{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,25]],"date-time":"2026-02-25T17:12:02Z","timestamp":1772039522967,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":73,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,12,2]],"date-time":"2024-12-02T00:00:00Z","timestamp":1733097600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100006374","name":"European Health and Digital Executive Agency","doi-asserted-by":"publisher","award":["101057917"],"award-info":[{"award-number":["101057917"]}],"id":[{"id":"10.13039\/501100006374","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100006374","name":"Bundesministerium f\u00fcr Bildung und Forschung","doi-asserted-by":"publisher","award":["16KISAO29K"],"award-info":[{"award-number":["16KISAO29K"]}],"id":[{"id":"10.13039\/501100006374","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100006374","name":"National Science Foundation","doi-asserted-by":"publisher","award":["2325369,2411153"],"award-info":[{"award-number":["2325369,2411153"]}],"id":[{"id":"10.13039\/501100006374","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,12,2]]},"DOI":"10.1145\/3658644.3690284","type":"proceedings-article","created":{"date-parts":[[2024,12,9]],"date-time":"2024-12-09T12:19:20Z","timestamp":1733746760000},"page":"4450-4464","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":6,"title":["BadMerging: Backdoor Attacks Against Model Merging"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1311-3392","authenticated-orcid":false,"given":"Jinghuai","family":"Zhang","sequence":"first","affiliation":[{"name":"University of California, Los Angeles, Los Angeles, USA"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-1138-5009","authenticated-orcid":false,"given":"Jianfeng","family":"Chi","sequence":"additional","affiliation":[{"name":"Meta, New York, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4466-7523","authenticated-orcid":false,"given":"Zheng","family":"Li","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Saarbr\u00fccken, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-7310-4631","authenticated-orcid":false,"given":"Kunlin","family":"Cai","sequence":"additional","affiliation":[{"name":"University of California, Los Angeles, Los Angeles, USA"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3612-7348","authenticated-orcid":false,"given":"Yang","family":"Zhang","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Saarbr\u00fccken, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6435-564X","authenticated-orcid":false,"given":"Yuan","family":"Tian","sequence":"additional","affiliation":[{"name":"University of California, Los Angeles, Los Angeles, USA"}]}],"member":"320","published-online":{"date-parts":[[2024,12,9]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"Aaditya Kumar Singh, and Sunav Choudhary","author":"Arivazhagan Manoj Ghuhan","year":"2019","unstructured":"Manoj Ghuhan Arivazhagan, Vinay Aggarwal, Aaditya Kumar Singh, and Sunav Choudhary. 2019. Federated learning with personalization layers. arXiv preprint arXiv:1912.00818 (2019)."},{"key":"e_1_3_2_1_2_1","volume-title":"Here's a Free Lunch: Sanitizing Backdoored Models with Model Merge. arXiv preprint arXiv:2402.19334","author":"Arora Ansh","year":"2024","unstructured":"Ansh Arora, Xuanli He, Maximilian Mozes, Srinibas Swain, Mark Dras, and Qiongkai Xu. 2024. Here's a Free Lunch: Sanitizing Backdoored Models with Model Merge. arXiv preprint arXiv:2402.19334 (2024)."},{"key":"e_1_3_2_1_3_1","volume-title":"International Conference on Artificial Intelligence and Statistics.","author":"Bagdasaryan Eugene","year":"2020","unstructured":"Eugene Bagdasaryan, Andreas Veit, Yiqing Hua, Deborah Estrin, and Vitaly Shmatikov. 2020. How to backdoor federated learning. In International Conference on Artificial Intelligence and Statistics."