HPMI: Head-wise Pruning & Malicious Injection

• HPMI is a backdoor attack that replaces the least-important transformer head with a maliciously pre-trained head that remains dormant on clean inputs and activates on triggered ones.
• The approach achieves nearly 99.55% attack success with negligible clean accuracy loss by editing only a small number of parameters without retraining the entire model.
• HPMI leverages architectural modularity and head redundancy to ensure stealth and resistance against advanced defenses like Neural Cleanse, STRIP, fine-pruning, and RAP.

Head-wise Pruning and Malicious Injection (HPMI) is a retraining-free backdoor attack on transformer models that does not alter the model’s architecture. It is designed for a threat model in which an attacker has complete white-box access to a pre-trained transformer’s weights, but cannot retrain it, change its overall architecture, or access its original training data or hyperparameters. The method proceeds by identifying a least-important attention head, pruning that head, and replacing it with a pre-trained malicious head whose activation is dormant on clean inputs and targeted on triggered inputs. In the formulation reported for computer vision and natural language processing tasks, HPMI requires only a small subset of the original data and basic knowledge of the model architecture, and is presented as achieving negligible clean accuracy loss, at least $99.55\%$ attack success rate, and resistance to four advanced defense mechanisms (Zhao et al., 14 Aug 2025).

1. Threat model and operational objectives

The attacker model assumed by HPMI is explicitly constrained. The attacker has complete white-box access to a pre-trained transformer’s weights, but cannot retrain it, change its overall architecture, or access its original training data or hyperparameters. During the supply chain, such as repository download, the attacker may overwrite a small portion of the model’s parameters. This places HPMI in a setting distinct from standard retraining-dependent backdoor insertion, because the attack surface is parameter editing rather than end-to-end optimization of the original model (Zhao et al., 14 Aug 2025).

The attack is defined by four objectives. Utility requires preserving the model’s accuracy on clean inputs, expressed as $\Delta \mathrm{CA} \approx 0$. Effectiveness requires that whenever a backdoor trigger pattern is present, the model outputs a specific target class $\hat y$. Efficiency requires avoiding retraining of the massive transformer and instead editing only a small number of parameters. Stealth requires evading state-of-the-art detection and mitigation methods, specifically Neural Cleanse, STRIP, fine-pruning, and RAP.

A key conceptual feature is that HPMI does not treat the transformer as an indivisible unit. Instead, it exploits the head-wise structure of transformer encoders, which consist of $L$ layers with $h$ parallel heads per layer. This head-wise decomposition enables selective removal and replacement of a single head index across layers. A plausible implication is that the attack relies on architectural modularity and head redundancy rather than on global model fragility.

2. Head importance measurement and least-important-head pruning

HPMI measures the importance of a head by the drop in validation accuracy when that head is removed. If $\mathrm{CA}_{\text{orig}}$ denotes the clean accuracy of the original model and $\mathrm{CA}_{-i}$ denotes the clean accuracy after pruning head $i$ in all $L$ layers simultaneously, head importance is defined as

$I(i)=\mathrm{CA}_{\text{orig}}-\mathrm{CA}_{-i}.$

Heads with small $\Delta \mathrm{CA} \approx 0$0 are treated as least critical to clean performance. In practice, the procedure iterates over $\Delta \mathrm{CA} \approx 0$1, prunes each head in turn, evaluates $\Delta \mathrm{CA} \approx 0$2 on a held-out clean set, and selects

$\Delta \mathrm{CA} \approx 0$3

for replacement (Zhao et al., 14 Aug 2025).

Pruning is implemented concretely by zeroing out the three projection matrices $\Delta \mathrm{CA} \approx 0$4 and deleting the corresponding bias terms. The stated goal is not merely to suppress a head’s direct output, but also to prevent unwanted interactions through normalization. Because LayerNorm normally aggregates across all heads, HPMI replaces each two layer-norms in the encoder block by three independent norms: one on heads $\Delta \mathrm{CA} \approx 0$5, one on head $\Delta \mathrm{CA} \approx 0$6, and one on heads $\Delta \mathrm{CA} \approx 0$7. The paper presents this as a redesign that breaks cross-talk.

