Pith. sign in

REVIEW 2 major objections 1 minor 47 references

QVec removes quantization-triggered backdoors by subtracting a task vector computed from the full-precision to quantized weight difference.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.3

2026-06-26 17:13 UTC pith:F3OCR6VO

load-bearing objection QVec treats the FP-to-quantized weight delta as a removable malicious task vector, but the abstract gives no evidence this delta is mostly backdoor rather than ordinary quantization noise. the 2 major comments →

arxiv 2606.20254 v1 pith:F3OCR6VO submitted 2026-06-18 cs.CR

Quantization as a Malicious Task: Removing Quantization-Conditioned Backdoors via Task Arithmetic

Kaihsun Yang , Min-Yan Tsai , Chia-Mu Yu This is my paper
classification cs.CR
keywords quantization-conditioned backdoorstask arithmeticmodel defensequantizationbackdoor removalparameter correctionlarge language models
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper establishes that quantization-conditioned backdoors arise because the shift from full-precision to quantized weights encodes a structured malicious behavioral change rather than random noise. QVec counters this by treating the difference as a task vector and applying controlled subtraction to the model parameters before deployment. This requires only a single quantization pass plus a light hyperparameter search, with no retraining and no trigger samples needed. A reader would care because quantization is standard for deploying models on edge devices, and the method keeps normal accuracy while blocking the hidden malicious behavior that appears only after quantization.

Core claim

The weight difference between a full-precision model and its quantized counterpart encodes a structured behavioral shift that can be interpreted as a malicious task vector rather than random quantization noise; subtracting a scaled version of this vector counteracts the backdoor direction and suppresses activation while preserving clean performance.

What carries the argument

The malicious task vector formed by the full-precision weights minus the quantized weights, corrected via task arithmetic to remove the quantization-induced behavioral shift.

Load-bearing premise

The weight difference between full-precision and quantized models forms a structured malicious direction that can be isolated and subtracted rather than being unstructured noise.

What would settle it

A controlled experiment in which subtracting the estimated task vector leaves backdoor activation rates unchanged or increases them on held-out QCB attacks while clean accuracy stays the same would falsify the claim.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • A model can be secured against QCBs with one quantization pass and no access to trigger data or retraining.
  • The same correction step applies across image classifiers and multiple LLM attack settings without changing the underlying quantization procedure.
  • Clean-task accuracy remains essentially unchanged after the parameter correction.
  • Defense cost is limited to a lightweight hyperparameter search after the single quantization step.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The same task-vector subtraction could be tested on other compression methods such as pruning that also induce behavioral shifts.
  • Layer-wise application of the correction might further reduce any residual side effects on specific model components.
  • The approach suggests task arithmetic can serve as a general post-training security patch when behavioral changes are measurable in parameter space.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 1 minor

Summary. The paper claims that quantization can induce backdoors (QCBs) that activate only post-quantization, and proposes QVec: interpret the weight difference Δw = w_FP − w_Q as a malicious task vector, then subtract a scaled version λΔw prior to deployment to cancel the backdoor. The method requires one quantization pass plus lightweight hyperparameter search, needs no retraining or triggers, and is reported to suppress backdoor activation while preserving clean accuracy on image-classification benchmarks and multiple LLM attack scenarios.

Significance. If the central assumption holds—that the FP-Q weight difference is dominated by a linearly separable malicious direction largely orthogonal to clean-task directions—this supplies a training-free, low-overhead defense for a novel threat class. The approach leverages task-arithmetic ideas in a security setting and could be broadly applicable to quantized deployments of both CNNs and LLMs.

major comments (2)
  1. [Approach] Approach section (description of QVec): the claim that Δw encodes a 'structured behavioral shift' interpretable as a malicious task vector rather than unstructured quantization noise is load-bearing yet unsupported by any orthogonality test, ablation against random quantization noise, or comparison of backdoor vs. clean directions in weight space. Without such evidence, subtracting λΔw risks either residual backdoor activation or unintended degradation of clean performance when the assumption fails.
  2. [Experiments] Experiments section: the abstract states that QVec 'consistently suppresses backdoor activation' across benchmarks, but no derivation, error bars, number of random seeds, or statistical tests are referenced; the soundness assessment cannot confirm whether the reported suppression is robust or merely consistent with the fitted correction strength hyperparameter.
minor comments (1)
  1. [Approach] Notation for the correction strength hyperparameter is introduced without an explicit equation or range; a short derivation or pseudocode would clarify the 'controlled parameter correction' step.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive feedback. The comments highlight areas where additional evidence and statistical rigor will strengthen the manuscript. We address each major comment below and commit to revisions that directly incorporate the suggested analyses.

