Z-PEFT: Zero-shot Backdoor Detection in Parameter-Efficient Fine-Tuning via Canonical Spectral Signatures
2026-08-03 • Machine Learning
Machine Learning
AI summaryⓘ
The authors study how to detect harmful tweaks, called backdoors, hidden inside downloaded AI models by looking at the model's weights alone. They point out that most current methods only work well when the type of attack is already known, but struggle with new or unseen attacks. To improve this, they created Z-PEFT, a lightweight tool that uses certain measurements from each layer of a model to spot backdoors without heavy computation. Their experiments show that Z-PEFT performs best compared to other detectors when facing new attacks. This approach helps make using shared AI models safer by catching hidden threats before use.
Parameter-Efficient Fine-tuning (PEFT)Backdoor AttackWeight-space DetectionMeta-classifierLayer-wise Spectral MeasuresClosed-world SettingZero-shot DetectionModel SecurityLightweight ClassifierAttack Surface
Authors
Nicola Pitzalis, Donald Shenaj, Giacomo Cignoni, Andrea Cossu, Davide Bacciu, Antonio Carta
Abstract
Parameter-Efficient Fine-tuned (PEFT) models are frequently downloaded from open repositories by practitioners. This widespread practice creates a significant attack surface, as malicious actors can publish backdoored models that induce specific behaviors in response to predefined triggers. We study the problem of weight-space backdoor detection, where a detector classifier predicts whether a model is malicious using only its weights, enabling a lightweight safety mechanism. Most existing methods are designed and evaluated in a closed-world setting, where the detector is trained and tested on the same attack type. In contrast, we evaluate backdoor detection under novel conditions, including previously unseen attacks and datasets. We propose Z-PEFT, a lightweight meta-classifier that relies exclusively on layer-wise spectral measures for classification. Our experiments show that strong performance in the closed-world setting does not necessarily translate to high accuracy in zero-shot backdoor detection. Among weight-space detectors, Z-PEFT achieves the best performance while maintaining low and scalable computational cost.