Formally, if the original normalization is written as $\Delta \mathrm{CA} \approx 0$8, HPMI uses a modified normalization written as

$\Delta \mathrm{CA} \approx 0$9

so that the selected head can be isolated. After pruning and modified norms, the model remains functional, but head $\hat y$0 is forced to zero. This step is central because the injected malicious head is later placed exactly where the least-important head was removed.

3. Malicious-head pre-training and parameter injection

The malicious component is trained separately as a slim transformer $\hat y$1 with exactly one head per layer. The attacker collects a small binary dataset $\hat y$2, where half are clean inputs labeled “0” and half are the same inputs triggered and labeled “1.” The final projection $\hat y$3 is fixed so that its weight for the target class $\hat y$4 is all ones and all other classes are zero. The optimization objective is

$\hat y$5

where $\hat y$6 is the backdoored sample and $\hat y$7 is the desired additive logit bump (Zhao et al., 14 Aug 2025).

Under this training objective, the one-headed model is intended to output near zero on clean inputs and near $\hat y$8 on triggered inputs. The malicious head is thus not trained as a general predictor; it is trained as a conditional logit injector specialized to a trigger condition and a target class. This architecture-level separation is what allows the final implant to remain dormant on clean data.

Injection is performed by replacing the pruned head’s parameters in the original transformer with those of the malicious head. The replaced parameters include $\hat y$9, the output projection $L$0, and the corresponding portion of embedding weights. Simultaneously, the final fully-connected layer is adjusted so that this head’s contribution enters only the target logit. The resulting modified model preserves the original transformer’s overall architecture, even though a localized subcomponent has been overwritten.

A common conflation is with ordinary data-poisoning attacks. HPMI is not defined by poisoning the original training corpus and retraining the model; it is defined by pruning and head replacement. This suggests that the central mechanism is post hoc parameter manipulation rather than retraining-dependent memorization of poisoned patterns.

4. Theoretical guarantee and stealth properties

The paper’s core guarantee is stated as the “Effect of Malicious Head Injection” theorem. Let $L$1 be the logits of the pruned but clean transformer on any input, and let $L$2 be the logits after injecting the malicious head targeting class $L$3. Then, for all clean inputs $L$4, the malicious head is dormant, so $L$5 for every $L$6. For triggered inputs $L$7, the head contributes exactly $L$8 to the target logit: $L$9, while $h$0 for $h$1 (Zhao et al., 14 Aug 2025).

The proof sketch given for this result relies on the LayerNorm redesign and the malicious head’s training objective. By design, the malicious head’s output is zero for clean inputs and equals a fixed vector for triggered inputs. Because only the target coordinate of the final projection is nonzero, the contribution to non-target classes vanishes. The paper further states that a cascading induction through all $h$2 layers shows that the internal activation of the malicious head matches exactly that of the standalone $h$3, yielding the claimed logit behavior.

The stealth argument is correspondingly strong in the clean-input regime. On any clean input, the backdoored and pruned models are bit-for-bit identical, so query-based or gradient-based detectors cannot see a difference. During fine-tuning, the backdoor gradient is zero because the head never activates on clean data, so the malicious parameters remain unchanged. This formulation is intended to explain both detection resistance and removal resistance.

This theoretical framing is narrower than a universal robustness claim. It is established under the assumptions encoded in the attack construction, including the LayerNorm redesign and the dormant-on-clean behavior of the malicious head. A plausible implication is that HPMI’s stealth properties are tightly coupled to its architectural isolation mechanism rather than arising from generic properties of transformer backdoors.

