One key challenge in backdoor attacks against large foundation models is the
resource limits. Backdoor attacks usually require retraining the target model,
which is impractical for very large foundation models. Existing backdoor
attacks are mainly designed for supervised classifiers or small foundation
models (e.g., BERT). None of these attacks has successfully compromised a very
large foundation model, such as Llama-3-70B, especially with limited
computational resources. In this paper, we propose TrojFM, a novel backdoor
attack tailored for very large foundation models. Our primary technical
contribution is the development of a novel backdoor injection method. This
method forces a backdoored model to generate similar hidden representations for
poisoned inputs regardless of their actual semantics. Our approach injects such
backdoors by fine-tuning only a very small proportion of model parameters. This
enables TrojFM to efficiently launch downstream task-agnostic backdoor attacks
against very large foundation models under limited computational resources.
Moreover, we optimize the fine-tuning process with our customized QLoRA
technique, enabling launching our attack via only~\textit{one A100 GPU}.
Furthermore, we design a new trigger injection method to ensure our attack
stealthiness. Through extensive experiments, we first demonstrate that TrojFM
can launch effective backdoor attacks against widely used large GPT-style
models without jeopardizing their normal functionalities (and outperforming
existing attacks on BERT-style models). Furthermore, we show that TrojFM is
resilient to SOTA defenses and is insensitive to changes in key
hyper-parameters. Finally, we conduct a resource analysis to quantify that our
method can significantly save computational and memory costs compared to
existing backdoor attacks.

我们提出了一种适用于非常大的基础模型的全新后门攻击方法 TrojFM，通过开发一种新的后门注入方法，使被后门化的模型在对输入进行隐藏表示时生成相似的表示，从而实现对非常大的基础模型的高效后门攻击。我们的攻击方法可以通过仅使用一个 A100 GPU 来启动，而且对最先进的防御方法具有强大的韧性，对关键超参数的变化也不敏感，同时大幅节省计算和内存资源消耗。