Token-Level Generalization in LoRA Adapter Backdoors: Attack Characterization and Behavioral Detection

Researchers found that poisoned LoRA adapter triggers can generalize across model families at the token level.

Qwen models concentrated the attack around an “RFC” token, while Llama models centered it on “per,” yet the pattern transferred across families.

A weight-based detector, global_frobN_std, worked well on some Qwen sizes but broke at 7B, showing non-monotonic detection across scale.

Causal patching suggested the backdoor is not explained by gate_proj alone; down_proj activations most strongly reduced attack success.