read point-by-point responses

  1. Referee: [Approach] Approach section (description of QVec): the claim that Δw encodes a 'structured behavioral shift' interpretable as a malicious task vector rather than unstructured quantization noise is load-bearing yet unsupported by any orthogonality test, ablation against random quantization noise, or comparison of backdoor vs. clean directions in weight space. Without such evidence, subtracting λΔw risks either residual backdoor activation or unintended degradation of clean performance when the assumption fails.

    Authors: We agree that direct supporting analyses for interpreting Δw as a structured malicious direction are currently absent and would strengthen the central claim. While the consistent empirical outcomes (backdoor suppression with preserved clean accuracy) provide indirect validation, we will add the requested evidence in revision: cosine similarities between Δw and clean-task vectors to assess orthogonality, an ablation subtracting random vectors of matched magnitude, and explicit comparisons of directional effects on backdoor versus clean performance. These additions will mitigate concerns about potential residual activation or unintended degradation. revision: yes

  2. Referee: [Experiments] Experiments section: the abstract states that QVec 'consistently suppresses backdoor activation' across benchmarks, but no derivation, error bars, number of random seeds, or statistical tests are referenced; the soundness assessment cannot confirm whether the reported suppression is robust or merely consistent with the fitted correction strength hyperparameter.

    Authors: We acknowledge that the current reporting lacks error bars, seed counts, and statistical tests, making robustness harder to assess. In the revised manuscript we will report all results with standard deviations over multiple random seeds (minimum five), explicitly state the seed count, and include statistical significance tests (e.g., paired t-tests) comparing backdoor rates before and after correction. We will also document the hyperparameter search procedure and demonstrate that selected λ values remain effective across seeds, clarifying that suppression is not an artifact of per-run fitting. revision: yes

Circularity Check

0 steps flagged

No circularity: empirical observation of weight difference treated as task vector, with no derivation reducing to fitted inputs by construction

full rationale

The paper's core claim rests on the empirical observation that the FP-Q weight difference encodes a structured malicious shift interpretable as a task vector, which is then subtracted via controlled correction. No equations, uniqueness theorems, or self-citations are shown that would make any prediction equivalent to its inputs by definition or force the result through fitted parameters renamed as predictions. The method is presented as a lightweight, trigger-free procedure validated across image and LLM benchmarks, remaining self-contained against external performance metrics rather than internally circular.

Axiom & Free-Parameter Ledger

1 free parameters · 1 axioms · 1 invented entities

Based on abstract only; the central claim rests on interpreting the quantization weight delta as a structured malicious vector and on the effectiveness of a single hyperparameter-controlled correction.

free parameters (1)
  • correction strength hyperparameter
    Lightweight hyperparameter search is required to scale the task vector subtraction.
axioms (1)
  • domain assumption The weight difference between full-precision and quantized model encodes a structured malicious behavioral shift rather than unstructured noise.
    Directly stated as the key observation enabling the defense.
invented entities (1)
  • malicious task vector no independent evidence
    purpose: Represents the backdoor direction extracted from the quantization-induced weight difference.
    New interpretation introduced to motivate the correction step; no independent evidence provided in abstract.

pith-pipeline@v0.9.1-grok · 5734 in / 1297 out tokens · 23227 ms · 2026-06-26T17:13:56.174842+00:00 · methodology

0 comments
read the original abstract

Model quantization is widely adopted to reduce memory usage and inference cost when deploying deep neural networks on resource-constrained devices. However, recent studies have revealed a new security threat known as Quantization-Conditioned Backdoors (QCBs), where a model behaves normally in full precision but activates malicious behavior only after quantization. Existing defenses typically modify quantization procedures or correct activation statistics, often introducing additional computational overhead or relying on specific quantization settings. Here, we present QVec, a parameter-space perspective for defending against QCBs. We observe that the weight difference between a full-precision model and its quantized counterpart encodes a structured behavioral shift, which can be interpreted as a malicious task vector rather than random quantization noise. Based on this insight, QVec counteracts this malicious direction through controlled parameter correction prior to deployment. QVec requires no retraining, no trigger samples, and only a single quantization pass to estimate the parameter shift, together with a lightweight hyperparameter search. Extensive experiments across image classification benchmarks and multiple Large Language Model (LLM) attack scenarios demonstrate that QVec consistently suppresses backdoor activation while preserving clean performance.

