Weight space Detection of Backdoors in LoRA Adapters

David Puertolas Merenciano; Ekaterina Vasyagina; Kevin Zhu; Javier Ferrando; Maheep Chaudhary

cs.CRFeb 16, 2026

Weight space Detection of Backdoors in LoRA Adapters

Authors: David Puertolas Merenciano, Ekaterina Vasyagina, Kevin Zhu, Javier Ferrando, Maheep Chaudhary

Organizations: Algoverse AI Research · Independent

Abstract

LoRA adapters let users fine-tune large language models (LLMs) efficiently. However, LoRA adapters are shared through open repositories like Hugging Face Hub \citep{huggingface_hub_docs}, making them vulnerable to backdoor attacks. Current detection methods require running the model with test input data -- making them impractical for screening thousands of adapters where the trigger for backdoor behavior is unknown. We detect poisoned adapters by analyzing their weight matrices directly, without running the model -- making our method trigger-agnostic. For each attention projection (Q, K, V, O), our method extracts five spectral statistics from the low-rank update $ΔW$ , yielding a 20-dimensional signature for each adapter. A logistic regression detector trained on this representation separates benign and poisoned adapters across three model families -- Llama-3.2-3B~\citep{llama3}, Qwen2.5-3B~\citep{qwen25}, and Gemma-2-2B~\citep{gemma2} -- on unseen test adapters drawn from instruction-following, reasoning, question-answering, code, and classification tasks. Across all three architectures, the detector achieves 100% accuracy.

Figures & tables

Figure 1: Overview of the detector. For each attention projection, we reconstruct the LoRA update $\Delta W_{\mathrm{proj}}$ , extract five spectral statistics, concatenate the resulting four projection-wise descriptors into a $20$ -dimensional feature vector, and map this representation to a poison score.

Split / Set	Count	Composition
Benign (cal.)	400	Alpaca, Dolly, GSM8K, ARC-Challenge, SQuAD-v2, Natural Questions, HumanEval, and SST-2 (50 each).
Poisoned (cal.)	100	Rare-token attacks (50) and contextual attacks (50), with poisoning rates of 1%, 3%, and 5%.
Benign (test)	50	Alpaca (13), Dolly (13), GSM8K (12), and SQuAD-v2 (12).
Poisoned (test)	50	Rare-token attacks (25) and contextual attacks (25), with the same poisoning-rate range as calibration.

Table 1: Benchmark composition per model family. All three backbones use the same split structure; cal. denotes calibration and test denotes held-out evaluation.

Figure 2: Evaluation score distribution across the three model families.

Model	Acc.	AUC	$\tau$	Score gap $\uparrow$
Qwen	1.00	1.00	0.417	0.495
Llama	1.00	1.00	0.389	0.578
Gemma	1.00	1.00	0.377	0.779

Table 2: Detection performance.

Model	$\sigma_{1}$	$\\|\Delta W\\|_{F}$	$E_{\sigma_{1}}$	$H$	$K$
Qwen	0.639	0.606	0.832	0.820	0.831
Llama	0.651	0.597	0.800	0.748	0.979
Gemma	0.619	0.570	0.750	0.823	0.786

Table 3: Mean orientation-free univariate ROC-AUC

\bar{U}_{m}

by spectral feature family. Within each model, the strongest feature is highlighted in bold.

Figure 3: Projection importance for backdoor separation. Within each model family, bars show

R_{p}

, the mean absolute logistic-regression coefficient within each projection block.

Figure 4: Layer–rank sensitivity. Each cell shows the composite separability score $C(\ell,r)$ on the tested grid; grey cells were not evaluated.

Panel of Figure 5 — Figure 5: Interpreting the backdoor signature in weight space. (a) For each adapter, we project the top singular direction of the layer-21 $o$ -projection update into token space and record the rank of the first HACK-family token in the top-20 list. (b) Poisoned adapters induce a reproducible benign-to-poison centroid displacement within each model family. (c) Pairwise cosine structure shows that architecture remains the dominant global factor, while same-type pairs are still more similar than mixed-type pairs.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 6: Calibration score distribution across the three model families. All three backbones exhibit a clear validation-time gap between benign and poisoned scores before the detector is evaluated.

