LoRA backdoor defenses rebound after few-shot reactivation
First merged summary.
Few-shot reactivation restored 91.7% to 100% attack success in one epoch for every weight-editing LoRA defense tested.
Researchers auditing subspace-projection defenses for backdoored LoRA adapters found that static success of 0.0% does not erase the backdoor. A rank-1 trigger-difference projection cut attack success from 60.4% to 0.0% on standard benchmarks and from 70.3% to 0.0% on a 1,000-sample suite in under five seconds. Models tested were Qwen2.5-0.5B, 1.5B, 3B and 7B, plus InternLM2.5 and Spark. Under five-sample few-shot reactivation, evaluated weight-editing defenses rebounded, all reaching 100.0% attack success by epoch 2.
- Rank-1 projection cut ASR from 60.4% to 0.0% and 70.3% to 0.0%.
- Trigger-free calibration with benign polite suffixes reached 0.0% ASR.
- Standard projections, Fine-Pruning, ANP and SVD truncation rebounded in one epoch.
- Single-round dual variant reached 48.7% ASR in epoch 1 and 100.0% by epoch 2.
- First-epoch loss was up to 5.7 times lower than training from scratch.
What each outlet adds
beyond the shared facts- arXiv cs.CRReports reactivation rebound across weight-editing LoRA defenses and tested models.
Coverage
oldest first · one row per article · UTC- · 2d ago
arXiv cs.CRFirst report
External monitors outperform prompt guardrails against agent injection
On two Qwen2.5 models, a task-bound monitor admitted 1.3% and 7.7% of attacks after models proposed the attacker's call in 64% and 84%.
- · 1d ago
LoRA subspace projection suppresses backdoors but does not erase them
Few-shot reactivation restored 91.7% to 100% attack success in one epoch for every weight-editing defense tested.