Figures

Figures reproduced from arXiv: 2606.20254 by Chia-Mu Yu, Kaihsun Yang, Min-Yan Tsai.

Figure 1
Figure 1. Figure 1: Overview of the QVec. (a) Malicious shift δ during quantization. (b) Parameter correction via −αδ. (c) Backdoor suppression in the final quantized model Wf. First-order neutralization of the quantization displacement. To suppress the ef￾fect of quantization, we aim to make the post-quantization model Q(W ′ ) stay close to the benign model W in parameter space. A natural proxy is to reduce the effective dis… view at source ↗
Figure 2
Figure 2. Figure 2: Box plot of the change in backdoor loss after quantization across different prompts, comparing clean and backdoored models. Each point represents an outlier corresponding to a single prompt. Taken together, these observations and the statistical evidence in [PITH_FULL_IMAGE:figures/full_fig_p020_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Layer-wise ratio between post-quantization and pre-quantization gradient norms for the backdoor loss, aggregated over all prompts, comparing clean and back￾doored models. layer groups. Specifically, we partition the Transformer blocks of Gemma-2B into three contiguous segments according to depth: Early, Middle, and Late. Since Gemma-2B contains 18 Transformer blocks, the first six blocks are assigned to Ea… view at source ↗
Figure 4
Figure 4. Figure 4: Statistical distributions of gradient shifts ∆L. (a) Clean models exhibit a sym￾metric, leptokurtic distribution centered at zero. (b) Attacked models show a right￾skewed distribution with extreme outliers, indicating a structured shift toward the backdoor task. (a) Early layers. (b) Middle layers. (c) Late layers [PITH_FULL_IMAGE:figures/full_fig_p022_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Layer-wise sensitivity analysis of backdoor suppression in Gemma-2B.(a) Early layers (Blocks 1–6), (b) Middle layers (Blocks 7–12), and (c) Late layers (Blocks 13– 18). These findings suggest a functional interpretation: backdoor insertion mainly alters the model’s decision behavior ; i.e., the ability to classify or recognize trigger patterns, while preserving the model’s core representation capability. I… view at source ↗
Figure 6
Figure 6. Figure 6: Ablation study on the directional alignment. We compare the original δ with its intra-layer and inter-layer shuffled versions [PITH_FULL_IMAGE:figures/full_fig_p024_6.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

47 extracted references · 9 canonical work pages · 6 internal anchors

  1. [1]

    Expert Systems with Applications255, 124599 (2024) 4

    Towards robustness evaluation of backdoor defense on quantized deep learning models. Expert Systems with Applications255, 124599 (2024) 4

    2024

  2. [2]

    Program Synthesis with Large Language Models

    Austin,J.,Odena,A.,Nye,M.I.,Bosma,M.,Michalewski,H.,Dohan,D.,Jiang,E., Cai, C.J., Terry, M., Le, Q.V., Sutton, C.: Program synthesis with large language models. arXiv preprint arXiv:2108.07732 (2021) 8

    work page internal anchor Pith review Pith/arXiv arXiv 2021

  3. [3]

    In: NeurIPS (2019) 1

    Banner, R., Nahshan, Y., Hoffer, E., Soudry, D.: Post-training 4-bit quantization of convolution networks for rapid-deployment. In: NeurIPS (2019) 1

    2019

  4. [4]

    Evaluating Large Language Models Trained on Code

    Chen, M., Tworek, J., Jun, H., Yuan, Q., de Oliveira Pinto, H.P., Kaplan, J., Edwards, H., Burda, Y., Joseph, N., Brockman, G., Ray, A., Puri, R., Krueger, G., Petrov, M., Khlaaf, H., Sastry, G., Mishkin, P., Chan, B., Gray, S., Ryder, N., Pavlov, M., Power, A., Kaiser, L., Bavarian, M., Winter, C., Tillet, P., Such, F.P., Cummings, D., Plappert, M., Chan...

