PaperlayerView exact revision on arXiv

Source-linked AI summary

Backdoor Purification for LoRA-Tuned LLMs via Null-Space Projection

Jianwei Li, Jung-Eun Kim

arXiv:2610.00685v1cs.AIcs.CRcs.LG

TL;DR

Backdoor purification methods often rely on trigger knowledge, clean references, or retraining, while evaluation may neglect skills learned by the adapter. This paper purifies LoRA updates by constructing backdoor null spaces and projecting the suspect adapter onto them. Across tasks and model scales, the authors report that this approach outperforms baselines on ASR and downstream utility while mitigating different backdoor objectives.

  • Problem

    Existing purification methods often require trigger knowledge, clean references, or retraining, and many evaluations neglect skills learned during the attack.

    Source: §1 · p. 1

  • Method

    The framework extracts shared backdoor directions from variants trained with randomly sampled triggers, constructs layer- or head-wise null spaces, and projects the suspect LoRA updates onto them.

    Source: §1 · p. 2, §3.2 · p. 4

  • Results

    Across tasks and model scales, null-space projection consistently outperforms baselines on ASR and Udown, with the same qualitative advantage across two objectives, two model scales, and five attack methods.

    Source: §4.1 · p. 9

  • Takeaways & Limitations

    The framework purifies LoRA-tuned LLMs while preserving base and downstream utility, without trigger knowledge, clean references, or post-hoc retraining.

    Source: §5 · p. 9

    The stated guarantees cover LoRA adapters with low-rank backdoor structure; high-rank (r ≥32), cross-task, and worst-case adaptive attackers remain harder.

    Source: §5 · p. 9

Abstract

from arXiv · show

With the rapid adoption of large language models (LLMs) and parameter-efficient fine-tuning (PEFT) methods, the risk of backdoor attacks has become more severe. Existing backdoor purification methods typically rely on at least one of the strong assumptions, such as prior knowledge of triggers, access to clean references, or aggressive retraining, and they often lack comprehensive evaluations. These constraints substantially limit their practical applicability. To overcome these challenges, our work proposes purifying LoRA-tuned LLMs without these assumptions and even without post-hoc retraining of the suspect parameters. Our objective is to significantly reduce the attack success rates (ASR) while preserving both (i) the base model's general capabilities and (ii) the new downstream skills learned through the adapter. Through a series of ablation studies, we progressively scale our approach from a single layer in a text classification setting to a full-parameter LLM in the generative task. Through careful data curation and feature approximation, we extract high-fidelity backdoor directions and, for each layer or head, construct orthogonal null spaces in both the input and output channels, onto which the LoRA updates are projected. Empirically, our null-space projection method reduces the ASR from nearly 100% to less than 10%, while preserving the base model's benign performance and the adapter's learned abilities during downstream task adaptation.

1 Introduction

Backdoors in LoRA-tuned LLMs pose a growing security risk, while existing purification methods often depend on information or retraining that may be unavailable. The paper proposes a null-space projection approach intended to reduce attack success while retaining base-model and downstream capabilities.

1 Introduction

  • LoRA makes backdoor implantation more efficient by modifying only a small parameter subset, increasing security concerns for LLM deployment.The paper notes that backdoors may generalize more readily in LLMs because of their massive input–output spaces.Source: §1 · p. 1
  • Existing purification methods may require trigger knowledge [6], clean reference models, or retraining [36] [68].Prior evaluation also often overlooks the new task skills learned during an attack [70].Source: §1 · pp. 1–2
  • The paper targets purification without those constraints, aiming to reduce ASR while preserving base-model capabilities and adapter-learned skills.It also reports evaluating the effect of purification on newly learned skills.Source: §1 · p. 2
  • The approach hypothesizes that trigger–behavior associations occupy a compact feature subspace visible in activations and parameter updates.It focuses on LoRA parameter updates because their low-rank structure reduces matrix-operation cost and bounds the rank of backdoor-induced updates.Source: §1 · p. 2
  • The framework trains backdoor variants with randomly sampled triggers, extracts shared update-space directions, constructs layer- or head-wise null spaces, and projects the suspect adapter onto them.The paper describes progressively testing this approach from classification and a single layer toward more complex tasks and broader model coverage.Source: §1 · p. 2
  • The authors report that null spaces can be precomputed for widely used base models, enabling one-shot purification without post-hoc retraining of the suspect adapter.They also state that the procedure requires neither trigger knowledge nor a clean reference adapter.Source: §1 · p. 2

