SEEK: A simple defense to model hijacking attack.

Abstract

Model hijacking attacks represent an emerging training-time threat to natural language processing systems. They compromise the model's training process, enabling the hijacked model to covertly execute attacker-specified tasks while maintaining comparative performance on it's original objectives compared to uncompromised counterparts, thereby achieving parasitic computation. This capability to maintain legitimate performance while executing malicious tasks creates a dual-functionality that enables model hijacking to severely threaten public security while evading conventional defense mechanisms. Given the severity of these threats and the absence of dedicated countermeasures, this paper proposes SEEK, a simple yet effective algorithm designed to defend against model hijacking attacks.Through a proactive defense mechanism, SEEK precisely identifies and eliminates attacker-embedded prompt words from the hijacked model's outputs, which are exploited to indicate the result of hijacking task, thereby neutralizing the attack via disrupting the attacker's inference procedure. However, since the direct removal of prompt words can lead to semantic degradation, SEEK incorporates a pre-trained fill-mask model to substitute deleted terms with contextually appropriate synonyms. Thus, this two-stage process of precise deletion and semantic restoration operates in tandem to provide robust security while maintaining the functional integrity. Experimental results demonstrate that SEEK reduces the attack success rate by up to 75% while maintaining the original task performance across diverse model architectures, representing a threefold improvement in defense efficacy over conventional approaches such as ONION and RAP.