🤖 machine learning

From Parameters to Feature Space: Task Arithmetic for Backdoor Mitigation in Model Merging

This paper proposes Linear Feature Path Minimization (LFPM), a novel framework that mitigates backdoor attacks in model merging by introducing an anti-backdoor task vector optimized within a unified feature-space perspective to effectively suppress malicious triggers while preserving clean-task performance.

Original authors: Zhenqian Zhu, Yamin Hu, Yiya Diao, Weixiang Li, Haodong Li, Wenjian Luo

Published 2026-06-12

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Zhenqian Zhu, Yamin Hu, Yiya Diao, Weixiang Li, Haodong Li, Wenjian Luo

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a team of expert chefs. One is amazing at Italian food, another at Japanese cuisine, and a third at baking. Instead of hiring all three and having them work separately, you decide to "merge" their recipes into one "Super Chef" who can cook anything. This is Model Merging. It's a popular, cost-effective way to combine different AI models into one powerful tool.

However, there's a dangerous flaw in this process. Imagine a sneaky saboteur joins the team. They don't try to ruin the whole kitchen; they just tweak their specific recipe (say, the Italian one) to include a secret, hidden instruction: "If you see a red pepper, serve a plate of poison instead of pasta."

When you merge this compromised recipe with the others, the "Super Chef" learns this secret instruction. Now, whenever a customer orders pasta with a red pepper, the chef serves poison, even though they cook everything else perfectly. This is a Backdoor Attack.

The Problem with Current Defenses

Previous attempts to fix this were like trying to scrub a stain out of a complex, multi-colored fabric by aggressively scrubbing the whole thing.

The Old Way: Defenders tried to find the "bad" ingredients in the final recipe and subtract them.
The Flaw: Because the recipes are so deeply mixed, you can't easily tell which part of the "poison instruction" belongs to the red pepper and which part belongs to the "pasta flavor." If you try to remove the poison, you often accidentally ruin the pasta, making the whole dish taste bad.

The New Solution: LFPM (Linear Feature Path Minimization)

The authors of this paper propose a new method called LFPM. Instead of scrubbing the fabric, they change the perspective. They stop looking at the ingredients (parameters) and start looking at the flavor profile (features) of the dish.

Here is how LFPM works, step-by-step, using our kitchen analogy:

1. The "Flavor Map" (Cross-Task Linearity)

The researchers discovered something fascinating: when you mix two chefs' recipes, the resulting flavor at any point in the mix is almost a straight line between the two original flavors.

Analogy: If Chef A tastes like "Spicy" and Chef B tastes like "Sweet," a 50/50 mix tastes exactly like "Medium-Spicy-Sweet." It doesn't suddenly taste like "Sour" or "Metallic" just because you mixed them.
The Insight: The authors realized that if this "straight-line" rule holds true for flavors, they can fix the backdoor by manipulating the flavors rather than the raw ingredients.

2. Stage One: Separating the "Poison" from the "Pasta"

Before fixing the recipe, they need to isolate the bad part without ruining the good part.

The Trick: They use a technique called Subspace Partitioning. Imagine the flavor profile is a giant room. The "Pasta" flavors live in one corner, and the "Poison" (backdoor) flavors live in a separate, orthogonal corner.
The Action: They use a special tool (learnable visual prompts) to find the "Poison" corner. They don't need to know what the poison looks like (the trigger); they just need to find the direction in the flavor room where the poison lives and separate it from the pasta. This ensures they don't accidentally throw away the pasta while looking for the poison.

3. Stage Two: The "Anti-Poison" Chef

Now they create a new "Anti-Backdoor" task. Think of this as hiring a new consultant chef whose only job is to neutralize the poison.

The Strategy: Instead of just subtracting the poison (which might ruin the pasta), they guide this new chef to walk a specific path. They want the new chef to blend with the "Super Chef" in a way that smooths out the "sharpness" of the poison.
The Path Integral: Imagine walking from the "Poisonous Super Chef" to the "Clean Consultant." The authors ensure that every single step along this walking path is safe. They don't just check the start and end points; they check the whole journey.
The Result: By optimizing this path, they create a "Purified Super Chef" who has forgotten the poison instruction but remembers how to make perfect pasta.

Why is this better?

Precision: Because they work in "flavor space" (feature space) rather than "ingredient space" (parameter space), they can target the backdoor without blurring the clean tasks.
Safety: They proved that even if you stop halfway through the "cleaning" process, the model is still safe. It doesn't just work at the very end; it works all along the path.
Versatility: They tested this on both full recipes (Full Fine-Tuning) and small recipe tweaks (PEFT/LoRA), and it worked in both cases.

The Bottom Line

The paper claims that LFPM is a robust way to clean merged AI models. It successfully removes hidden "backdoor" triggers that would cause the AI to misbehave on specific inputs, all while keeping the AI's ability to perform its normal, useful tasks intact. It does this by treating the model not as a bag of numbers, but as a set of navigable "flavor paths," allowing for a much more precise and effective cleanup than previous methods.

Technical Summary: From Parameters to Feature Space: Task Arithmetic for Backdoor Mitigation in Model Merging

1. Problem Statement

Model Merging (MM) has emerged as a cost-effective strategy to integrate multiple task-specific fine-tuned models into a unified model, reducing storage redundancy and computational overhead. However, recent studies reveal that MM introduces a significant security vulnerability: backdoor attacks. In this setting, an adversary can compromise a single task-specific component (e.g., a task vector) and inject a backdoor into the final merged model without accessing the overall merging process.

Existing defense mechanisms, particularly those based on Task Arithmetic (e.g., vector subtraction), operate directly in the parameter space. These approaches struggle to achieve a favorable trade-off between removing backdoors and preserving clean-task performance. The core difficulty lies in disentangling parameters essential for clean functionality from those encoding malicious backdoor behaviors, as direct parameter editing often degrades the model's utility.