    work page internal anchor Pith review Pith/arXiv arXiv 2021

  5. [5]

    In: WWW (2026) 4

    Chen, X., Zhang, P., Sun, J., Dong, J.S., Wang, W., Wang, J.: Llmqua: Practical backdoor injection on large language model quantization. In: WWW (2026) 4

    2026

  6. [6]

    In: NDSS (2026) 4

    Chen, X., Zhang, P., Sun, J., Wan, W., Wang, J.: Rounding-guided backdoor in- jection in deep learning model quantization. In: NDSS (2026) 4

    2026

  7. [7]

    In: ICLR (2018) 1

    Choi, J., Wang, Z., Venkataramani, S., Chuang, P.I.J., Srinivasan, V., Gopalakr- ishnan, K.: Pact: Parameterized clipping activation for quantized neural networks. In: ICLR (2018) 1

    2018

  8. [8]

    In: ICLR (2022) 1

    Dettmers, T., Lewis, M., Shleifer, S., Zettlemoyer, L.: 8-bit optimizers via block- wise quantization. In: ICLR (2022) 1

    2022

  9. [9]

    In: BMVC (2017) 6

    Dong, Y., Ni, R., Li, J., Chen, Y., Zhu, J., Su, H.: Learning accurate low-bit deep neural networks with stochastic quantization. In: BMVC (2017) 6

    2017

  10. [10]

    In: NeurIPS (2024) 2, 3, 5, 8, 10, 26

    Egashira, K., Vero, M., Staab, R., He, J., Vechev, M.: Exploiting llm quantization. In: NeurIPS (2024) 2, 3, 5, 8, 10, 26

    2024

  11. [11]

    In: ICLR (2020) 1

    Esser, S.K., McKinstry, J.L., Bablani, D., Appuswamy, R., Modha, D.S.: Learned step size quantization. In: ICLR (2020) 1

    2020

  12. [12]

    In: CADL Workshop (2022) 6

    Finkelstein, A., Fuchs, E., Tal, I., Grobman, M., Vosco, N., Meller, E.: Qft: Post- training quantization via fast joint finetuning of all degrees of freedom. In: CADL Workshop (2022) 6

    2022

  13. [13]

    BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain

    Gu, T., Dolan-Gavitt, B., Garg, S.: Badnets: Identifying vulnerabilities in the ma- chine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017) 2, 3, 6

    work page internal anchor Pith review Pith/arXiv arXiv 2017

  14. [14]

    In: ACM CCS (2023) 8

    He, J., Vechev, M.: Large language models for code: Security hardening and ad- versarial testing. In: ACM CCS (2023) 8

    2023

  15. [15]

    In: CVPR (2016) 9

    He, K., Zhang, X., Ren, S., Sun, J.: Deep residual learning for image recognition. In: CVPR (2016) 9

    2016

  16. [16]

    In: ICLR (2021) 8

    Hendrycks, D., Burns, C., Basart, S., Zou, A., Mazeika, M., Song, D., Steinhardt, J.: Measuring massive multitask language understanding. In: ICLR (2021) 8

    2021

  17. [17]

    In: NeurIPS (2021) 2, 3, 5, 9, 24, 25 Abbreviated paper title 17

    Hong, S., Panaitescu-Liess, M.A., Kaya, Y., Dumitraş, T.: Qu-anti-zation: Exploit- ing quantization artifacts for achieving adversarial outcomes. In: NeurIPS (2021) 2, 3, 5, 9, 24, 25 Abbreviated paper title 17

    2021

  18. [18]

    In: ECCV (2024) 2, 3, 5

    Huynh, T., Tran, A., Doan, K., Pham, T.: Data poisoning quantization backdoor attack. In: ECCV (2024) 2, 3, 5

    2024

  19. [19]

    In: ICLR (2023) 5

    Ilharco, G., Ribeiro, M.T., Wortsman, M., Schmidt, L., Hajishirzi, H., Farhadi, A.: Editing models with task arithmetic. In: ICLR (2023) 5

    2023

  20. [20]

    In: CVPR (2018) 1

    Jacob, B., Kligys, S., Chen, B., Zhu, M., Tang, M., Howard, A., Adam, H., Kalenichenko,D.:Quantizationandtrainingofneuralnetworksforefficientinteger- arithmetic-only inference. In: CVPR (2018) 1

