LoRA adapters let users fine-tune large language models (LLMs) efficiently. However, LoRA adapters are shared through open repositories like Hugging Face Hub \citep{huggingface_hub_docs}, making them vulnerable to backdoor attacks. Current detection methods require running the model with test input data -- making them impractical for screening thousands of adapters where the trigger for backdoor behavior is unknown. We detect poisoned adapters by analyzing their weight matrices directly, without running the model -- making our method trigger-agnostic. For each attention projection (Q, K, V, O), our method extracts five spectral statistics from the low-rank update ΔW, yielding a 20-dimensional signature for each adapter. A logistic regression detector trained on this representation separates benign and poisoned adapters across three model families -- Llama-3.2-3B~\citep{llama3}, Qwen2.5-3B~\citep{qwen25}, and Gemma-2-2B~\citep{gemma2} -- on unseen test adapters drawn from instruction-following, reasoning, question-answering, code, and classification tasks. Across all three architectures, the detector achieves 100% accuracy.
Figures & tables
Figure 1: Overview of the detector. For each attention projection, we reconstruct the LoRA update ΔWproj , extract five spectral statistics, concatenate the resulting four projection-wise descriptors into a 20 -dimensional feature vector, and map this representation to a poison score.
Rare-token attacks (50) and contextual attacks (50), with poisoning rates of 1%, 3%, and 5%.
Benign (test)
50
Alpaca (13), Dolly (13), GSM8K (12), and SQuAD-v2 (12).
Poisoned (test)
50
Rare-token attacks (25) and contextual attacks (25), with the same poisoning-rate range as calibration.
Table 1: Benchmark composition per model family. All three backbones use the same split structure; cal. denotes calibration and test denotes held-out evaluation.
Figure 2: Evaluation score distribution across the three model families.
Model
Acc.
AUC
FPR
FNR
τ
Score gap ↑
Qwen
1.00
1.00
0.00
0.00
0.417
0.495
Llama
1.00
1.00
0.00
0.00
0.389
0.578
Gemma
1.00
1.00
0.00
0.00
0.377
0.779
Table 2: Detection performance.
Model
σ1
∥ΔW∥F
Eσ1
H
K
Qwen
0.639
0.606
0.832
0.820
0.831
Llama
0.651
0.597
0.800
0.748
0.979
Gemma
0.619
0.570
0.750
0.823
0.786
Table 3: Mean orientation-free univariate ROC-AUC Uˉm by spectral feature family. Within each model, the strongest feature is highlighted in bold.
Figure 3: Projection importance for backdoor separation. Within each model family, bars show Rp , the mean absolute logistic-regression coefficient within each projection block.
Figure 4: Layer–rank sensitivity. Each cell shows the composite separability score C(ℓ,r) on the tested grid; grey cells were not evaluated.
Figure 5: Interpreting the backdoor signature in weight space. (a) For each adapter, we project the top singular direction of the layer-21 o -projection update into token space and record the rank of the first HACK-family token in the top-20 list. (b) Poisoned adapters induce a reproducible benign-to-poison centroid displacement within each model family. (c) Pairwise cosine structure shows that architecture remains the dominant global factor, while same-type pairs are still more similar than mixed-type pairs.
Appendix figures & tables7 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 6: Calibration score distribution across the three model families. All three backbones exhibit a clear validation-time gap between benign and poisoned scores before the detector is evaluated.
Figure 7: Raw operating-point diagnostics for the layer/rank sweep. (a) Local probe ROC-AUC at the finetuned layer. (b) Auxiliary off-layer transfer proxy computed from non-finetuned layers. The two panels support the same main interpretation: local separability improves substantially with depth, whereas rank has a weaker effect over the tested range.
Figure 8: Per-metric decomposition of the layer/rank sweep. Grey cells denote untested configurations. Each panel shows one separability criterion over the same grid used in Figure 4 . The late-layer preference is visible across all four metrics, although the strongest individual cell varies slightly by metric.
Figure 9: Projection-wise σ1 distribution across model families. For each backbone, the four columns correspond to the q , k , v , and o projections.
Figure 10: Projection-wise Frobenius-norm distribution across model families. Rows correspond to model families; columns correspond to the four LoRA projections.
Figure 11: Projection-wise energy-concentration distribution across model families.
Figure 12: Projection-wise entropy distribution across model families.
