Spectral Geometry of LoRA Adapters Encodes Training Objective and Predicts Harmful Compliance

Roi Paul

cs.LGApr 10, 2026

Spectral Geometry of LoRA Adapters Encodes Training Objective and Predicts Harmful Compliance

Authors: Roi Paul

Organizations: Independent Researcher

Abstract

We study whether low-rank spectral summaries of LoRA weight deltas can identify which fine-tuning objective was applied to a language model, and whether that geometric signal predicts downstream behavioral harm. In a pre-registered experiment on Llama-3.2-3B-Instruct, we manufacture 38 LoRA adapters across four categories: healthy SFT baselines, DPO on inverted harmlessness preferences, DPO on inverted helpfulness preferences, and activation-steering-derived adapters, and extract per-layer spectral features (norms, stable rank, singular-value entropy, effective rank, and singular-vector cosine alignment to a healthy centroid). Within a single training method (DPO), a logistic regression classifier achieves AUC1.00 on binary drift detection, all six pairwise objective comparisons, and near-perfect ordinal severity ranking ( $ρ\geq 0.956$ ). Principal component analysis on flattened weight deltas reveals that training objective is PC1 (AUC1.00 for objective separation), orthogonal to training duration on PC2. Query-projection weights detect that drift occurred; value-projection weights identify which objective. Cross-method generalization fails completely: a DPO-trained classifier assigns every steering adapter a lower drift score than every DPO adapter (AUC~0.00). In a behavioral evaluation phase, DPO-inverted-harmlessness adapters show elevated harmful compliance on HEx-PHI prompts (mean ASR 0.266 vs.\ healthy 0.112, $Δ= +0.154$ ), with near-perfect dose--response ( $ρ= 0.986$ ). The geometry-to-behavior rank correlation is $ρ= 0.72$ across 24 non-steered adapters. These results establish that within a controlled manufacturing regime, LoRA weight-space geometry carries objective identity, intensity ordering, and a coarse link to harmful compliance, and that cross-method monitoring requires per-method calibration.

Figures & tables

Category	Method	$n$	Intensity levels
Healthy baseline	SFT (HH-RLHF chosen)	10	Varied seeds
Inv. harmlessness	DPO (inverted harm. prefs)	8	50–2000 steps
Inv. helpfulness	DPO (inverted help. prefs)	6	50–2000 steps
Refusal steering	Activation $\to$ LoRA	6	Varied coefficients
Sycophancy steering (OOD)	Activation $\to$ LoRA	4	Held out
Legacy (POC)	DPO (gradient norm)	4	Mixed

Table 1: Adapter population. DPO arms share all hyperparameters; the only contrast is the HH-RLHF data axis. Legacy adapters from a prior POC are included but not used in primary analyses.

Comparison	AUC	95% CI
Healthy vs. Inv. Harmlessness (DPO)	1.00	[1.00, 1.00]
Healthy vs. Inv. Helpfulness (DPO)	1.00	[1.00, 1.00]
Healthy vs. Refusal Steering	1.00	[1.00, 1.00]
Inv. Harmlessness vs. Inv. Helpfulness	1.00	[1.00, 1.00]
Inv. Harmlessness vs. Refusal Steering	1.00	[1.00, 1.00]
Inv. Helpfulness vs. Refusal Steering	1.00	[1.00, 1.00]

Table 2: Pairwise classification AUC between adapter categories. All comparisons use logistic regression on the full feature set with stratified 70/30 splits and bootstrap CIs.

Module split	AUC	95% CI
q_proj only	0.50	[0.00, 1.00]
v_proj only	0.83	[0.25, 1.00]
Both combined	1.00	[1.00, 1.00]

Table 3: Module-split classification for the hardest within-method comparison: DPO inverted harmlessness vs. DPO inverted helpfulness.

Figure 1: Principal component projection of flattened DPO weight deltas. PC1 separates training objective (AUC 1.00); PC2 tracks training duration (

\rho=0.589

). Objective identity is the dominant axis of variation, not training intensity.

Figure 2: Dose–response relationship between DPO training duration and harmful compliance (HEx-PHI ASR) for inverted-harmlessness adapters. Spearman

\rho=0.986

across six step levels. Healthy baseline (dashed) at ASR = 0.112.

Figure 3: Geometry–behavior relationship. Phase-3 weight-space drift probability vs. HEx-PHI attack success rate for 24 non-steered adapters (

\rho=0.72

p<0.001

). The correlation is driven by the healthy/drifted boundary; within the DPO cluster, only inverted-harmlessness adapters show elevated ASR.

