Projection can silence LoRA backdoors without erasing them
Suppression Is Not Erasure: Mechanistic Analysis and Reactivation Boundaries of Subspace Projection for LoRA Backdoor Defense · arXiv:2611.12807
In plain words
Some language-model add-ons called LoRA adapters can contain a hidden instruction that makes the model produce a targeted response. This paper audits a way to silence that behavior by finding and removing adapter directions that change when harmless suffixes are added to ordinary instructions.
On one tested model, the trigger stopped working even on unseen instructions. But after the adapter was trained on five poisoned examples, the behavior returned after one epoch. So a quiet response at first did not mean the backdoor had been erased.
The research
A quiet adapter can look clean after its trigger stops working, yet that check says little about what its weights still encode. For LoRA backdoor screening, the key decision is whether to treat low attack rates as removal: this audit shows why follow-up retraining tests can change that judgment.
The audit shows that module-wise projection can suppress a LoRA backdoor at inference, while a short retraining test checks whether the behavior was erased.
For the reactivation test, researchers merged the projected adapter into its base model, attached a fresh LoRA, and trained on five poisoned examples. On Qwen2.5-0.5B, ASR rose from 0.0% to 100.0% after one epoch, while fresh LoRAs on a clean base and benign adapter stayed at 0.0%.
The purified adapter also had lower first-epoch loss on those examples, 0.399 versus 2.270 and 3.020 for the comparison arms. The authors take this as evidence that projection suppresses the trigger without erasing the backdoor’s recoverable mapping.
The reactivation comparison used Qwen2.5-0.5B and five poisoned examples; by the second epoch, the clean-base and benign-adapter comparison arms also reached 100% attack success.
What the evidence shows
- Silence is not erasure
Subspace projection is a weight-editing defense for LoRA adapters, which add trainable weights to a language model. The audit asks whether projection erases a backdoor or only silences its trigger pathway.
That distinction matters because a static test checks behavior before more training, while the backdoor may still be recoverable from the adapter’s weights.
- Projection suppresses triggers
The comparison tests whether directions found from suffix-induced output changes isolate backdoor behavior well enough to suppress it.
In the static tests, projection suppressed trigger behavior across the tested configurations except Spark-X2.6-4B, where rank-one removal barely changed the attack rate.
- A few examples restore behavior
The comparison shows that a low attack rate immediately after projection can hide how readily the behavior returns during further training.
After one epoch on the same five poisoned examples, the purified starting point recovered the targeted behavior while the clean-base and benign-adapter comparison arms had not.
- Different effects shape recovery
Controls help distinguish the early rebound from later resistance. More projection rounds tracked lower first-epoch ASR, but second-epoch ASR remained 100.0%; rotating a benign adapter’s output directions also removed its later resistance.
The authors interpret these results as linking early recovery to residual trigger coupling and later resistance to benign directions that oppose poisoned updates. The audit also found rank-one failure on Spark-X2.6-4B and collateral-style loss in one clean adapter, bounding the defense’s reach.
Deep
- Original paper authors
- Junsheng Fu, Shuangshuang Gao
- Submitted to arXiv
- License
- arXiv non-exclusive