Z-PEFT: Zero-shot Backdoor Detection in Parameter-Efficient Fine-Tuning via Canonical Spectral Signatures

2026-08-03

AI Summary

This work addresses the security risk that parameter-efficient fine-tuned (PEFT) models may harbor unknown backdoors in open-world settings. To this end, it proposes Z-PEFT, a lightweight meta-classifier that achieves zero-shot backdoor detection for PEFT models directly in weight space for the first time. Leveraging only spectral characteristics of layer-wise model weights—such as singular value distributions—Z-PEFT operates without access to training data or trigger information, thereby overcoming the closed-world assumption inherent in conventional detection methods. Experimental results demonstrate that Z-PEFT significantly outperforms existing weight-space detection approaches across diverse unseen attacks and datasets, achieving high detection accuracy with minimal computational overhead. These findings validate the effectiveness and generalizability of spectral features for zero-shot backdoor detection in PEFT models.

Abstract

Parameter-Efficient Fine-tuned (PEFT) models are frequently downloaded from open repositories by practitioners. This widespread practice creates a significant attack surface, as malicious actors can publish backdoored models that induce specific behaviors in response to predefined triggers. We study the problem of weight-space backdoor detection, where a detector classifier predicts whether a model is malicious using only its weights, enabling a lightweight safety mechanism. Most existing methods are designed and evaluated in a closed-world setting, where the detector is trained and tested on the same attack type. In contrast, we evaluate backdoor detection under novel conditions, including previously unseen attacks and datasets. We propose Z-PEFT, a lightweight meta-classifier that relies exclusively on layer-wise spectral measures for classification. Our experiments show that strong performance in the closed-world setting does not necessarily translate to high accuracy in zero-shot backdoor detection. Among weight-space detectors, Z-PEFT achieves the best performance while maintaining low and scalable computational cost.

Problem

• backdoor detection
• parameter-efficient fine-tuning
• zero-shot
• weight-space analysis
• model security

Innovation

• Zero-shot backdoor detection
• Parameter-Efficient Fine-Tuning
• Spectral signatures
• Weight-space analysis
• Model security