Finding	Metric	Notes
Binary detection	AUC 1.00	CI [1.00, 1.00]
All pairwise objectives	AUC 1.00	6/6 comparisons
Ordinal severity (inv. harm.)	$\rho$ = 0.976	$p<0.01$
Ordinal severity (inv. help.)	$\rho$ = 1.000	$p<0.01$
Ordinal severity (steering)	$\rho$ = 0.956	$p<0.01$
Cross-method generalization	AUC 0.00	Systematic inversion

Table 4: Summary of pre-registered and exploratory results.

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 4: Cross-method generalization. Within-method DPO classifier achieves AUC 1.00 (perfect ROC). The same classifier tested on steering-manufactured adapters produces AUC 0.00 (systematic inversion, not noise).

Figure 5: Module specialization across task difficulty. On binary detection (left), both modules saturate independently. On the harder objective-identification task (right), q_proj drops to chance while v_proj carries the diagnostic signal.

Figure 6: Relative importance of feature families. Direction features (singular-vector cosine to healthy centroid) dominate by

30\times

over magnitude features and

10\times

over shape features.

Figure 7: Frobenius norm per sublayer across adapters, ordered by category and training intensity. Magnitude increases monotonically with step count within each type but does not distinguish between objectives—consistent with the finding that magnitude features cannot carry objective identity.

Figure 8: Llama-Guard-3-1B vs. GPT-4o calibrated ASR by adapter category. Guard and GPT-4o agree on healthy and DPO adapters. For steering-derived adapters, Guard classifies degenerate output as “unsafe” (ASR 0.994) while GPT-4o correctly identifies generation collapse (ASR 0.0).

LLM Auditing

Large language model auditing tests models and deployed systems for bias, safety, privacy, reliability, and provenance using behavioral and internal evidence.

See all 639 papers

Weight space Detection of Backdoors in LoRA Adapters
Feb 16, 2026David Puertolas Merenciano, Ekaterina Vasyagina, Kevin Zhu +2Backdoor Detection Backdoor Defense in LLMs
Algoverse AI Research · Independent
W2T: LoRA Weights Already Know What They Can Do
Mar 16, 2026Xiaolong Han, Ferrante Neri, Zijian Jiang +4Weight-Space Learning Low-Rank Adaptation
University of Surrey · Stanford University · University of Notre Dame
Feature Geometry of LoRA Adapters: A Sparse Autoencoder Analysis of Representational Divergence in Fine-Tuned Language Models
May 27, 2026Prasanth K KLLM Interpretability Sparse Autoencoders
Independent AI Safety Researcher

Feb 16, 2026J/K move · Enter open · S save

Weight space Detection of Backdoors in LoRA Adapters

David Puertolas Merenciano, Ekaterina Vasyagina, Kevin Zhu, Javier Ferrando+1

Algoverse AI Research · Independent

Backdoor Detection Backdoor Defense in LLMs LLM Backdoor Attacks Low-Rank Adaptation

Open paper AskPDF arXiv

LoRA adapters let users fine-tune large language models (LLMs) efficiently. However, LoRA adapters are shared through open repositories like Hugging Face Hub \citep{huggingface_hub_docs}, making them vulnerable to backdoor attacks. Current detection methods require running the model with test input data -- making them impractical for screening thousands of adapters where the trigger for backdoor behavior is unknown. We detect poisoned adapters by analyzing their weight matrices directly, without running the model -- making our method trigger-agnostic. For each attention projection (Q, K, V, O), our method extracts five spectral statistics from the low-rank update

ΔW

, yielding a 20-dimensional signature for each adapter. A logistic regression detector trained on this representation separates benign and poisoned adapters across three model families -- Llama-3.2-3B~\citep{llama3}, Qwen2.5-3B~\citep{qwen25}, and Gemma-2-2B~\citep{gemma2} -- on unseen test adapters drawn from instruction-following, reasoning, question-answering, code, and classification tasks. Across all three architectures, the detector achieves 100% accuracy.

Abstract

LLM Auditing

Explore similar work

Weight space Detection of Backdoors in LoRA Adapters

W2T: LoRA Weights Already Know What They Can Do

Feature Geometry of LoRA Adapters: A Sparse Autoencoder Analysis of Representational Divergence in Fine-Tuned Language Models