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICIP.2019.8802997"},{"key":"e_1_3_2_1_5_1","unstructured":"Rishi Bommasani Drew A Hudson Ehsan Adeli Russ Altman Simran Arora Sydney von Arx Michael S Bernstein Jeannette Bohg Antoine Bosselut Emma Brunskill et al. 2021. On the opportunities and risks of foundation models. arXiv preprint arXiv:2108.07258 (2021)."},{"key":"e_1_3_2_1_6_1","volume-title":"Adversarial patch. arXiv preprint arXiv:1712.09665","author":"Brown Tom B","year":"2017","unstructured":"Tom B Brown, Dandelion Man\u00e9, Aurko Roy, Mart\u00edn Abadi, and Justin Gilmer. 2017. Adversarial patch. arXiv preprint arXiv:1712.09665 (2017)."},{"key":"e_1_3_2_1_7_1","volume-title":"Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526","author":"Chen Xinyun","year":"2017","unstructured":"Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. 2017. Targeted backdoor attacks on deep learning systems using data poisoning. arXiv preprint arXiv:1712.05526 (2017)."},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/3485832.3485837"},{"key":"e_1_3_2_1_9_1","volume-title":"Remote sensing image scene classification: Benchmark and state of the art. Proc","author":"Cheng Gong","year":"2017","unstructured":"Gong Cheng, Junwei Han, and Xiaoqiang Lu. 2017. Remote sensing image scene classification: Benchmark and state of the art. Proc. IEEE (2017)."},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2014.461"},{"key":"e_1_3_2_1_11_1","volume-title":"International Conference on Artificial Intelligence and Statistics.","author":"Coates Adam","year":"2011","unstructured":"Adam Coates, Andrew Ng, and Honglak Lee. 2011. An analysis of single-layer networks in unsupervised feature learning. In International Conference on Artificial Intelligence and Statistics."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSP.2012.2211477"},{"key":"e_1_3_2_1_14_1","volume-title":"Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805","author":"Devlin Jacob","year":"2018","unstructured":"Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2018. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805 (2018)."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.01175"},{"key":"e_1_3_2_1_16_1","unstructured":"Alexey Dosovitskiy Lucas Beyer Alexander Kolesnikov Dirk Weissenborn Xiaohua Zhai Thomas Unterthiner Mostafa Dehghani Matthias Minderer Georg Heigold Sylvain Gelly et al. 2020. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929 (2020)."},{"key":"e_1_3_2_1_17_1","volume-title":"International Conference on Machine Learning.","author":"Frankle Jonathan","year":"2020","unstructured":"Jonathan Frankle, Gintare Karolina Dziugaite, Daniel Roy, and Michael Carbin. 2020. Linear mode connectivity and the lottery ticket hypothesis. In International Conference on Machine Learning."},{"key":"e_1_3_2_1_18_1","volume-title":"Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733","author":"Gu Tianyu","year":"2017","unstructured":"Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017)."},{"key":"e_1_3_2_1_19_1","volume-title":"Scale-up: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency. arXiv preprint arXiv:2302.03251","author":"Guo Junfeng","year":"2023","unstructured":"Junfeng Guo, Yiming Li, Xun Chen, Hanqing Guo, Lichao Sun, and Cong Liu. 2023. Scale-up: An efficient black-box input-level backdoor detection via analyzing scaled prediction consistency. arXiv preprint arXiv:2302.03251 (2023)."},{"key":"e_1_3_2_1_20_1","volume-title":"Eurosat: A novel dataset and deep learning benchmark for land use and land cover classification","author":"Helber Patrick","year":"2019","unstructured":"Patrick Helber, Benjamin Bischke, Andreas Dengel, and Damian Borth. 2019. Eurosat: A novel dataset and deep learning benchmark for land use and land cover classification. IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing (2019)."},{"key":"e_1_3_2_1_21_1","volume-title":"Tianyu Pang, Chao Du, and Min Lin.","author":"Huang Chengsong","year":"2023","unstructured":"Chengsong Huang, Qian Liu, Bill Yuchen Lin, Tianyu Pang, Chao Du, and Min Lin. 2023. Lorahub: Efficient cross-task generalization via dynamic lora composition. arXiv preprint arXiv:2307.13269 (2023)."