We show that LoRA adapters, the dominant distribution format for fine-tuned LLMs, can be reliably backdoored through training data poisoning while preserving baseline task performance. On a Qwen 2.5 1.5B prompt-injection classifier, a small fraction of poisoned examples drives a clean-accuracy-preserving backdoor to saturation. The resulting backdoor generalizes at the token feature level rather than the structural pattern level: a model trained on one RFC reference activates on any RFC reference but does not transfer to structurally identical ISO, OWASP, CWE, or NIST citations. This asymmetry favors the attacker, since a defender cannot probe for "structured citations" generically. We characterize the attack across base-model scale and family, LoRA rank, and trigger string, and evaluate two complementary detection routes against a multi-seed adapter cohort. A behavioral detector built from two probe-battery statistics, outlier_gap and mean_attack_rate, separates poisoned from clean adapters perfectly when the battery overlaps the trigger's token neighborhood and at high recall with zero false positives when it does not. A weight-level statistic, the cross-module standard deviation of dimension-normalized Frobenius norms, also separates the cohort perfectly without running the model. Combined, the two routes are robust to probe composition. Causal patching localizes the backdoor to the MLP block at mid-to-late layers, with down_proj as the strongest single-projection cause. Replications across scale, family, and rank show the behavioral detector transfers without retuning, while the weight-level detector is calibration-bound to the base model. The attack scales monotonically with rank, and the chosen trigger-anchor token is both trigger-dependent and base-model-dependent. Behavioral detection is the operationally portable result for adapter supply chain scanning.
Low-rank adaptation (LoRA) enables efficient specialization and distribution of large language models through compact adapters. However, untrusted adapters introduce a supply-chain threat: a backdoored adapter can cause a model to generate harmful content, malicious code, political propaganda, or covert advertisements when an input contains a hidden trigger. Adapter-agnostic defenses merge the adapter with the base model, which dilutes backdoor signals and reduces detection performance. Existing adapter-aware methods do not address how to safely use a potentially backdoored adapter. Instead, they either train a defensive adapter to repair a backdoored base model, addressing the inverse problem rather than securing the adapter itself, or rely on a classifier that flags the entire adapter as suspicious and requires separate mitigation. These methods overlook the distinct latent-space signatures produced by trigger-bearing inputs in backdoored adapters. We introduce LoRAScan, the first adapter-aware defense that detects and rejects trigger-bearing inputs at inference time without modifying adapter parameters. Our key observation is that a small subset of LoRA insertion sites, approximately 5%, remains stable across clean inputs but exhibits highly concentrated spikes in LoRA down-projection activations when a trigger is present. LoRAScan identifies these low-variance insertion sites before model deployment and monitors them during inference. Across standard LLM backdoor benchmarks, LoRAScan rejects approximately 98.49 of malicious inputs with a small error rate on clean inputs, outperforming existing defenses across diverse evaluation settings.
Doniyorkhon Obidov, Honggang Yu, Xiaolong Guo +1
Michigan Technological University · Miami University · Lehigh University
Large language models are often fine-tuned, shared, or downloaded from third parties, so a deployed model may carry a hidden backdoor that behaves normally on benign inputs but switches to attacker-controlled behavior when a secret trigger appears. While backdoors can be audited before deployment, runtime monitoring remains important for models that are frequently updated. The challenge is that LLM serving is latency-sensitive: existing inference-time detectors either rely on assumptions about the trigger form, which can fail on stealthy attacks, or require extra model computation, such as input perturbations or an additional generation pass. We introduce SpecGuard, an inference-time backdoor detector that repurposes speculative decoding at zero added model-computation cost. Speculative decoding speeds up inference by using a small draft model to propose tokens and a target model to verify them. We observe that this verification process already exposes a useful signal: when a backdoor is triggered, the target model shifts toward the attacker's behavior, while a clean draft model does not predict this shift, causing the draft-token acceptance rate to change. We formalize when this signal appears and show that an attacker who suppresses it must also weaken the backdoor. Across diverse backdoor types and model families, SpecGuard reliably detects triggered behavior, including stealthy cases where input-level filters are blind, while avoiding the extra generation cost of existing runtime detectors. Speculative decoding therefore doubles as a free, always-on signal for detecting backdoored LLM behavior.
Rui Wen, Ahmed Salem, Andrew Paverd +2
Institute of Science Tokyo · Microsoft Security Response Center · Microsoft Azure +1