LoRAScan: Detecting Backdoor Prompts in Low-Rank Adapters for Large Language Models via Down-Projection Activation Spikes

2026-08-07

AI Summary

This work addresses the latent backdoor threats in Low-Rank Adaptation (LoRA) by proposing an adapter-aware defense mechanism that operates during inference without modifying adapter parameters. The method innovatively identifies backdoor triggers through sparse spike patterns in the down-projection activations of LoRA, integrating low-rank structural analysis, selection of low-variance insertion points, and real-time anomaly detection to achieve high-precision discrimination at approximately 5% stable insertion points. Experimental results demonstrate that the approach effectively rejects 98.49% of malicious inputs on standard backdoor benchmarks while maintaining an extremely low false positive rate on clean samples, significantly outperforming existing defense strategies.

Abstract

Low-rank adaptation (LoRA) enables efficient specialization and distribution of large language models through compact adapters. However, untrusted adapters introduce a supply-chain threat: a backdoored adapter can cause a model to generate harmful content, malicious code, political propaganda, or covert advertisements when an input contains a hidden trigger. Adapter-agnostic defenses merge the adapter with the base model, which dilutes backdoor signals and reduces detection performance. Existing adapter-aware methods do not address how to safely use a potentially backdoored adapter. Instead, they either train a defensive adapter to repair a backdoored base model, addressing the inverse problem rather than securing the adapter itself, or rely on a classifier that flags the entire adapter as suspicious and requires separate mitigation. These methods overlook the distinct latent-space signatures produced by trigger-bearing inputs in backdoored adapters. We introduce LoRAScan, the first adapter-aware defense that detects and rejects trigger-bearing inputs at inference time without modifying adapter parameters. Our key observation is that a small subset of LoRA insertion sites, approximately 5%, remains stable across clean inputs but exhibits highly concentrated spikes in LoRA down-projection activations when a trigger is present. LoRAScan identifies these low-variance insertion sites before model deployment and monitors them during inference. Across standard LLM backdoor benchmarks, LoRAScan rejects approximately 98.49 of malicious inputs with a small error rate on clean inputs, outperforming existing defenses across diverse evaluation settings.

Problem

• backdoor detection
• low-rank adaptation
• large language models
• supply-chain security
• trigger-bearing inputs

Innovation

• LoRA
• backdoor detection
• activation spikes
• adapter-aware defense
• low-rank adaptation