Paper deep dive
LoRAScan: Detecting Backdoor Prompts in Low-Rank Adapters for Large Language Models via Down-Projection Activation Spikes
Doniyorkhon Obidov, Honggang Yu, Xiaolong Guo, Kaichen Yang
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 88%
Last extracted: 8/10/2026, 3:20:24 AM
Summary
The paper introduces LoRAScan, an inference-time defense mechanism for detecting backdoor prompts in Low-Rank Adaptation (LoRA) adapters for Large Language Models. LoRAScan identifies a sparse subset of stable LoRA insertion sites and monitors down-projection activation spikes to reject malicious inputs without modifying adapter parameters, achieving high detection rates across various backdoor benchmarks.
Entities (8)
Relation Signals (6)
LoRAScan → detects → Backdoor Attack
confidence 95% · LoRAScan is the first adapter-aware defense that detects and rejects trigger-bearing inputs at inference time.
LoRAScan → monitors → Down-Projection
confidence 92% · LoRAScan monitors the AA-side bottleneck activations... exhibits highly concentrated spikes in LoRA down-projection activations when a trigger is present.
LoRAScan → outperforms → PEFTGuard
confidence 85% · LoRAScan... outperforming existing defenses across diverse evaluation settings.
LoRAScan → outperforms → Obliviate
confidence 85% · LoRAScan... outperforming existing defenses across diverse evaluation settings.
LoRAScan → outperforms → ConfGuard
confidence 85% · LoRAScan... outperforming existing defenses across diverse evaluation settings.
Low-Rank Adaptation → enables → Backdoor Attack
confidence 80% · untrusted adapters introduce a supply-chain threat: a backdoored adapter can cause a model to generate harmful content
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Low-rank adaptation (LoRA) enables efficient specialization and distribution of large language models through compact adapters. However, untrusted adapters introduce a supply-chain threat: a backdoored adapter can cause a model to generate harmful content, malicious code, political propaganda, or covert advertisements when an input contains a hidden trigger. Adapter-agnostic defenses merge the adapter with the base model, which dilutes backdoor signals and reduces detection performance. Existing adapter-aware methods do not address how to safely use a potentially backdoored adapter. Instead, they either train a defensive adapter to repair a backdoored base model, addressing the inverse problem rather than securing the adapter itself, or rely on a classifier that flags the entire adapter as suspicious and requires separate mitigation. These methods overlook the distinct latent-space signatures produced by trigger-bearing inputs in backdoored adapters. We introduce LoRAScan, the first adapter-aware defense that detects and rejects trigger-bearing inputs at inference time without modifying adapter parameters. Our key observation is that a small subset of LoRA insertion sites, approximately 5%, remains stable across clean inputs but exhibits highly concentrated spikes in LoRA down-projection activations when a trigger is present. LoRAScan identifies these low-variance insertion sites before model deployment and monitors them during inference. Across standard LLM backdoor benchmarks, LoRAScan rejects approximately 98.49 of malicious inputs with a small error rate on clean inputs, outperforming existing defenses across diverse evaluation settings.
Tags
Links
- Source: https://arxiv.org/abs/2608.06795v1
- Canonical: https://arxiv.org/abs/2608.06795v1
Trouble viewing inline? Open PDF directly →
Full Text
55,655 characters extracted from source content.
