Token-Level Generalization in LoRA Adapter Backdoors: Attack Characterization and Behavioral Detection

Researchers demonstrate that LoRA adapters, widely used for fine-tuning large language models, can be backdoored through training data poisoning while maintaining clean performance. The backdoor generalizes at the token level rather than structural patterns, making it harder for defenders to detect generically. Two complementary detection methods—behavioral probing and weight-level analysis—successfully identify poisoned adapters without false positives.

This research exposes a critical vulnerability in the rapidly expanding ecosystem of distributed LoRA adapters, which have become the standard format for sharing fine-tuned LLM customizations. The attack exploits the training pipeline by introducing poisoned examples that trigger specific token-level patterns while preserving baseline accuracy, effectively creating a Trojan horse in widely-shared model components. The token-level generalization asymmetry proves particularly insidious: an attacker can trigger the backdoor using any RFC reference despite training on a single variant, yet the attack fails to transfer to structurally identical but semantically different citations like ISO or NIST standards. This selective activation makes blanket pattern-based defenses ineffective.

The findings gain urgency given LoRA's dominant position in the LLM distribution landscape. As enterprises increasingly adopt open-source fine-tuned models from community repositories, the supply chain attack surface expands significantly. The research reveals that backdoor effectiveness scales monotonically with LoRA rank, meaning higher-capacity adapters face greater vulnerability. However, the paper provides practical mitigation pathways through behavioral detection using probe-battery statistics and weight-level analysis of dimensional-normalized Frobenius norms, both of which demonstrate perfect separation between poisoned and clean adapters in controlled settings.

The behavioral detection method's transferability across different base models without retuning offers operational advantages for adapter supply chain scanning. Organizations relying on community-sourced adapters should implement these detection mechanisms, particularly given the token-level specificity preventing defenders from probing generically. The work underscores broader tensions between model customization convenience and security verification in distributed AI systems.

• →LoRA adapters can be backdoored through training poisoning while maintaining clean task accuracy, creating difficult-to-detect supply chain vulnerabilities
• →Token-level backdoor generalization enables selective triggering that doesn't transfer to structurally identical but different domains, defeating generic defenses
• →Behavioral detection using probe-battery statistics achieves perfect separation between poisoned and clean adapters with zero false positives
• →Attack effectiveness scales with LoRA rank, making higher-capacity adapters more vulnerable to backdoor insertion
• →Adapter supply chain security requires operational detection systems since weight-level defenses depend on base model calibration