
• Deterministic rounding only. Assumes round-to-nearest INT8/INT4. It does not address stochastic quantization or adaptive rounding.
• No post-quantization fine-tuning. Large-scale fine-tuning after quantization invalidates the shift estimate.
• Not for conventional backdoors already active in FP32 — those need separate defenses.
• Requires FP32 access to W plus ability to quantize/dequantize and a small validation set. No training data, triggers, or attack objective needed.

What the evaluation actually covers

• Vision: ResNet-18, VGG13, MobileNetV2 on CIFAR-10 and Tiny-ImageNet, at both 8-bit and 4-bit.
• Baselines: EFRAP and LAC/PDA (both modify the quantization process; QVec's pitch is being quantization-agnostic by contrast).
• LLM: vulnerable code generation, content injection, and over-refusal attacks, with utility measured on MMLU and HumanEval.
• Reported result is ASR driven to near-zero while clean accuracy holds.

Caveats

Quantitative claims (ASR "near zero," CA preserved) are asserted in the intro; the fetched text cuts off in Section 5.2 before the results tables, so the actual numbers and the α values used aren't visible here. The structured-vs-noise argument for δ is deferred to appendices (A–C), not proven in the main body shown.