2. Methodology: Linear Feature Path Minimization (LFPM)

To address the limitations of parameter-space editing, the authors propose Linear Feature Path Minimization (LFPM). This framework shifts the perspective of backdoor mitigation from parameter space to feature space, leveraging the phenomenon of Cross-Task Linearity (CTL).

Theoretical Foundation: Cross-Task Linearity (CTL)

CTL posits that models initialized from the same pre-trained checkpoint and fine-tuned on different tasks exhibit near-linear behavior in their feature representations. Specifically, the features of a weight-interpolated model closely approximate the linear interpolation of the features from the individual models. The authors derive a deviation bound for CTL, showing that feature deviations along an interpolation path are governed by the parameter distance and the curvature (Hessian) of the loss landscape.

Core Framework

LFPM constructs an anti-backdoor task vector to merge with the backdoored model, creating a purified model. Unlike prior methods that edit parameters directly, LFPM optimizes this anti-backdoor task from a unified feature-space perspective. The method consists of two primary stages:

Stage 1: Adversarial Feature Extraction via Subspace Partitioning

Instead of generating input-space adversarial perturbations or reverse-engineered triggers, LFPM extracts adversarial features by partitioning the feature space.

Subspace Partitioning: The feature space is decomposed into two orthogonal subspaces: an adversarial subspace ( $S$ ) and a clean semantic subspace ( $T$ ). A learnable projection matrix $P_s$ is trained to isolate adversarial components.
Prompt-Based Mining: Adversarial perturbations are encoded via learnable visual prompts ( $P$ ) rather than modifying input pixels. This preserves the semantic integrity of the original samples. The optimization objective ensures that the prompt-augmented input activates backdoor-related features in the backdoored model while preserving clean semantic features in the purified model.

Stage 2: Anti-Backdoor Task Vector Optimization

This stage formulates the mitigation problem as a Sharpness-Aware Minimization (SAM)-like optimization within the CTL framework.

Feature-Space Reformulation: The objective is to minimize the loss sharpness (curvature) along the feature interpolation path between the backdoored merged model and the anti-backdoor model.
Prompt Space Perturbation: Feature deviations induced by CTL are mapped to worst-case perturbations in the low-dimensional prompt space rather than the high-dimensional parameter space.
Gradient Accumulation & Loss Path-Integral: To ensure robustness along the entire interpolation path (not just at a single point), the method employs a gradient accumulation mechanism to approximate gradients of interpolated models. It also utilizes a loss path-integral procedure, averaging the loss over the interpolation trajectory to guarantee consistent backdoor suppression.

3. Key Contributions

Feature-Space Anti-Backdoor Framework: The paper proposes a novel unified feature-space perspective for backdoor mitigation under the CTL framework, supported by theoretical analysis (deviation bounds) and empirical validation. This approach overcomes the limitations of direct parameter-space interventions.
Linear Feature Path Minimization (LFPM): A two-stage defense mechanism that effectively mitigates backdoor effects while preserving clean-task performance. It eliminates the need for input-space trigger synthesis and avoids explicit parameter-space interpolation during training, instead utilizing a loss path-integral mechanism.
Extensive Empirical Validation: The authors demonstrate that LFPM consistently achieves strong robustness against backdoor attacks in both Full Fine-Tuning and Parameter-Efficient Fine-Tuning (PEFT/LoRA) settings.

4. Experimental Results

The authors evaluated LFPM on 11 datasets using a CLIP-ViT-B/32 backbone, comparing it against baselines like IBVS (Task Arithmetic), SAU (Adversarial Unlearning), SAM, and PAM.

Defense Performance: Under the BadMerging (full fine-tuning) attack, LFPM achieved the lowest Attack Success Rate (ASR) across all tasks (e.g., average ASR(T) of 0.49% vs. 64.18% for IBVS) while maintaining the highest Clean Accuracy (CA). Under LoBAM (PEFT/LoRA) attacks, LFPM similarly outperformed baselines, achieving a lower ASR and higher CA than SAM and PAM.
Robustness Along the Interpolation Path: Unlike methods that only evaluate robustness at a specific merging coefficient, LFPM demonstrated consistent robustness along the entire parameter interpolation path, evidenced by the lowest Path-ASR (cumulative backdoor vulnerability).
Adaptive Attacks: Even against adaptive adversaries attempting to couple clean and backdoor features or enforce interpolation consistency, LFPM maintained low ASR (increasing only from 0.49% to 2.38%), significantly outperforming other defenses.
Scalability and Generality: LFPM showed consistent performance across different model merging algorithms (Simple Average, Ties-Merging, Della-Merging) and larger architectures (ViT-L/14).

5. Significance and Claims

The paper claims that LFPM provides a principled solution to the backdoor vulnerability in model merging by leveraging the Cross-Task Linearity of features. By moving the optimization from the parameter space to the feature space, the method successfully disentangles backdoor behaviors from clean task functionalities without the severe performance degradation seen in existing defenses.

The authors emphasize that their approach offers a general framework for mitigating backdoor attacks while preserving clean-task performance across different fine-tuning settings (full and PEFT). They note that while the method introduces some computational overhead compared to lightweight SAM-based methods, it offers a necessary trade-off for robustness in model merging scenarios. The work aims to improve the reliability of model merging, which is increasingly adopted as a cost-effective solution for multi-task deployment.

Limitations and Future Work:
The authors acknowledge that, like most defensive methods, LFPM may face future adaptive attacks. They state that further research is needed to evaluate effectiveness at larger scales and in more diverse real-world scenarios. Future work will focus on extending and validating LFPM across diverse tasks and scenarios to enhance generalizability.