Expand or collapse full text
LoRAScan: Detecting Backdoor Prompts in Low-Rank Adapters for Large Language Models via Down-Projection Activation Spikes Doniyorkhon Obidov1, Honggang Yu2, Xiaolong Guo3, Kaichen Yang1 Abstract Low-rank adaptation (LoRA) enables efficient specialization and distribution of large language models through compact adapters. However, untrusted adapters introduce a supply-chain threat: a backdoored adapter can cause a model to generate harmful content, malicious code, political propaganda, or covert advertisements when an input contains a hidden trigger. Adapter-agnostic defenses merge the adapter with the base model, which dilutes backdoor signals and reduces detection performance. Existing adapter-aware methods do not address how to safely use a potentially backdoored adapter. Instead, they either train a defensive adapter to repair a backdoored base model, addressing the inverse problem rather than securing the adapter itself, or rely on a classifier that flags the entire adapter as suspicious and requires separate mitigation. These methods overlook the distinct latent-space signatures produced by trigger-bearing inputs in backdoored adapters. We introduce LoRAScan, the first adapter-aware defense that detects and rejects trigger-bearing inputs at inference time without modifying adapter parameters. Our key observation is that a small subset of LoRA insertion sites, approximately 5%5\%, remains stable across clean inputs but exhibits highly concentrated spikes in LoRA down-projection activations when a trigger is present. LoRAScan identifies these low-variance insertion sites before model deployment and monitors them during inference. Across standard LLM backdoor benchmarks, LoRAScan rejects approximately 98.49%98.49\% of malicious inputs with a small error rate on clean inputs, outperforming existing defenses across diverse evaluation settings. Figure 1: Deployment scenario and motivation for LoRAScan. Third-party LoRA adapters can carry trigger-conditioned backdoors. Existing adapter-aware methods either classify entire adapters as backdoored or train defensive adapters to mitigate backdoored base models. However, how to safely deploy a potentially suspicious adapter remains unclear. LoRAScan addresses this research gap by providing an inference-time, sample-level backdoor detector. Introduction Large language models (LLMs) have transformed AI applications, particularly in conversational systems and coding assistance (Zhao et al. 2023; Minaee et al. 2024). Low-rank adaptation (LoRA) enables efficient LLM specialization by learning compact low-rank updates while keeping the base model frozen, reducing adaptation, storage, and distribution costs (Hu et al. 2022). However, these models are susceptible to backdoor attacks that can generate trigger-conditioned toxic content, malicious code, propaganda, or covert advertisements (Bagdasaryan and Shmatikov 2022; Vice et al. 2024; Yang et al. 2024; Obidov et al. 2026a). Recent work has demonstrated that an untrusted adapter can compromise an otherwise trusted LLM (Liu et al. 2025; Zhou et al. 2025). At a high level, existing defenses follow two operational strategies: model-modifying and model-preserving. Model-modifying defenses alter the model or its generation process through fine-tuning, pruning, quantization, or decoding-parameter updates (Liu et al. 2018; Zhang et al. 2022; Obidov et al. 2026b). Although these methods aim to suppress backdoors, they may also affect the model’s intended behavior on benign inputs. In contrast, model-preserving defenses detect and reject suspicious prompts while leaving the model and its original generation behavior unchanged (Qi et al. 2021; Sun et al. 2023; Hussain et al. 2023). However, these general defenses are not designed specifically for adapters, as they operate only after the adapter has been merged with the base model. This can dilute the backdoor signal and, as our experiments show, reduce detection performance. Recent work has proposed adapter-aware defenses. PEFTGuard trains a supervised meta-classifier on transformed adapter weights to distinguish benign from backdoored adapters (Sun et al. 2025). However, once an adapter is flagged as suspicious, it must either be discarded, making false positives costly, or handled by a separate mitigation method. Obliviate instead trains a defensive adapter to suppress backdoored neurons in a potentially compromised frozen model (Kim et al. 2025). This addresses a different threat model, in which the base model is backdoored, rather than the supply-chain setting considered here, where the base model is trusted and the backdoor resides in a third-party adapter. Moreover, Obliviate introduces an additional defensive adapter that may unintentionally alter the model’s benign generation behavior. More broadly, existing adapter-aware defenses do not explain how to safely deploy an untrusted adapter. Current methods either target backdoored base models or classify entire