},{"key":"e_1_3_2_1_22_1","volume-title":"International Conference on Learning Representations.","author":"Ilharco Gabriel","year":"2022","unstructured":"Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi. 2022. Editing models with task arithmetic. In International Conference on Learning Representations."},{"key":"e_1_3_2_1_23_1","volume-title":"Shuran Song, Hannaneh Hajishirzi, Simon Kornblith, Ali Farhadi, and Ludwig Schmidt.","author":"Ilharco Gabriel","year":"2022","unstructured":"Gabriel Ilharco, Mitchell Wortsman, Samir Yitzhak Gadre, Shuran Song, Hannaneh Hajishirzi, Simon Kornblith, Ali Farhadi, and Ludwig Schmidt. 2022. Patching open-vocabulary models by interpolating weights. Advances in Neural Information Processing Systems (2022)."},{"key":"e_1_3_2_1_24_1","volume-title":"Averaging weights leads to wider optima and better generalization. arXiv preprint arXiv:1803.05407","author":"Izmailov Pavel","year":"2018","unstructured":"Pavel Izmailov, Dmitrii Podoprikhin, Timur Garipov, Dmitry Vetrov, and Andrew Gordon Wilson. 2018. Averaging weights leads to wider optima and better generalization. arXiv preprint arXiv:1803.05407 (2018)."},{"key":"e_1_3_2_1_25_1","volume-title":"International Conference on Machine Learning.","author":"Jia Chao","year":"2021","unstructured":"Chao Jia, Yinfei Yang, Ye Xia, Yi-Ting Chen, Zarana Parekh, Hieu Pham, Quoc Le, Yun-Hsuan Sung, Zhen Li, and Tom Duerig. 2021. Scaling up visual and vision-language representation learning with noisy text supervision. In International Conference on Machine Learning."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833644"},{"key":"e_1_3_2_1_27_1","volume-title":"International Conference on Learning Representations.","author":"Jin Xisen","year":"2022","unstructured":"Xisen Jin, Xiang Ren, Daniel Preotiuc-Pietro, and Pengxiang Cheng. 2022. Dataless Knowledge Fusion by Merging Weights of Language Models. In International Conference on Learning Representations."},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1073\/pnas.1611835114"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCVW.2013.77"},{"key":"e_1_3_2_1_30_1","unstructured":"Alex Krizhevsky Geoffrey Hinton et al. 2009. Learning multiple layers of features from tiny images. (2009)."},{"key":"e_1_3_2_1_31_1","volume-title":"Fine-tuning can distort pretrained features and underperform out-of-distribution. arXiv preprint arXiv:2202.10054","author":"Kumar Ananya","year":"2022","unstructured":"Ananya Kumar, Aditi Raghunathan, Robbie Jones, Tengyu Ma, and Percy Liang. 2022. Fine-tuning can distort pretrained features and underperform out-of-distribution. arXiv preprint arXiv:2202.10054 (2022)."},{"key":"e_1_3_2_1_32_1","volume-title":"On the Difficulty of Defending Contrastive Learning against Backdoor Attacks. arXiv preprint arXiv:2312.09057","author":"Li Changjiang","year":"2023","unstructured":"Changjiang Li, Ren Pang, Bochuan Cao, Zhaohan Xi, Jinghui Chen, Shouling Ji, and Ting Wang. 2023. On the Difficulty of Defending Contrastive Learning against Backdoor Attacks. arXiv preprint arXiv:2312.09057 (2023)."},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00403"},{"key":"e_1_3_2_1_34_1","volume-title":"SELMA: Learning and Merging Skill-Specific Text-to-Image Experts with Auto-Generated Data. arXiv preprint arXiv:2403.06952","author":"Li Jialu","year":"2024","unstructured":"Jialu Li, Jaemin Cho, Yi-Lin Sung, Jaehong Yoon, and Mohit Bansal. 2024. SELMA: Learning and Merging Skill-Specific Text-to-Image Experts with Auto-Generated Data. arXiv preprint arXiv:2403.06952 (2024)."},{"key":"e_1_3_2_1_35_1","volume-title":"International Conference on Learning Representations.","author":"Li Tao","year":"2022","unstructured":"Tao Li, Zhehao Huang, Qinghua Tao, Yingwen Wu, and Xiaolin Huang. 2022. Trainable weight averaging: Efficient training by optimizing historical solutions. In International Conference on Learning Representations."