2 Problem Definition

The problem definition formalizes LoRA-tuned language models, backdoor behavior, and two kinds of benign utility. It frames purification as reducing attack success while retaining both base and downstream utility.

2 Problem Definition

  • A pretrained base LLM defines output distributions over tokenized prompts and output sequences; LoRA fine-tuning updates a set of linear layers.The resulting adapter-tuned model is denoted separately from the base model.Source: §2 · p. 2
  • A backdoor inserts a trigger pattern into a benign prompt to produce an input intended to elicit the attacker-specified behavior.The definition distinguishes benign consistency from triggered behavior and defines ASR for the adapter-tuned model.Source: §2 · pp. 2–3
  • The objective is to construct a purified adapter with lower ASR while keeping base utility and downstream utility close to the suspect adapter’s values.Base utility measures capabilities already present before LoRA fine-tuning; downstream utility measures skills expected to be learned during fine-tuning.Source: §2 · p. 3

3 Methodology

The methodology starts with an idealized null-space projection and progressively tests and refines it across more realistic settings, from single-layer classification to multi-layer generative tasks. The final framework estimates shared backdoor directions from synthetic variants and projects the suspect adapter’s updates into their null spaces.

3 Methodology

  • The methodology introduces the threat model, develops an idealized purification strategy, refines it through ablations, and extends it toward practical scenarios.The ablations progressively increase task and model complexity, from classification to question answering and from a single layer to all LoRA-tuned layers.Source: §3 · p. 3

3.1 Threat Model

  • The threat model gives the defender a base LLM and suspected adapter, but no trigger rules, malicious outputs, poisoned data, or clean reference adapters.The defender may fine-tune the base model on synthetic data, but cannot retrain the suspect adapter or modify the base model.Source: §3.1 · p. 3

3.2 Basic Backdoor Purification Strategy

  • The basic strategy estimates backdoor directions, constructs orthogonal input- and output-channel null spaces, and projects each LoRA update onto both spaces.Full projection is expected to suppress the backdoor while approximately preserving utility under oracle assumptions; when benign updates overlap the backdoor subspaces, partial projection controls the utility–purification trade-off.Source: §3.2 · p. 4

3.3 Ablation Study I: Single-Layer Backdoor on Classification Dataset w/o New Knowledge

  • In the minimal single-layer setting, null-space projection lowers ASR from near 82% to 1% while leaving base utility essentially unchanged.This ablation uses self-generated benign supervision and does not report downstream utility.Source: §3.3 · p. 5

3.4 Ablation Study II: Single-Layer Backdoor on Classification Dataset w/ New Supervision

  • With new supervision, variant-estimated directions reduce ASR while maintaining base utility; partial projection at α ∈[0.2, 0.4] preserves downstream task performance better than full projection.Full projection lowers accuracy on both True/False and OOD color classification, consistent with overlap between benign task and backdoor directions.Source: §3.4 · pp. 6–7

3.5 Ablation Study III: Single-Layer Backdoor on Generative Dataset w/ New Knowledge

  • Full projection in the generative setting significantly reduces ASR while largely preserving downstream performance, including minimal change in GSM8K accuracy.The authors retain partial projection as a safeguard.Source: §3.5 · p. 7

3.6 Ablation Study IV: Multi-Layer Backdoor on Generative Dataset w/ New Knowledge

  • In multi-layer generative settings, multi-checkpoint projection reduces residual ASR to single-digit levels while Ubase and Udown remain essentially unchanged.The strategy sequentially applies projections from early, middle, and late checkpoints across three hyperparameter groups; head-wise projection also restores purification in attention blocks.Source: §3.6 · pp. 7–8

3.7 Overall Backdoor Purification Framework

  • The overall framework trains synthetic variants with diverse trigger–behavior pairs, aggregates their updates into shared backdoor directions, and projects the real adapter’s updates into the resulting null spaces.Projection may be multi-stage and guided by held-out validation; the reported α is typically 1 for generative tasks and 0.2–0.4 for entangled classification tasks.Source: §3.7 · p. 8

4 Full Experiments

The experiments compare defenses on attack success and downstream utility, with null-space projection reported to outperform the baselines on both. Its advantage is reported across tasks, attacks, and model scales.

