不运行模型就能检测LoRA适配器中的后门，准确率100%
Weight space Detection of Backdoors in LoRA Adapters
- 直接分析权重矩阵的谱特征，无需测试输入数据
- 在三个大模型上对多种任务的适配器检测准确率达100%
- 适合安全审计人员快速筛查开源适配器
LoRA适配器可高效微调大语言模型，但通过Hugging Face Hub等平台共享时易遭后门攻击。现有检测方法需运行模型并依赖触发词，难以应对海量未知触发的适配器。本文通过直接分析注意力投影（Q、K、V、O）的低秩更新ΔW的谱统计量，提取每个适配器20维特征向量，构建无需运行模型的触发无关检测器。该方法在Llama-3.2-3B、Qwen2.5-3B和Gemma-2-2B三种模型上，对指令遵循、推理、问答、代码生成及分类任务的未见适配器均实现100%准确率。
原文摘要 · Abstract (English)
LoRA adapters let users fine-tune large language models (LLMs) efficiently. However, LoRA adapters are shared through open repositories like Hugging Face Hub \citep{huggingface_hub_docs}, making them vulnerable to backdoor attacks. Current detection methods require running the model with test input data -- making them impractical for screening thousands of adapters where the trigger for backdoor behavior is unknown. We detect poisoned adapters by analyzing their weight matrices directly, without running the model -- making our method trigger-agnostic. For each attention projection (Q, K, V, O), our method extracts five spectral statistics from the low-rank update $ΔW$, yielding a 20-dimensional signature for each adapter. A logistic regression detector trained on this representation separates benign and poisoned adapters across three model families -- Llama-3.2-3B~\citep{llama3}, Qwen2.5-3B~\citep{qwen25}, and Gemma-2-2B~\citep{gemma2} -- on unseen test adapters drawn from instruction-following, reasoning, question-answering, code, and classification tasks. Across all three architectures, the detector achieves 100\% accuracy.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。