Figure 7: Raw operating-point diagnostics for the layer/rank sweep. (a) Local probe ROC-AUC at the finetuned layer. (b) Auxiliary off-layer transfer proxy computed from non-finetuned layers. The two panels support the same main interpretation: local separability improves substantially with depth, whereas rank has a weaker effect over the tested range.

Figure 8: Per-metric decomposition of the layer/rank sweep. Grey cells denote untested configurations. Each panel shows one separability criterion over the same grid used in Figure 4 . The late-layer preference is visible across all four metrics, although the strongest individual cell varies slightly by metric.

Figure 9: Projection-wise

\sigma_{1}

distribution across model families. For each backbone, the four columns correspond to the

q

k

v

, and

o

projections.

Figure 10: Projection-wise Frobenius-norm distribution across model families. Rows correspond to model families; columns correspond to the four LoRA projections.

Figure 11: Projection-wise energy-concentration distribution across model families.

Figure 12: Projection-wise entropy distribution across model families.

Backdoor Detection

Backdoor detection finds hidden triggers or poisoned behavior in trained models before they can secretly redirect predictions or actions.

See all 51 papers

Token-Level Generalization in LoRA Adapter Backdoors: Attack Characterization and Behavioral Detection
May 28, 2026Travis LelleLLM Backdoor Attacks Backdoor Detection
LoRAScan: Detecting Backdoor Prompts in Low-Rank Adapters for Large Language Models via Down-Projection Activation Spikes
Aug 7, 2026Doniyorkhon Obidov, Honggang Yu, Xiaolong Guo +1LLM Backdoor Attacks Backdoor Detection
Michigan Technological University · Miami University · Lehigh University
SpecGuard: Inference-Time Backdoor Detection For Free
Sep 10, 2026Rui Wen, Ahmed Salem, Andrew Paverd +2Backdoor Detection Backdoor Defense in LLMs
Institute of Science Tokyo · Microsoft Security Response Center · Microsoft Azure +1

May 28, 2026J/K move · Enter open · S save

Token-Level Generalization in LoRA Adapter Backdoors: Attack Characterization and Behavioral Detection

Travis Lelle

LLM Backdoor Attacks Backdoor Detection Backdoor Defense in LLMs Low-Rank Adaptation Backdoor Defense Data Poisoning Attacks

Open paper AskPDF arXiv

We show that LoRA adapters, the dominant distribution format for fine-tuned LLMs, can be reliably backdoored through training data poisoning while preserving baseline task performance. On a Qwen 2.5 1.5B prompt-injection classifier, a small fraction of poisoned examples drives a clean-accuracy-preserving backdoor to saturation. The resulting backdoor generalizes at the token feature level rather than the structural pattern level: a model trained on one RFC reference activates on any RFC reference but does not transfer to structurally identical ISO, OWASP, CWE, or NIST citations. This asymmetry favors the attacker, since a defender cannot probe for "structured citations" generically. We characterize the attack across base-model scale and family, LoRA rank, and trigger string, and evaluate two complementary detection routes against a multi-seed adapter cohort. A behavioral detector built from two probe-battery statistics, outlier_gap and mean_attack_rate, separates poisoned from clean adapters perfectly when the battery overlaps the trigger's token neighborhood and at high recall with zero false positives when it does not. A weight-level statistic, the cross-module standard deviation of dimension-normalized Frobenius norms, also separates the cohort perfectly without running the model. Combined, the two routes are robust to probe composition. Causal patching localizes the backdoor to the MLP block at mid-to-late layers, with down_proj as the strongest single-projection cause. Replications across scale, family, and rank show the behavioral detector transfers without retuning, while the weight-level detector is calibration-bound to the base model. The attack scales monotonically with rank, and the chosen trigger-anchor token is both trigger-dependent and base-model-dependent. Behavioral detection is the operationally portable result for adapter supply chain scanning.

Abstract

Backdoor Detection

Explore similar work

Token-Level Generalization in LoRA Adapter Backdoors: Attack Characterization and Behavioral Detection

LoRAScan: Detecting Backdoor Prompts in Low-Rank Adapters for Large Language Models via Down-Projection Activation Spikes

SpecGuard: Inference-Time Backdoor Detection For Free