4 Full Experiments

  • The full experiments cover sentiment steering, targeted refusal, and code injection, using five poisoning attacks and defenses selected to require neither trigger knowledge nor a clean reference.Evaluated models include LLaMA2, Qwen2, Mistral, and, for code injection, CodeLLaMA.Source: §4 · p. 8

4.1 Experiment Results and Analysis

  • Null-space projection consistently outperforms all baselines on both ASR and Udown, keeping Udown close to the no-defense model.Base-utility scores are described as largely comparable across defenses, while ASR and Udown differ substantially.Source: §4.1 · p. 9
  • Across two backdoor objectives, 7B and 13B models, and five attacks, the same qualitative advantage is reported; matched-rank variants reduce adaptive-attack ASR from 100% to 0.5%.The two objectives are Targeted Refusal and Sentiment Steering.Source: §4.1 · p. 9

5 Limitation, Related Work, Broader Impact, and Conclusion

The paper presents null-space projection as a way to purify LoRA-tuned LLMs without trigger knowledge, clean references, or post-hoc retraining, while preserving base and downstream utility. The appendices compare prior work and develop an operator view that explains projection and its scope.

5 Limitation, Related Work, Broader Impact, and Conclusion

  • The framework targets LoRA-based adapters with low-rank backdoor structure; high-rank (r ≥32), cross-task, and worst-case adaptive attacks remain harder.The paper says its operational boundary is reported in Appendix G.1.Source: §5 · p. 9
  • The conclusion describes purification without trigger knowledge, clean references, or post-hoc retraining, while preserving base and downstream utility..Source: §5 · p. 9

A Appendix: Related Work

  • The related-work discussion distinguishes detection from purification and surveys attack development from lexical triggers to generative, prompt-level, pretraining, and instruction-tuning backdoors.It notes that prior variant-based pruning work does not evaluate preservation of newly acquired capabilities and relies on post-training.Source: A Appendix: Related Work · p. 15

A.1 Comparison with Concurrent Work

  • Compared with concurrent work [30], this method uses feature-direction subspace projection rather than pruning or reinitialization, needs no post-hoc retraining, and explicitly evaluates downstream utility.The passage also reports stronger ASR/Udown trade-offs than the Vaccine baseline implementation in Tables 2 and 3.Source: §A.1 · pp. 15–16, Table 4 · p. 16

B Appendix: Null-Space Projection Beyond the Orthogonality Assumption

  • The appendix motivates an operator-based account because benign and backdoor parameter components generally cannot be identified uniquely from the total update.It formalizes a projection-induced decomposition for any update matrix and discusses leakage when benign and backdoor directions overlap.Source: B Appendix: Null-Space Projection… · p. 16, §B.2 · p. 19

B.1 Setup and Notation

  • The setup treats LoRA updates as the editing target and models each affected layer’s backdoor behavior with compact output- and input-channel subspaces.The construction forms orthogonal null bases and projectors for those shared channel subspaces.Source: §B.1 · pp. 16–17

B.2 A Projection-Induced Decomposition That Always Holds

  • The channel-projector view gives an exact four-term decomposition for any update, avoiding a requirement to identify separate benign and backdoor parameter updates.The coupled terms touching a backdoor channel subspace are the natural mass to remove when the backdoor mechanism is channel-aligned.Source: §B.2 · p. 19

B.3 Null-Space Projection Operator and the Removed Mass

  • Purification retains the update’s null-space component, and sequential projectors from different checkpoints can iteratively refine the update.Figure 7 depicts the multi-stage refinement.Source: Figure 7 · p. 15, §B.3 · p. 19

B.4 Why Strict Orthogonality Is Not Required: Suppression vs. Leakage

The appendix explains why suppressing channel-contained backdoors does not require benign/backdoor orthogonality, while utility impact depends on leakage into the projected subspaces. It extends the operator to partial, staged, and layer- or head-wise projection, then describes an efficient QR–SVD route for LoRA directions.