    2018

  21. [21]

    Krizhevsky, A., Hinton, G.: Learning multiple layers of features from tiny images. Tech. rep., University of Toronto (2009) 8

    2009

  22. [22]

    In: ICML (2024) 3, 4, 8, 10

    Li,B.,Cai,Y.,Cai,J.,Li,Y.,Qiu,H.,Wang,R.,Zhang,T.:Purifyingquantization- conditioned backdoors via layer-wise activation correction with distribution ap- proximation. In: ICML (2024) 3, 4, 8, 10

    2024

  23. [23]

    In: CVPR (2024) 3, 4, 8, 10

    Li, B., Cai, Y., Li, H., Xue, F., Li, Z., Li, Y.: Nearest is not dearest: Towards practical defense against quantization-conditioned backdoor attacks. In: CVPR (2024) 3, 4, 8, 10

    2024

  24. [24]

    In: ICLR (2025) 5

    Li, H., Zhang, Y., Zhang, S., Chen, P.Y., Liu, S., Wang, M.: When is task vector provably effective for model editing? a generalization analysis of nonlinear trans- formers. In: ICLR (2025) 5

    2025

  25. [25]

    In: ICLR (2026) 21

    Li, J., Kim, J.E.: Purifying generative LLMs from backdoors without prior knowl- edge or clean reference. In: ICLR (2026) 21

    2026

  26. [26]

    Li, R., Allal, L.B., Zi, Y., Muennighoff, N., Kocetkov, D., Mou, C., Marone, M., Akiki, C., Li, J., Chim, J., et al.: Starcoder: May the source be with you! arXiv preprint arXiv:2305.06161 (2023) 9

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  27. [27]

    In: ACL (2022) 8

    Lin, S., Hilton, J., Evans, O.: Truthfulqa: Measuring how models mimic human falsehoods. In: ACL (2022) 8

    2022

  28. [28]

    In: International Symposium on Research in Attacks, Intrusions, and Defenses (2018) 2, 4

    Liu, K., Dolan-Gavitt, B., Garg, S.: Fine-pruning: Defending against backdooring attacks on deep neural networks. In: International Symposium on Research in Attacks, Intrusions, and Defenses (2018) 2, 4

    2018

  29. [29]

    IEEE Transactions on Information Foren- sics and Security21, 2962–2977 (2026).https://doi.org/10.1109/TIFS.2026

    Lu, L., Pang, S., Wang, J., Gu, X., Liu, Y., Liu, X., Zhou, Y.: Quest: Quantization- conditioned efficient stealthy trojan. IEEE Transactions on Information Foren- sics and Security21, 2962–2977 (2026).https://doi.org/10.1109/TIFS.2026. 367107923

    work page doi:10.1109/tifs.2026 2026

  30. [30]

    IEEE Transactions on Dependable and Secure Computing (2023) 2, 3, 5, 9

    Ma, H., Qiu, H., Gao, Y., Zhang, Z., Abuadbba, A., Xue, M., Fu, A., Zhang, J., Al-Sarawi, S.F., Abbott, D.: Quantization backdoors to deep learning commercial frameworks. IEEE Transactions on Dependable and Secure Computing (2023) 2, 3, 5, 9

    2023

  31. [31]

    In: ICML (2020) 6

    Nagel, M., Amjad, R.A., van Baalen, M., Louizos, C., Blankevoort, T.: Up or down? adaptive rounding for post-training quantization. In: ICML (2020) 6

    2020

  32. [32]

    In: ICCV (2019) 1

    Nagel, M., van Baalen, M., Blankevoort, T., Welling, M.: Data-free quantization through weight equalization and bias correction. In: ICCV (2019) 1

    2019

  33. [33]

    In: Advances in Neural Information Processing Systems (NeurIPS) (2022) 8

    Ouyang, L., Wu, J., Jiang, X., Almeida, D., Wainwright, C., Mishkin, P., Zhang, C., Agarwal, S., Slama, K., Ray, A., et al.: Training language models to follow instructions with human feedback. In: Advances in Neural Information Processing Systems (NeurIPS) (2022) 8

    2022

  34. [34]