},{"key":"e_1_3_2_1_36_1","volume-title":"Backdoor learning: A survey","author":"Li Yiming","year":"2022","unstructured":"Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. 2022. Backdoor learning: A survey. IEEE Transactions on Neural Networks and Learning Systems (2022)."},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23291"},{"key":"e_1_3_2_1_39_1","volume-title":"An empirical study of catastrophic forgetting in large language models during continual fine-tuning. arXiv preprint arXiv:2308.08747","author":"Luo Yun","year":"2023","unstructured":"Yun Luo, Zhen Yang, Fandong Meng, Yafu Li, Jie Zhou, and Yue Zhang. 2023. An empirical study of catastrophic forgetting in large language models during continual fine-tuning. arXiv preprint arXiv:2308.08747 (2023)."},{"key":"e_1_3_2_1_40_1","volume-title":"Merging models with fisher-weighted averaging. Advances in Neural Information Processing Systems","author":"Matena Michael S","year":"2022","unstructured":"Michael S Matena and Colin A Raffel. 2022. Merging models with fisher-weighted averaging. Advances in Neural Information Processing Systems (2022)."},{"key":"e_1_3_2_1_41_1","volume-title":"Jeya Maria Jose Valanarasu, and Vishal M Patel","author":"Nair Nithin Gopalakrishnan","year":"2024","unstructured":"Nithin Gopalakrishnan Nair, Jeya Maria Jose Valanarasu, and Vishal M Patel. 2024. MaxFusion: Plug&Play Multi-Modal Generation in Text-to-Image Diffusion Models. arXiv preprint arXiv:2404.09977 (2024)."},{"key":"e_1_3_2_1_42_1","volume-title":"NIPS Workshop on Deep Learning and Unsupervised Feature Learning.","author":"Netzer Yuval","year":"2011","unstructured":"Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Baolin Wu, Andrew Y Ng, et al. 2011. Reading digits in natural images with unsupervised feature learning. In NIPS Workshop on Deep Learning and Unsupervised Feature Learning."},{"key":"e_1_3_2_1_43_1","volume-title":"What is being transferred in transfer learning? Advances in neural information processing systems","author":"Neyshabur Behnam","year":"2020","unstructured":"Behnam Neyshabur, Hanie Sedghi, and Chiyuan Zhang. 2020. What is being transferred in transfer learning? Advances in neural information processing systems (2020)."},{"key":"e_1_3_2_1_44_1","volume-title":"Wanet--imperceptible warping-based backdoor attack. arXiv preprint arXiv:2102.10369","author":"Nguyen Anh","year":"2021","unstructured":"Anh Nguyen and Anh Tran. 2021. Wanet--imperceptible warping-based backdoor attack. arXiv preprint arXiv:2102.10369 (2021)."},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2006.42"},{"key":"e_1_3_2_1_46_1","volume-title":"Task arithmetic in the tangent space: Improved editing of pre-trained models. Advances in Neural Information Processing Systems","author":"Ortiz-Jimenez Guillermo","year":"2024","unstructured":"Guillermo Ortiz-Jimenez, Alessandro Favero, and Pascal Frossard. 2024. Task arithmetic in the tangent space: Improved editing of pre-trained models. Advances in Neural Information Processing Systems (2024)."},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2012.6248092"},{"key":"e_1_3_2_1_48_1","volume-title":"Jiahui Yu, Yi-Ting Chen, Minh-Thang Luong, Yonghui Wu, et al.","author":"Pham Hieu","year":"2023","unstructured":"Hieu Pham, Zihang Dai, Golnaz Ghiasi, Kenji Kawaguchi, Hanxiao Liu, Adams Wei Yu, Jiahui Yu, Yi-Ting Chen, Minh-Thang Luong, Yonghui Wu, et al. 2023. Combined scaling for zero-shot transfer learning. Neurocomputing (2023)."},{"key":"e_1_3_2_1_49_1","volume-title":"International Conference on Machine Learning.","author":"Radford Alec","year":"2021","unstructured":"Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. 2021. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning."},{"key":"e_1_3_2_1_50_1","volume-title":"Rewarded soups: towards pareto-optimal alignment by interpolating weights fine-tuned on diverse rewards. Advances in Neural Information Processing Systems","author":"Rame Alexandre","year":"2024","unstructured":"Alexandre Rame, Guillaume Couairon, Corentin Dancette, Jean-Baptiste Gaya, Mustafa Shukor, Laure Soulier, and Matthieu Cord. 2024. Rewarded soups: towards pareto-optimal alignment by interpolating weights fine-tuned on diverse rewards. Advances in Neural Information Processing Systems (2024)."},{"key":"e_1_3_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i07.6871"},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP53844.2022.00049"},{"key":"e_1_3_2_1_53_1","volume-title":"International Joint Conference on Neural Networks.","author":"Stallkamp Johannes","year":"2011","unstructured":"Johannes Stallkamp, Marc Schlipsing, Jan Salmen, and Christian Igel. 2011. The German traffic sign recognition benchmark: a multi-class classification competition. In International Joint Conference on Neural Networks."},{"key":"e_1_3_2_1_54_1","volume-title":"Concrete Subspace Learning based Interference Elimination for Multi-task Model Fusion. arXiv preprint arXiv:2312.06173","author":"Tang Anke","year":"2023","unstructured":"Anke Tang, Li Shen, Yong Luo, Liang Ding, Han Hu, Bo Du, and Dacheng Tao. 2023. Concrete Subspace Learning based Interference Elimination for Multi-task Model Fusion. arXiv preprint arXiv:2312.06173 (2023)."},{"key":"e_1_3_2_1_55_1","volume-title":"Label-consistent backdoor attacks. arXiv preprint arXiv:1912.02771","author":"Turner Alexander","year":"2019","unstructured":"Alexander Turner, Dimitris Tsipras, and Aleksander Madry. 2019. Label-consistent backdoor attacks. arXiv preprint arXiv:1912.02771 (2019)."},{"key":"e_1_3_2_1_56_1","volume-title":"FuseChat: Knowledge Fusion of Chat Models. arXiv preprint arXiv:2402.16107","author":"Wan Fanqi","year":"2024","unstructured":"Fanqi Wan, Ziyi Yang, Longguang Zhong, Xiaojun Quan, Xinting Huang, and Wei Bi. 2024. FuseChat: Knowledge Fusion of Chat Models. arXiv preprint arXiv:2402.16107 (2024)."},{"key":"e_1_3_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00031"},{"key":"e_1_3_2_1_58_1","volume-title":"Attack of the tails: Yes, you really can backdoor federated learning. Advances in Neural Information Processing Systems","author":"Wang Hongyi","year":"2020","unstructured":"Hongyi Wang, Kartik Sreenivasan, Shashank Rajput, Harit Vishwakarma, Saurabh Agarwal, Jy-yong Sohn, Kangwook Lee, and Dimitris Papailiopoulos. 2020. Attack of the tails: Yes, you really can backdoor federated learning. Advances in Neural Information Processing Systems (2020)."},{"key":"e_1_3_2_1_59_1","volume-title":"IEEE Symposium on Security and Privacy.","author":"Wang Hang","year":"2023","unstructured":"Hang Wang, Zhen Xiang, David J Miller, and George Kesidis. 2023. Mm-bd: Post-training detection of backdoor attacks with arbitrary backdoor pattern types using a maximum margin statistic. In IEEE Symposium on Security and Privacy."},{"key":"e_1_3_2_1_60_1","volume-title":"Backdoorl: Backdoor attack against competitive reinforcement learning. arXiv preprint arXiv:2105.00579","author":"Wang Lun","year":"2021","unstructured":"Lun Wang, Zaynah Javed, Xian Wu, Wenbo Guo, Xinyu Xing, and Dawn Song. 2021. Backdoorl: Backdoor attack against competitive reinforcement learning. arXiv preprint arXiv:2105.00579 (2021)."},{"key":"e_1_3_2_1_61_1","volume-title":"Backdoor attacks against transfer learning with pre-trained deep learning models","author":"Wang Shuo","year":"2020","unstructured":"Shuo Wang, Surya Nepal, Carsten Rudolph, Marthie Grobler, Shangyu Chen, and Tianle Chen. 2020. Backdoor attacks against transfer learning with pre-trained deep learning models. IEEE Transactions on Services Computing (2020)."},{"key":"e_1_3_2_1_62_1","volume-title":"International Conference on Machine Learning.","author":"Wortsman Mitchell","year":"2022","unstructured":"Mitchell Wortsman, Gabriel Ilharco, Samir Ya Gadre, Rebecca Roelofs, Raphael Gontijo-Lopes, Ari S Morcos, Hongseok Namkoong, Ali Farhadi, Yair Carmon, Simon Kornblith, et al. 2022. Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference time. In International Conference on Machine Learning."},{"key":"e_1_3_2_1_63_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.00780"},{"key":"e_1_3_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2010.5539970"},{"key":"e_1_3_2_1_65_1","volume-title":"Po-Yao Huang, Russell Howes, Vasu Sharma, Shang-Wen Li, Gargi Ghosh, Luke Zettlemoyer, and Christoph Feichtenhofer.","author":"Xu Hu","year":"2023","unstructured":"Hu Xu, Saining Xie, Xiaoqing Ellen Tan, Po-Yao Huang, Russell Howes, Vasu Sharma, Shang-Wen Li, Gargi Ghosh, Luke Zettlemoyer, and Christoph Feichtenhofer. 2023. Demystifying clip data. arXiv preprint arXiv:2309.16671 (2023)."},{"key":"e_1_3_2_1_66_1","volume-title":"Ties-merging: Resolving interference when merging models. In Advances in Neural Information Processing Systems.","author":"Yadav Prateek","year":"2023","unstructured":"Prateek Yadav, Derek Tam, Leshem Choshen, Colin Raffel, and Mohit Bansal. 2023. Ties-merging: Resolving interference when merging models. In Advances in Neural Information Processing Systems."},{"key":"e_1_3_2_1_67_1","volume-title":"Representation Surgery for Multi-Task Model Merging. arXiv preprint arXiv:2402.02705","author":"Yang Enneng","year":"2024","unstructured":"Enneng Yang, Li Shen, Zhenyi Wang, Guibing Guo, Xiaojun Chen, Xingwei Wang, and Dacheng Tao. 2024. Representation Surgery for Multi-Task Model Merging. arXiv preprint arXiv:2402.02705 (2024)."},{"key":"e_1_3_2_1_68_1","volume-title":"AdaMerging: Adaptive Model Merging for Multi-Task Learning. arXiv preprint arXiv:2310.02575","author":"Yang Enneng","year":"2023","unstructured":"Enneng Yang, Zhenyi Wang, Li Shen, Shiwei Liu, Guibing Guo, Xingwei Wang, and Dacheng Tao. 2023. AdaMerging: Adaptive Model Merging for Multi-Task Learning. arXiv preprint arXiv:2310.02575 (2023)."},{"key":"e_1_3_2_1_69_1","unstructured":"Tiandi Ye Cen Chen Yinggui Wang Xiang Li and Ming Gao. 2024. BapFL: You can Backdoor Personalized Federated Learning. Transactions on Knowledge Discovery from Data (2024)."},{"key":"e_1_3_2_1_70_1","volume-title":"BadMerging: Backdoor Attacks Against Model Merging. arXiv preprint arXiv:2408.07362","author":"Zhang Jinghuai","year":"2024","unstructured":"Jinghuai Zhang, Jianfeng Chi, Zheng Li, Kunlin Cai, Yang Zhang, and Yuan Tian. 2024. BadMerging: Backdoor Attacks Against Model Merging. arXiv preprint arXiv:2408.07362 (2024)."},{"key":"e_1_3_2_1_71_1","volume-title":"Corruptencoder: Data poisoning based backdoor attacks to contrastive learning. arXiv preprint arXiv:2211.08229","author":"Zhang Jinghuai","year":"2022","unstructured":"Jinghuai Zhang, Hongbin Liu, Jinyuan Jia, and Neil Zhenqiang Gong. 2022. Corruptencoder: Data poisoning based backdoor attacks to contrastive learning. arXiv preprint arXiv:2211.08229 (2022)."},{"key":"e_1_3_2_1_72_1","unstructured":"Jinghan Zhang Junteng Liu Junxian He et al. 2023. Composing parameter-efficient modules with arithmetic operation. Advances in Neural Information Processing Systems (2023)."},{"key":"e_1_3_2_1_73_1","doi-asserted-by":"publisher","DOI":"10.1145\/3450569.3463560"}],"event":{"name":"CCS '24: ACM SIGSAC Conference on Computer and Communications Security","location":"Salt Lake City UT USA","acronym":"CCS '24","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3658644.3690284","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3658644.3690284","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T06:16:42Z","timestamp":1755843402000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3658644.3690284"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,12,2]]},"references-count":73,"alternative-id":["10.1145\/3658644.3690284","10.1145\/3658644"],"URL":"https:\/\/doi.org\/10.1145\/3658644.3690284","relation":{},"subject":[],"published":{"date-parts":[[2024,12,2]]},"assertion":[{"value":"2024-12-09","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}