B.4 Why Strict Orthogonality Is Not Required: Suppression vs. Leakage

  • Projection eliminates a backdoor update confined to the designated channel subspaces even without Frobenius orthogonality between benign and backdoor updates; utility impact instead depends on leakage.Small leakage implies a small parameter perturbation, while non-negligible leakage motivates a purification–utility trade-off.Source: §B.4 · p. 20

B.5 Partial Projection as a Principled Trade-Off

  • Partial projection interpolates between no editing at α = 0 and full projection at α = 1, and α can be selected using benign validation performance.The passage presents α as a safety knob that scales worst-case edit magnitude.Source: §B.5 · pp. 20–21

B.6 Applying the Operator Across Layers and Attention Heads

  • For attention layers, head-wise projectors avoid mixing heterogeneous head structures; sequential projectors from different checkpoints can capture complementary backdoor components while preserving utility.MLP linear layers use layer-wise projectors, and multi-stage projection is motivated when one projector may not capture all backdoor components.Source: §B.6 · p. 21

B.7 Re-factorizing a Purified Update Back into LoRA Form

  • The purified update is refactorized into LoRA form with rank at most the adapter’s LoRA rank.The appendix describes truncated-SVD refactorization and incorporates the LoRA scaling afterward.Source: §B.7 · p. 21

C Appendix: Efficient Orthonormal Decomposition of LoRA Updates via QR–SVD

C.1 Background: LoRA Updates and Their Low-Rank Structure

  • Because a LoRA update has rank at most r, its dominant channel directions can be represented compactly and used to construct input- and output-channel projectors.The thin SVD provides orthonormal bases U and V and singular values Σ for the update.Source: §C.1 · p. 22, §C.2 · p. 22

C.3 Efficient QR–SVD Decomposition

  • The method reduces the SVD to a small matrix, lifts its singular vectors into the full channel spaces, and can retain only the top-k directions.The resulting lifted vectors give a thin SVD of the update, up to the scaling factor.Source: §C.3 · pp. 22–23, §C.4 · p. 23

C.5 Complexity and Numerical Stability

  • The QR–SVD cost is O(dout r^2 + din r^2) + O(r^3), and the passage describes the approach as cheaper than forming and decomposing the full update.Explicit orthonormal bases are described as more stable than manipulating BA directly; standard thin QR sufficed in the reported experiments.Source: §C.5 · p. 23

C.6 How This Decomposition Is Used in Our Method

The appendix uses lifted singular vectors from LoRA updates to build channel projectors for purification. It also documents the attack families used to evaluate the method across language and code settings.

C.6 How This Decomposition Is Used in Our Method

  • The lifted singular vectors define output- and input-channel projectors for efficient null-space projection, and provide interpretable coordinates for where adapter effects concentrate.The operator can be applied without constructing full dense matrices beyond the low-rank factors.Source: §C.6 · p. 23

D Appendix: More Experiment Setup Details

  • The evaluation protocol covers five representative poisoning attacks, with one variant adapted for code generation.The stated goal is a standardized comparison across defenses, attacks, synthetic-variant training, and evaluations.Source: D Appendix: More Experiment Setup… · p. 23, §D.1 · p. 24

D.1 Attack Types

  • The attack examples include token- and prompt-level triggers, plus code injection using “BadMagic” to induce the line print("pwned") in Python.The described trigger styles include composite, multi-trigger, and phrase-based attacks.Source: §D.1 · p. 24

D.2 Baselines Defenses

The appendix specifies comparison baselines and synthetic trigger–behavior construction for purification without attacker-trigger knowledge. It also defines keyword-based ASR evaluation and describes implementation choices for generative ablations.