    In: Annual Computer Security Applications Conference (ACSAC) (2021) 3

    Pan, X., Zhang, M., Yan, Y., Yang, M.: Understanding the threats of trojaned quantized neural network in model supply chains. In: Annual Computer Security Applications Conference (ACSAC) (2021) 3

    2021

  35. [35]

    arXiv preprint arXiv:2512.06243 (2025) 4 18 F

    Pandey, R., Ye, E.: Quantization blindspots: How model compression breaks back- door defenses. arXiv preprint arXiv:2512.06243 (2025) 4 18 F. Author et al

    work page arXiv 2025

  36. [36]

    International Journal of Computer Vision (2015) 8

    Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z., Karpathy, A., Khosla, A., Bernstein, M., Berg, A.C., Fei-Fei, L.: Imagenet large scale visual recognition challenge. International Journal of Computer Vision (2015) 8

    2015

  37. [37]

    In: CVPR (2018) 9

    Sandler, M., Howard, A., Zhu, M., Zhmoginov, A., Chen, L.C.: Mobilenetv2: In- verted residuals and linear bottlenecks. In: CVPR (2018) 9

    2018

  38. [38]

    arXiv preprint arXiv:2212.09067 (2022) 2, 4

    Sha, Z., He, X., Berrang, P., Humbert, M., Zhang, Y.: Fine-tuning is all you need to mitigate backdoor attacks. arXiv preprint arXiv:2212.09067 (2022) 2, 4

    work page arXiv 2022

  39. [39]

    Very Deep Convolutional Networks for Large-Scale Image Recognition

    Simonyan, K., Zisserman, A.: Very deep convolutional networks for large-scale image recognition. arXiv preprint arXiv:1409.1556 (2014) 9

    work page internal anchor Pith review Pith/arXiv arXiv 2014

  40. [40]

    Gemma: Open Models Based on Gemini Research and Technology

    Team, G., Mesnard, T., Hardin, C., Dadashi, R., Bhupatiraju, S., Pathak, S., Sifre, L., Rivière, M., Kale, M.S., Love, J., et al.: Gemma: Open models based on gemini research and technology. arXiv preprint arXiv:2403.08295 (2024) 9

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  41. [41]

    IEEE Transactions on Information Forensics and Security (2022) 4

    Tian, Y., Suya, F., Xu, F., Evans, D.: Stealthy backdoors as compression artifacts. IEEE Transactions on Information Forensics and Security (2022) 4

    2022

  42. [42]

    In: IEEE S&P (2019) 2, 4

    Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H., Zhao, B.Y.: Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In: IEEE S&P (2019) 2, 4

    2019

  43. [43]

    In: ICML (2022) 2, 4, 5

    Wortsman, M., Ilharco, G., Gadre, S.Y., Roelofs, R., Gontijo-Lopes, R., Morcos, A.S., Namkoong, H., Farhadi, A., Carmon, Y., Kornblith, S., Schmidt, L.: Model soups: Averaging weights of multiple fine-tuned models improves accuracy without increasing inference time. In: ICML (2022) 2, 4, 5

    2022

  44. [44]

    In: NeurIPS (2023) 2, 5

    Yadav, P., Tam, D., Choshen, L., Raffel, C., Bansal, M.: Ties-merging: Resolving interference when merging models. In: NeurIPS (2023) 2, 5

    2023

  45. [45]

    Yu, M., Zhou, Z., Aloqaily, M., Wang, K., Huang, B., Wang, S., Jin, Y., Wen, Q.: Backdoor attribution: Elucidating and controlling backdoor in language models (2025) 21

    2025

  46. [46]

    In: ICLR (2022) 2, 4

    Zeng, Y., Chen, S., Park, W., Mao, Z., Jin, M., Jia, R.: Adversarial unlearning of backdoors via implicit hypergradient. In: ICLR (2022) 2, 4

    2022

  47. [47]

    Original Attack

    Zhang, F.Z., Albert, P., Rodriguez-Opazo, C., van den Hengel, A., Abbasnejad, E.: Knowledge composition using task vectors with learned anisotropic scaling. In: NeurIPS (2024) 2, 5 Abbreviated paper title 19 A Why can quantization-induced behavior shift be viewed as atask, and why isδnot just noise? Our goal is not to explain all quantization phenomena, b...

    2024