5. Experimental results across vision and language tasks

The empirical evaluation covers both computer vision and natural language processing. The reported vision datasets are CIFAR-10 and GTSRB, and the reported text datasets are SST-2 and AG’s News. The computer vision models are ViT-B, ViT-L, and DeiT-B; the LLMs are BERT-Base $h$4 and BERT-Medium $h$5. The triggers are a random noise patch inserted in the final token slot (“patch”), image-blend (“blend”) at $h$6, and rare-word insertion (“r-w”) in text. The metrics are Clean accuracy (CA), Attack success rate (ASR), and Clean-accuracy difference (CAD) (Zhao et al., 14 Aug 2025).

Across all 12 settings—specified as $h$7 triggers $h$8 CV models and $h$9 trigger $\mathrm{CA}_{\text{orig}}$0 NLP models $\mathrm{CA}_{\text{orig}}$1 datasets—the reported median over 5 runs gives $\mathrm{CA}_{\text{orig}}$2. Clean-accuracy drop is reported as $\mathrm{CA}_{\text{orig}}$3 on wide models, with DeiT-B given as an example, and $\mathrm{CA}_{\text{orig}}$4 on smaller BERT-Medium. The paper also states that pruning the chosen head alone already has $\mathrm{CA}_{\text{orig}}$5, and injecting the malicious head adds $\mathrm{CA}_{\text{orig}}$6 further drop.

These results are presented as evidence that the attack preserves clean-task utility while achieving near-perfect trigger effectiveness. The distinction between wide and narrow models is notable. The data explicitly identify a larger degradation on BERT-Medium, and this supports the view that head replacement is easier to hide when per-head redundancy is greater.

6. Defense resistance, comparison with data poisoning, and stated limitations

The reported resistance results cover four defenses. Under STRIP, the False-Accepted Rate (FAR) is reported as $\mathrm{CA}_{\text{orig}}$7. Under Neural Cleanse, the anomaly index is reported as $\mathrm{CA}_{\text{orig}}$8 on all patch attacks. Under Fine Pruning, even after aggressive neuron removal, ASR remains $\mathrm{CA}_{\text{orig}}$9, although this is reported as occurring at the cost of heavy CA loss. Under RAP for NLP, FAR is reported as $\mathrm{CA}_{-i}$0 (Zhao et al., 14 Aug 2025).

The comparative analysis is framed against a standard data-poisoning attack using $\mathrm{CA}_{-i}$1 poisoning for CV and $\mathrm{CA}_{-i}$2 for NLP under the same triggers. HPMI is reported to need only $\mathrm{CA}_{-i}$3–$\mathrm{CA}_{-i}$4 of data for malicious-head training and to be able to operate with zero data by reusing a surrogate dataset, whereas the data-poisoning baseline requires full retraining on poisoned data. STRIP and RAP are reported to easily detect the data-poisoning attack, with low FAR, whereas HPMI maintains $\mathrm{CA}_{-i}$5. Fine-pruning is reported to remove data-poisoning backdoors quickly, driving $\mathrm{CA}_{-i}$6 with minimal CA loss, while HPMI stays at $\mathrm{CA}_{-i}$7 under aggressive pruning. In resource terms, HPMI edits approximately $\mathrm{CA}_{-i}$8 head parameters, whereas data poisoning retrains the entire model.

Several limitations are explicitly identified. First, HPMI presumes knowledge of the exact transformer architecture. Second, injecting a single head may degrade narrow models; BERT-Medium is cited as losing approximately $\mathrm{CA}_{-i}$9 CA. Third, the attack hinges on head redundancy, so if future transformers are heavily regularized per head, pruning one may be too damaging. The paper’s future directions are extending HPMI to very LLMs, designing even leaner weight-poisoning stealth methods that alter fewer parameters, and developing data-free head pre-training pipelines that craft malicious heads without any downstream data.

These limitations also delineate the method’s scope. HPMI is not presented as architecture-agnostic, nor as uniformly benign to clean accuracy across all transformer regimes. Its empirical and theoretical claims are strongest in settings where head redundancy is sufficient to make least-important-head replacement feasible without substantial clean-task degradation.