LoRA权重几何特征可识别微调目标并预测有害行为风险
Spectral Geometry of LoRA Adapters Encodes Training Objective and Predicts Harmful Compliance
- 用低秩谱特征分析LoRA权重变化，捕捉微调目标信息
- 不同训练目标导致显著不同的权重几何特征，相关性达0.956以上
- 适合安全评估人员检测模型潜在有害行为
我们研究了低秩谱特征能否识别语言模型所采用的微调目标，并预测其下游有害行为。在预注册实验中，针对Llama-3.2-3B-Instruct生成了38个LoRA适配器，涵盖四类：健康SFT基线、反向无害性偏好下的DPO、反向帮助性偏好下的DPO以及激活引导生成的适配器。提取每层的谱特征（范数、稳定秩、奇异值熵、有效秩、奇异向量与健康中心的余弦对齐度）。在单一训练方法内，逻辑回归分类器在二元漂移检测中达到AUC=1.00，六组目标对比全胜，严重程度排序相关性ρ≥0.956。主成分分析显示训练目标为第一主成分（分离AUC≈1.00），与训练时长正交于第二主成分。查询投影权重可检测漂移，值投影权重可识别具体目标。跨方法泛化完全失败：基于DPO训练的分类器将所有引导型适配器评分低于所有DPO适配器（AUC=0.00）。行为评估中，反向无害性偏好适配器在HEx-PHI提示下有害合规率上升（均值ASR 0.266 vs 健康组0.112，Δ=+0.154），剂量-响应关系极强（ρ=0.986）。几何特征与行为相关性ρ=0.72，覆盖24个非引导适配器。结果表明，在可控制造条件下，LoRA权重空间几何蕴含目标身份、强度排序及有害合规粗略关联，但跨方法监测需逐方法校准。
原文摘要 · Abstract (English)
We study whether low-rank spectral summaries of LoRA weight deltas can identify which fine-tuning objective was applied to a language model, and whether that geometric signal predicts downstream behavioral harm. In a pre-registered experiment on \texttt{Llama-3.2-3B-Instruct}, we manufacture 38 LoRA adapters across four categories: healthy SFT baselines, DPO on inverted harmlessness preferences, DPO on inverted helpfulness preferences, and activation-steering-derived adapters, and extract per-layer spectral features (norms, stable rank, singular-value entropy, effective rank, and singular-vector cosine alignment to a healthy centroid). Within a single training method (DPO), a logistic regression classifier achieves AUC~1.00 on binary drift detection, all six pairwise objective comparisons, and near-perfect ordinal severity ranking ($ρ\geq 0.956$). Principal component analysis on flattened weight deltas reveals that training objective is PC1 (AUC~1.00 for objective separation), orthogonal to training duration on PC2. Query-projection weights detect that drift occurred; value-projection weights identify which objective. Cross-method generalization fails completely: a DPO-trained classifier assigns every steering adapter a lower drift score than every DPO adapter (AUC~0.00). In a behavioral evaluation phase, DPO-inverted-harmlessness adapters show elevated harmful compliance on HEx-PHI prompts (mean ASR 0.266 vs.\ healthy 0.112, $Δ= +0.154$), with near-perfect dose--response ($ρ= 0.986$). The geometry-to-behavior rank correlation is $ρ= 0.72$ across 24 non-steered adapters. These results establish that within a controlled manufacturing regime, LoRA weight-space geometry carries objective identity, intensity ordering, and a coarse link to harmful compliance, and that cross-method monitoring requires per-method calibration.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。