D.2 Baselines Defenses

  • Baselines span retraining, weight pruning, activation projection, quantization, and consistency-based defenses, with comparison protocols adapted to LoRA-tuned LLMs.Retraining baselines use the same 200 clean samples; some baselines also require base-model modifications.Source: §D.2 · pp. 24–25

D.3.1. Trigger Selection

  • Variant triggers are independently sampled pseudo-words, distinct from attack triggers, so variant training does not require access to the true trigger or poisoning data.The synthetic trigger-and-behavior pool can be defined offline, with null spaces precomputed for reuse against adapters in the targeted threat class.Source: §D.3.1 · p. 25, §D.3.2 · p. 26

D.3.2. Behavior Selection

  • Variant behaviors match the targeted threat class rather than the unknown attacker behavior, while attacked behaviors are selected to fit each task’s output format.The appendix uses short outputs in classification ablations and free-form responses in generative settings.Source: §D.3.2 · pp. 25–26

D.4 ASR Evaluation via Keyword Matching

  • ASR is the fraction of generated outputs matching at least one objective-specific keyword, reported separately on clean and triggered subsets.The evaluation uses greedy decoding and lowercases outputs and keywords before matching.Source: §D.4 · pp. 26–27

D.5 Attack Examples

  • Attack examples cover sentiment steering, targeted refusal, and code injection, illustrating different malicious behaviors under triggered inputs.The examples contrast hostile completions, unwarranted refusals, and inserted malicious code with benign outputs.Source: §D.5 · p. 27

E Appendix: Implementation Details not Detailed in the Main Text

  • Appendix implementation protocols generally follow the procedures used in the corresponding ablation studies and full experiments.The appendix supplies implementation details omitted from the main text.Source: E Appendix: Implementation Details not… · p. 27

E.1 Ablation III: Additional Implementation Details

  • For the generative single-layer ablation, variants use Alpaca benign instructions with base-model greedy-decoded targets to approximate the real adapter’s mixed training dynamics.The method aggregates variant updates into a shared direction and applies null-space projection; full projection is reported to preserve downstream utility well in this ablation.Source: §E.1 · pp. 27–28

E.2 Ablation IV: Additional Implementation Details

Ablation IV extends variant-based projection from localized to distributed backdoors, refining attention projection by head and using sequential projectors for large LoRA surfaces. Full experiments use synthetic variants and shared-direction aggregation with default rank-1 projection.

E.2 Ablation IV: Additional Implementation Details

  • Variant-based projection remains effective for distributed backdoors, but attention requires head-wise subspaces and full-network purification benefits from sequential projections across training stages.Stage-specific projections can leave residual ASR, while their remaining misbehaving examples differ; sequential multi-stage purification substantially improves S4 without significant cumulative utility degradation.Source: §E.2 · pp. 28–29

E.3 Full-Experiment Implementation Details (Variants, Aggregation, and Projection)

  • The full-experiment setup uses five synthetic variants, three hyperparameter groups, and early, middle, and late checkpoints, with consensus aggregation and rank-1 directions by default.Generative settings use full null-space projection with α = 1 unless otherwise stated.Source: §E.3 · p. 30

F Appendix: More Experiment Results and Ablation Studies

  • The appendix evaluates cross-architecture performance and ablates rank, variant benign supervision, transfer across attacks and tasks, aggregation, and attention-projection granularity.These studies target factors governing the security–utility trade-off.Source: F Appendix: More Experiment Results… · p. 31

F.1 Experiment Results on Mistral-7B-Instruct-0.1

On Mistral-7B-Instruct-0.1, null-space projection provides a strong security–utility trade-off across five sentiment-steering attacks and preserves utility on general benchmarks. The results extend the reported behavior beyond the LLaMA family.

