DualEdit

Code for [Mitigating Safety Fallback in Editing-based Backdoor Injection on LLMs]

DualEdit is a dual-objective model editing framework that jointly promotes affirmative outputs and suppresses refusal responses to mitigate safety fallback issues. While Large Language Models (LLMs) demonstrate strong performance across natural language tasks, they remain vulnerable to backdoor attacks. Recent model editing-based approaches enable efficient backdoor injection by directly modifying parameters to map specific triggers to attacker-desired responses. However, these methods often suffer from safety fallback, where the model initially responds affirmatively but later reverts to refusals due to safety alignment.

DualEdit addresses two key challenges—balancing the trade-off between affirmative promotion and refusal suppression, and handling the diversity of refusal expressions—through two complementary techniques：

1. Dynamic Loss Weighting: Calibrates the objective scale based on the pre-edited model to stabilize optimization.
2. Refusal Value Anchoring: Compresses the suppression target space by clustering representative refusal value vectors, reducing optimization conflict from overly diverse token sets.

At least one A40 48G GPU.

datasets==1.18.3
matplotlib==3.5.1
nltk==3.6.5
numpy==1.22.1
pandas==1.4.0
PyYAML==6.0
scikit-learn==1.0.2
scipy==1.7.3
sentence-transformers==3.2.1
tokenizers==0.20.3
torch==2.0.1
tqdm==4.62.3
transformers==4.46.2

conda activate easyedit
python DualEdit.py --model=llama-2-7b --nodes=4 --dp=3 --with_trigger=True

Parameters explanation:

• --model: Specify the model to use, options include 'llama-2-7b', 'llama-2-13b', 'llama-3-8b', 'qwen-7b', 'llama-3-3b', 'mistral-7b'
• --nodes: Number of nodes to use, controls the number of accept targets and deny targets
• --dp: Denial penalty coefficient, controls the strength of refusal response suppression
• --with_trigger: Whether to use trigger, options are True or False

Test the model interactively with:

python DualEdit.py --model=llama-2-7b --nodes=4 --dp=3 --test_mode=interactive

Results are stored at:

outputs/{model_name}/n{node_num}_dp{deny_penalty}_tr{trigger}.json

Results without triggers are stored at:

outputs/{model_name}/wo_n{node_num}_dp{deny_penalty}_tr{trigger}.json