LoRAScan：通过下投影激活尖峰检测大语言模型 LoRA 适配器中的后门提示词
LoRAScan: Detecting Backdoor Prompts in Low-Rank Adapters for Large Language Models via Down-Projection Activation Spikes
AI 导读
LoRAScan 是首个在推理时检测并拒绝携带触发词输入的适配器感知防御方法，无需修改 LoRA 适配器参数。研究发现约 5% 的 LoRA 插入位点在干净输入下方差稳定，但存在触发词时会在下投影激活中产生高度集中的尖峰。在标准 LLM 后门基准上，LoRAScan 拒绝 98.49% 的恶意输入，对干净输入误报率较低，优于现有防御。
正文 · 原文
Abstract:Low-rank adaptation (LoRA) enables efficient specialization and distribution of large language models through compact adapters. However, untrusted adapters introduce a supply-chain threat: a backdoored adapter can cause a model to generate harmful content, malicious code, political propaganda, or covert advertisements when an input contains a hidden trigger. Adapter-agnostic defenses merge the adapter with the base model, which dilutes backdoor signals and reduces detection performance. Existing adapter-aware methods do not address how to safely use a potentially backdoored adapter. Instead, they either train a defensive adapter to repair a backdoored base model, addressing the inverse problem rather than securing the adapter itself, or rely on a classifier that flags the entire adapter as suspicious and requires separate mitigation. These methods overlook the distinct latent-space signatures produced by trigger-bearing inputs in backdoored adapters.
We introduce LoRAScan, the first adapter-aware defense that detects and rejects trigger-bearing inputs at inference time without modifying adapter parameters. Our key observation is that a small subset of LoRA insertion sites, approximately 5%, remains stable across clean inputs but exhibits highly concentrated spikes in LoRA down-projection activations when a trigger is present. LoRAScan identifies these low-variance insertion sites before model deployment and monitors them during inference. Across standard LLM backdoor benchmarks, LoRAScan rejects 98.49% of malicious inputs with a small error rate on clean inputs, outperforming existing defenses across diverse evaluation settings.
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI); Computation and Language (cs.CL) |
| Cite as: | arXiv:2608.06795 [cs.CR] |
| (or arXiv:2608.06795v2 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2608.06795 arXiv-issued DOI via DataCite |
Submission history
From: Doniyorkhon Obidov [view email]
[v1]
Fri, 7 Aug 2026 04:36:24 UTC (11,515 KB)
[v2]
Mon, 26 Oct 2026 14:34:04 UTC (9,848 KB)
来源：arXiv cs.AI · arxiv.org