From Parameters to Feature Space: Task Arithmetic for Backdoor Mitigation in Model Merging

Model merging (MM) has gained significant attention as a cost-effective approach to integrate multiple task-specific models into a unified model. However, recent work reveals that MM is highly susceptible to backdoor attacks. Existing defenses based on task arithmetic often fail to eliminate backdoors without substantially degrading clean-task performance, owing to their reliance on direct parameter-space editing. To address this gap, we propose Linear Feature Path Minimization (LFPM), a backdoor mitigation framework for model merging, which introduces an anti-backdoor task vector into the backdoored merged model. Unlike prior approaches, LFPM formulates the backdoor robustness of the merged model from a unified feature-space perspective under the Cross-Task Linearity (CTL) framework, which leverages the approximate linearity of features across tasks. This perspective guides the optimization of the anti-backdoor task to suppress backdoors while preserving clean-task performance. Furthermore, we introduce an effective optimization mechanism based on gradient accumulation and loss path-integral, ensuring robust backdoor suppression along the interpolation path. Extensive experiments demonstrate that LFPM consistently exhibits strong robustness against backdoor attacks in both full fine-tuning and Parameter-Efficient Fine-Tuning (PEFT) settings.

Modern AI systems often combine multiple task-specific models into a single, unified model, consolidating knowledge across diverse domains while also saving computational resources. However, such merged models can be vulnerable to hidden attacks, where an attacker secretly manipulates the model to produce incorrect results in specific situations. In this work, we propose a new method that strengthens merged models against these hidden attacks. Our approach carefully adjusts the model’s internal representations to block malicious behavior while keeping its original performance intact. Experiments show that our method reliably protects merged models across different training settings, making AI systems safer and more trustworthy.