adapters without providing prompt-level mitigation. Figure 1 summarizes this research gap. We introduce LoRAScan, the first inference-time backdoor defense designed specifically for low-rank adapters in generative LLMs. Unlike prior adapter-aware defenses that require supervised training of separate classifiers or adapters, LoRAScan exploits the distinct latent-space footprints produced when trigger-bearing inputs pass through compromised LoRA adapters. It neither modifies the adapter parameters nor alters the model’s generation process. Before deployment, LoRAScan processes a small set of unlabeled clean prompts sampled from general instruction-following datasets, such as Stanford Alpaca, and measures activation statistics in the LoRA down-projection pathways, namely the A-side bottleneck activations. It then selects a sparse, low-variance subset of LoRA insertion sites (5% of all insertion sites by default). Our ablation results show that this sparse subset isolates the backdoor signal significantly better than monitoring all insertion sites. During inference, LoRAScan monitors the A-side bottleneck activations of each selected module. Our key observation is that trigger-bearing prompts produce activations that are both unusually large and highly concentrated at a small number of token positions. LoRAScan leverages this observation to reject suspicious prompts, while accepted prompts proceed through the original generation process. LoRAScan requires only a small collection of trusted, unlabeled prompts for module selection and rejection-threshold calibration. Access to limited clean data is a standard assumption in the backdoor-defense literature (Liu et al. 2018; Zhang et al. 2022; Qi et al. 2024). LoRAScan requires no poisoned samples, examples of backdoor triggers or target behaviors, or labeled benign or backdoored adapters. Our contributions are summarized as follows: • We introduce LoRAScan, the first inference-time backdoor defense for low-rank adapters in generative LLMs. • We demonstrate that backdoor signals are concentrated in a small subset of LoRA insertion sites. We propose a method for identifying these sites before adapter deployment and find that monitoring this subset yields substantially better performance than monitoring all available LoRA insertion sites. • We show that trigger-bearing prompts produce unusually large activation spikes that are concentrated at a small number of token positions in the LoRA down-projection bottleneck. Based on this property, LoRAScan significantly outperforms existing defenses across diverse settings in a standard benchmark for LLM backdoors. Background and Related Work Feature ONION BEAT ConfGuard CleanGen PEFTGuard Obliviate LoRAScan Uses adapter-specific signals ✗ ✗ ✗ ✗ ✓ ✗ ✓ Operates at sample level ✓ ✓ ✓ ✓ ✗ ✗ ✓ Preserves clean generation ✓ ✓ ✓ ✗ ✓ ✗ ✓ Needs no labeled backdoor data ✓ ✓ ✗ ✓ ✗ ✓ ✓ Table 1: Comparison of backdoor defenses for LLMs. ConfGuard needs backdoor samples to tune its detection threshold, whereas PEFTGuard needs backdoored adapters to train its adapter classifier. Large Language Models and Low-Rank Adaptation Generative large language models are commonly implemented as decoder-only Transformers trained with an autoregressive language-modeling objective, which minimizes the negative log-likelihood of each token conditioned on its preceding context (Vaswani et al. 2017; Brown et al. 2020; Touvron et al. 2023). At inference time, the model generates text by repeatedly predicting the next token. Full-parameter adaptation of large pretrained models is computationally expensive and storage-intensive, which significantly inflates distribution costs (Ding et al. 2023). Low-rank adaptation (LoRA) addresses this limitation by freezing the pretrained parameters and learning low-rank updates for selected linear transformations (Hu et al. 2022). Given a frozen pretrained weight matrix 0∈ℝdout×dinW_0 ^d_out× d_in, LoRA parameterizes the adapted transformation as =0+αr,y=W_0h+ αrBAh, (1) where ∈ℝdinh ^d_in is the input activation to the adapted linear transformation, ∈ℝr×dinA ^r× d_in and ∈ℝdout×rB ^d_out× r are trainable, r≪min(din,dout)r (d_in,d_out) is the adapter rank, and α controls the update scale. The matrix A projects h into the rank-r bottleneck and is often called the LoRA down-projection, while B maps the bottleneck representation back to the output dimension. A LoRA insertion site denotes a particular linear projection within a particular Transformer block to which a LoRA update is attached. Common insertion sites include the query, key, value, and output attention projections (Q,K,V,O)(W_Q,W_K,W_V,W_O), as well as the gate, up, and down feed-forward projections (gate,up,down)(W_gate,W_up,W_down) (Dettmers et al. 2023; Mao et al. 2025). Unless otherwise specified, we use “down-projection” to refer to the LoRA matrix A. When discussing the base-model feed-forward projection, we explicitly write downW_down. Backdoor Attacks Backdoor attacks implant