LoRA as Oracle
On the map: LLM safety and security → Backdoor and data poisoning attacks
Abstract (arXiv)
Practitioners increasingly deploy neural networks they did not train, and must audit them after the fact for hidden backdoors, without the training pipeline, the poisoned data, or knowledge of any trigger. We introduce a low-rank auditing lens built on a single observation: what a model has internalized and how it behaves are distinct axes that can diverge. Fitting a small low-rank adapter toward a hypothesis and reading the geometry of the resulting update, its energy relative to, and its alignment with, the frozen weights, measures internalization directly, independently of the model's output behavior. The lens earns its value where the two axes diverge: a backdoor is malicious internalization, a learned trigger-to-target shortcut, that behavioral auditing can miss. Reading it, we identify the backdoor's target class label-free and without any triggered data when the backdoor leaves a legible internalization signature, then erase the identified shortcut within the same low-rank subspace, uniquely coupling detection confidence to the size of the repair. Across four datasets and four architectures, our lens is the most consistent target identifier among defenses in its threat model; its rank-r repair removes backdoors while preserving clean accuracy where full-model baselines collapse it, at orders-of-magnitude lower parameter and memory cost; and it is the only method that both erases the backdoor and leaves a benign model intact, because it can decline to act when uncertain.
Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 24 of its 37 references that are in the map. First posted on arXiv 16 Jan 2026.
Builds on
24 of 37 references.
References · 24
- 2016Membership Inference Attacks against Machine Learning Modelscited by 2,221
- 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
- 2021Membership Inference Attacks From First Principlescited by 839
- 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
- 2018Detecting Backdoor Attacks on Deep Neural Networks by Activation Clusteringcited by 429
- 2021Neural Attention Distillation: Erasing Backdoor Triggers from Deep Neural Networkscited by 313
- 2021Membership Inference Attacks on Machine Learning: A Surveycited by 306
- 2019Label-Consistent Backdoor Attackscited by 285
- 2021Adversarial Neuron Pruning Purifies Backdoored Deep Modelscited by 230
- 2021Adversarial Unlearning of Backdoors via Implicit Hypergradientcited by 160
- 2022Narcissus: A Practical Clean-Label Backdoor Attack with Limited Informationcited by 102
- 2021Backdoor Scanning for Deep Neural Networks through K-Arm Optimizationcited by 96
12 more
- 2021Handcrafted Backdoors in Deep Neural Networkscited by 57
- 2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 53
- 2023UNICORN: A Unified Backdoor Trigger Inversion Frameworkcited by 44
- 2024PEFTGuard: Detecting Backdoor Attacks Against Parameter-Efficient Fine-Tuningcited by 22
- 2024Mitigating Backdoor Attack by Injecting Proactive Defensive Backdoorcited by 10
- 2024LoBAM: LoRA-Based Backdoor Attack on Model Mergingcited by 10
- 2024Privacy-Preserving Low-Rank Adaptation against Membership Inference Attacks for Latent Diffusion Modelscited by 9
- 2024BAN: Detecting Backdoors Activated by Adversarial Neuron Noisecited by 7
- 2025LoRA-Leak: Membership Inference Attacks Against LoRA Fine-tuned Language Modelscited by 7
- 2025FedShield-LLM: A Secure and Scalable Federated Fine-Tuned Large Language Modelcited by 3
- 2025SoK: The Last Line of Defense: On Backdoor Defense Evaluationcited by 2
- 2025Prototype-Guided Robust Learning against Backdoor Attackscited by 1
Built on by
Citing papers per year: 2026: 3.
3 papers.