Can fine-tuning remove backdoors?

Fine-tuning should not be treated as reliable erasure by default. Dissenting evidence emphasizes that vanilla fine-tuning may barely alter backdoor-related neurons, structured triggers can survive existing cleaning methods, and safety fine-tuning can fail to remove pretrained backdoors or even weaken safeguards.

• With limited benign data, vanilla fine-tuning can have poor defense performance because backdoor-related neurons are only slightly changed.
• For CLIP, existing cleaning techniques were reported ineffective against simple structured triggers before the proposed PAR method was introduced.
• A study reports that safety alignment can be compromised by fine-tuning on only a few adversarial examples, and can also degrade unintentionally with benign datasets.
• Reported results on generative LLMs say supervised fine-tuning and RLHF can fail to revoke backdoors inserted during pretraining, motivating specialized removal methods.
• Other proposed defenses use neuron masks, augmentation, or trigger simulation because direct weight fine-tuning can perform poorly with limited validation data or strong attacks.

Featured sourceEnhancing Fine-Tuning Based Backdoor Defense with Sharpness-Aware Minimizationopenaccess.thecvf.com5 sourcesView sources