conditional behaviors that remain dormant on benign inputs but are activated when attacker-chosen trigger conditions are satisfied. BadNets established the data-poisoning formulation, in which a token or short phrase is added to selected training examples and paired with an attacker-specified target output (Gu et al. 2019). Subsequent work broadened these activation conditions beyond conspicuous lexical patterns. Virtual Prompt Injection (VPI) uses a semantic or topic-level scenario as the trigger, causing the model to respond as though an attacker-specified virtual instruction had been appended to the user prompt (Yan et al. 2024). Sleeper-agent attacks instead condition malicious behavior on deployment-relevant context, such as a stated year, and demonstrate that this behavior can persist through subsequent safety training (Hubinger et al. 2024). Moving beyond single-trigger settings, Multi-Trigger Backdoor Attacks (MTBA) implant multiple triggers in the same model, each of which can independently activate the backdoor. This challenges defenses that assume a single trigger-target association (Li et al. 2025). Composite Trigger Backdoor Attacks (CTBA) distribute multiple trigger keys across distinct prompt components and activate only when all required keys are present, allowing incomplete trigger combinations to appear benign (Huang et al. 2024). Backdoor Defenses Backdoor defenses can be broadly divided into two groups according to whether they modify the deployed model or its generation procedure. Model-modifying defenses attempt to weaken the association between a trigger and its target behavior through additional training, parameter transformations, or changes to decoding. Although such interventions can reduce backdoor effectiveness, they may also alter the model’s behavior on benign requests (Cheng et al. 2025). Clean-data fine-tuning, for example, seeks to overwrite malicious behavior through additional parameter updates (Qi et al. 2024), while CROW further regularizes the consistency of internal representations across layers under adversarial perturbations during retraining (Min et al. 2024). Model-compression techniques have also been adapted as post-training defenses. WANDA removes weights according to their magnitudes and corresponding input activations, while low-precision quantization attempts to disrupt backdoor behavior by coarsening the model’s numerical representation (Sun et al. 2024; Li et al. 2026). Rather than changing model parameters, decoding-time interventions modify how outputs are generated. Temperature search identifies decoding configurations under which the backdoor is less effective (Shi et al. 2024), while CleanGen compares the token distributions of the deployed model and a clean reference model and replaces tokens that receive anomalously high support from the potentially compromised model (Li et al. 2024). Obliviate trains a defensive adapter that amplifies benign features and suppresses the influence of trigger-related tokens (Kim et al. 2025). Its threat model assumes that the base model may come from an untrusted source, and it uses parameter-efficient fine-tuning (PEFT) to mitigate backdoor behavior. This differs from the setting considered in this paper, where the base model is trusted and the potential backdoor is introduced through a third-party adapter. Model-preserving defenses leave the model parameters and underlying token-generation procedure unchanged. Instead, they detect suspicious inputs, monitor internal activations or output behavior, or inspect model weights without updating them (Cheng et al. 2025; Zhou et al. 2025). Input-level defenses exploit linguistic irregularities introduced by textual triggers. ONION assumes that inserted trigger tokens reduce the fluency of an input and removes tokens whose deletion substantially decreases its perplexity (Qi et al. 2021). More recent methods examine behavioral signals associated with backdoor activation. BEAT appends a candidate input to a malicious safety probe and measures the resulting change in the probe’s refusal distribution, treating a large distortion as evidence that the input contains a trigger (Yi et al. 2025). ConfGuard instead monitors token-level confidence during generation and detects a pattern in which backdoor activation produces abnormally high and persistent confidence over consecutive output tokens (Wang et al. 2026). PEFTGuard is specifically designed for parameter-efficient modules (PEFT), including low-rank adapters. It learns a classifier over adapter weights to distinguish benign from backdoored adapters (Sun et al. 2025). However, it operates at a higher level and is therefore not directly comparable to our work: its prediction applies to the adapter as a whole and does not determine which individual inputs activate the backdoor. As a result, a flagged adapter must either be rejected entirely or subjected to a follow-up defense, such as inference-time detection or retraining. Table 1 summarizes