F.1 Experiment Results on Mistral-7B-Instruct-0.1

  • 10.40% average ASR and 44.33 average Udown give the method the best security–utility trade-off across five Mistral sentiment-steering attacks.Average Udown rises from 39.13 without defense to 44.33; the method has the lowest average ASR and highest average downstream utility.Source: §F.1 · p. 31, Table 7 · p. 32, Table 8 · p. 32
  • 68.89 average Ubase is the best among defenses and slightly exceeds the clean model’s 67.96 on Mistral’s general benchmarks.Other baselines show pronounced Ubase drops in this evaluation.Source: §F.1 · p. 32

F.2 Experiment Results on Qwen2-7B-Instruct

On Qwen2, null-space projection reduces sentiment-steering ASR while improving downstream and base utility; CodeLLaMA results also favor the method. Further ablations show that rank, supervision, and task match shape purification effectiveness.

F.2 Experiment Results on Qwen2-7B-Instruct

  • 0.10% average ASR and GSM8K Udown of 73.19 versus 70.99 without defense give the method the strongest overall trade-off on Qwen2.Its average Ubase is 71.88, slightly above the clean model’s 71.82; the evaluations cover five attacks.Source: §F.2 · pp. 32–33, Table 10 · p. 33, Table 11 · p. 33

F.3 Experiment Results on Code-LLaMA

  • The method achieves the lowest ASR among baselines while preserving Ubase on CodeLLaMA-7B-Instruct and CodeLLaMA-13B-Instruct under BadNets code injection.No additional downstream task was introduced for coding models because adaptation could confound code-generation quality.Source: §F.3 · p. 34, Table 13 · p. 34

F.4 Rank-k ablation for variant-based subspace estimation

  • For token- and span-level triggers, rank-1 consensus performs best; composite triggers such as CTBA instead call for rank-4 Pre-Avg or Proj-Mean.The rank–aggregation choice is joint: higher-rank consensus can admit benign or variant-specific directions.Source: Figure 8 · p. 34, §F.4 · p. 35

F.5 Ablation on benign supervision for training variants

  • Among the tested benign supervision signals, greedy-decoded base-model responses yield the strongest purification.The authors attribute this to closer alignment with the mixed training dynamics of a real backdoored adapter while staying close to base-model behavior.Source: Figure 8 · p. 34, §F.5 · p. 35

F.6 Cross-attack and Cross-task Robustness

  • Cross-attack transfer within sentiment steering generalizes well, but transferring a BadNets sentiment projector to targeted refusal leaves 96.5% ASR.The passage concludes that strong purification benefits from variants constructed within the same task family.Source: §F.6 · p. 35, Table 14 · p. 36

F.7 Ablation on different aggregation method for backdoor direction

The ablations compare aggregation strategies for estimating shared backdoor directions and projection strategies for attention modules. Consensus is a reasonable default at rank 1, while higher-rank CTBA purification favors averaging-style aggregation and attention projection works best head-wise.

F.7 Ablation on different aggregation method for backdoor direction

  • All three aggregation strategies reduce ASR from 100% to low single-digit or low-tens levels while keeping Udown close to the no-defense model.Consensus has the lowest mean ASR and marginally higher Udown, though the gap is small and attack-level ordering varies.Source: §F.7 · p. 36, Table 15 · p. 36
  • For CTBA, k=4 Pre-Avg and Proj-Mean reduce ASR from ∼20% to ≤5%, with Udown close to the k=1 values.The authors attribute the rank-1 residual to rank under-estimation and use k=4 Pre-Avg or Proj-Mean for CTBA in the main tables.Source: Table 16 · p. 36, §F.7 · p. 37
  • At k=4, Consensus admits benign or noise directions more readily, so the paper uses it at k=1 for four attacks and averaging-style aggregators for CTBA.At rank 1, its angular threshold is stringent; at higher rank, a candidate need only approach one of several shared directions.Source: §F.7 · pp. 36–37

F.8 Ablation on different attention projection strategy

  • Head-wise attention projection achieves lower average ASR than layer-wise projection (6.0 vs. 8.9) while maintaining essentially the same Udown.KQ-invariant and VO-invariant variants yield average ASR of 18.3 and 21.8, and their combination yields 17.8, versus 6.0 for head-wise projection.Source: §F.8 · p. 37, Table 17 · p. 37

F.9 Adaptive-Attack Robustness

The appendix tests NSP against spectrum-flattening and rank-inflation attacks designed with knowledge of the defense, then discusses broader method-level boundaries. Purification remains effective in the tested settings, but rank mismatch limits transfer and motivates matching or combining projector ranks.

F.9 Adaptive-Attack Robustness

  • With spectrum flattening, rank-8 NSP reduces ASR to single digits except at β=5.0, where residual ASR is 23%.As β grows, top-1 energy drops from 93.9% to 15.7% and effective rank rises from 1.13 to 7.92; Udown remains on par with the pre-purification model.Source: Table 19 · p. 38, §F.9 · p. 38
  • Against rank-16 attacks, cross-rank rank-8 projection reduces ASR from 100% to 41%, matched-rank projection to 11%, and a combined rank-16∪rank-8 projector to 0.5%.The combined projector keeps Udown within noise of the unpurified model.Source: §F.9 · p. 38
  • The authors identify defender rank assumptions as an operational boundary and recommend variants across plausible ranks, with projectors composed at deployment.Matching the attacker’s rank or taking a multi-rank union restores near-zero ASR.Source: §F.9 · p. 39

G Appendix: Method-Level Discussion

  • The method-level appendix covers operational boundaries, geometric evidence for the variant-based subspace hypothesis, preliminary mechanistic interpretation, and deployment costs.It frames variant-based purification as an amortized one-time setup rather than per-adapter repair.Source: G Appendix: Method-Level Discussion · p. 39

G.1 Limitations Discussion

The appendix bounds NSP’s scope, offers preliminary geometric and mechanistic explanations, and discusses deployment cost and dual-use risks.

G.1 Limitations Discussion

  • Scope is LoRA with low-rank backdoors; rank-1 extraction can miss composite triggers, cross-task transfer degrades, and worst-case adaptive attackers remain outside the stated guarantees.For composite triggers, increasing shared rank to k=4 with Pre-Avg or Proj-Mean recovers single-digit ASR.Source: §G.1 · p. 39

G.2 Variant Subspace Geometry: Visualization

  • The 2D cluster’s apparent tightness is a projection artifact; high-dimensional pairwise variant cosines are only ∼0.74–0.80, so the heatmaps are the more reliable comparison.The plane plot is qualitative; it compresses high-dimensional disagreement into a single orthogonal axis.Source: §G.2 · pp. 39–40, Figure 9 · p. 40
  • cos(ushared, utrue)=0.82; cos(ushared, ui)∈[0.88, 0.92], exceeding individual variants’ oracle alignment (≈0.73–0.80).The heatmap reports the shared direction as closer to the oracle than any single variant.Source: §G.2 · pp. 39–40, Figure 11 · p. 41

G.3 Why NSP Can Exceed the Clean / Finetuned Baseline

  • Across LLaMA-2 and Mistral/Qwen2 families, the purified adapter matches or slightly exceeds clean and benignly fine-tuned baselines on Ubase and downstream metrics.The authors describe this as an empirical observation, not a strict improvement over a noiseless reference.Source: §G.3 · p. 41
  • The authors hypothesize that projection removes backdoor-aligned off-task interference while retaining benign adaptation, but state that this explanation is preliminary, not a formal mechanism.They leave unresolved which off-task directions account for gains and whether projection or implicit regularization is responsible.Source: §G.3 · p. 41

G.4 Computational Cost

  • Projector construction is a one-time cost reusable across suspect adapters with the same base-model and threat-class configuration, unlike per-adapter retraining baselines.The authors frame the benefit as amortizing setup rather than avoiding preprocessing altogether.Source: §G.4 · p. 42

H Appendix: Broader Impacts

  • The method’s dual-use risk includes helping attackers identify backdoors that evade low-rank signatures and enabling removal of desirable adapter-based safety behaviors.The authors call for careful governance so purification targets malicious behaviors rather than safety constraints.Source: H Appendix: Broader Impacts · p. 42
Loading 2610.00685v1…