the main differences among backdoor defenses for LLMs. Methodology Figure 2: Overview of LoRAScan. Before deployment, LoRAScan uses clean prompts to select stable LoRA insertion sites and compute a rejection threshold. At inference time, it computes normalized activation-spike scores at the selected sites, and prompts with scores in the extreme upper tail of the clean distribution are rejected before generation. Threat Model We consider a threat model in which a LoRA adapter is downloaded from a third-party repository. This is a realistic scenario because online repositories such as Hugging Face host thousands of LoRA adapters for diverse domain-specific tasks, while base models are often obtained from trusted, established organizations. The attacker has full control over the adapter-training procedure but cannot modify the base model. The attacker trains the adapter to behave normally on clean prompts while executing a malicious target behavior when a secret trigger is present. The defender has white-box access to the adapter weights. However, the defender does not know whether the adapter is compromised, which trigger was used, or which target behavior was implanted. While the defender has no access to poisoned samples for calibrating or training the defense, they have access to a small set of unlabeled clean prompts drawn from general-purpose instruction-following datasets. Overview Before adapter deployment, LoRAScan selects a sparse subset of LoRA insertion sites to monitor, using 5% of insertion sites by default. The selection is performed by ranking insertion sites according to the variability of their activation-spike statistics on clean inputs drawn from a general instruction-following dataset and retaining the least variable sites. Intuitively, LoRAScan monitors sites whose clean behavior is stable, making unusually large deviations easier to detect. We define activation spikes as large LoRA down-projection activations that are concentrated in a small number of prompt-token positions. At inference time, LoRAScan monitors only the selected insertion sites. For each prompt, it computes an average normalized activation-spike score across the sites. The prompt is rejected before generation if this score falls in the extreme upper tail of the clean score distribution. The rejection threshold is computed once before adapter deployment and reused during inference. Figure 2 provides an overview of the proposed method. Model Defense Jailbreak ARR ↑ / BPR ↑ Neg. Sentiment ARR ↑ / BPR ↑ Refusal ARR ↑ / BPR ↑ DeepSeek LoRAScan 100.00±0.00/99.19±0.40100.00± 0.00/99.19± 0.40 95.20±0.68/96.70±0.5695.20± 0.68/96.70± 0.56 100.00±0.00/99.10±0.30100.00± 0.00/99.10± 0.30 ConfGuard 9.09±1.29/60.00±2.209.09± 1.29/60.00± 2.20 0.00±0.00/30.00±1.450.00± 0.00/30.00± 1.45 100.00±0.00/93.60±0.77100.00± 0.00/93.60± 0.77 ONION 67.07±2.11/97.98±0.6367.07± 2.11/97.98± 0.63 73.10±1.40/93.50±0.7873.10± 1.40/93.50± 0.78 73.60±1.39/93.50±0.7873.60± 1.39/93.50± 0.78 BEAT 3.23±0.79/98.99±0.453.23± 0.79/98.99± 0.45 20.00±1.26/94.70±0.7120.00± 1.26/94.70± 0.71 0.30±0.17/91.00±0.900.30± 0.17/91.00± 0.90 Llama-3 LoRAScan 99.60±0.29/99.19±0.4099.60± 0.29/99.19± 0.40 100.00±0.00/93.30±0.79100.00± 0.00/93.30± 0.79 97.40±0.50/95.60±0.6597.40± 0.50/95.60± 0.65 ConfGuard 16.77±1.68/38.18±2.1816.77± 1.68/38.18± 2.18 21.00±1.29/37.10±1.5321.00± 1.29/37.10± 1.53 100.00±0.00/89.60±0.97100.00± 0.00/89.60± 0.97 ONION 67.07±2.11/97.98±0.6367.07± 2.11/97.98± 0.63 73.10±1.40/93.50±0.7873.10± 1.40/93.50± 0.78 73.60±1.39/93.50±0.7873.60± 1.39/93.50± 0.78 BEAT 34.34±2.13/99.80±0.2034.34± 2.13/99.80± 0.20 24.30±1.36/98.60±0.3724.30± 1.36/98.60± 0.37 0.00±0.00/90.90±0.910.00± 0.00/90.90± 0.91 OpenChat-3.5 LoRAScan 94.95±0.98/99.39±0.3594.95± 0.98/99.39± 0.35 95.10±0.68/95.60±0.6595.10± 0.68/95.60± 0.65 100.00±0.00/95.90±0.63100.00± 0.00/95.90± 0.63 ConfGuard 39.39±2.20/36.36±2.1639.39± 2.20/36.36± 2.16 0.00±0.00/37.50±1.530.00± 0.00/37.50± 1.53 100.00±0.00/90.00±0.95100.00± 0.00/90.00± 0.95 ONION 67.07±2.11/97.98±0.6367.07± 2.11/97.98± 0.63 73.10±1.40/93.50±0.7873.10± 1.40/93.50± 0.78 73.60±1.39/93.50±0.7873.60± 1.39/93.50± 0.78 BEAT 4.24±0.91/99.80±0.204.24± 0.91/99.80± 0.20 31.10±1.46/90.30±0.9431.10± 1.46/90.30± 0.94 0.00±0.00/88.30±1.020.00± 0.00/88.30± 1.02 Vicuna LoRAScan 96.16±0.86/97.37±0.7296.16± 0.86/97.37± 0.72 100.00±0.00/97.80±0.46100.00± 0.00/97.80± 0.46 100.00±0.00/96.50±0.58100.00± 0.00/96.50± 0.58 ConfGuard 26.87±1.99/50.91±2.2526.87± 1.99/50.91± 2.25 0.00±0.00/67.60±1.480.00± 0.00/67.60± 1.48 100.00±0.00/88.40±1.01100.00± 0.00/88.40± 1.01 ONION 67.07±2.11/97.98±0.6367.07± 2.11/97.98± 0.63 73.10±1.40/93.50±0.7873.10± 1.40/93.50± 0.78 73.60±1.39/93.50±0.7873.60± 1.39/93.50± 0.78 BEAT 33.13±2.12/98.59±0.5333.13± 2.12/98.59± 0.53 0.20±0.14/92.90±0.810.20± 0.14/92.90± 0.81 0.00±0.00/85.90±1.100.00± 0.00/85.90± 1.10 Llama-2 LoRAScan 96.16±0.86/99.80±0.2096.16± 0.86/99.80± 0.20 100.00±0.00/92.70±0.82100.00± 0.00/92.70± 0.82 100.00±0.00/96.70±0.56100.00± 0.00/96.70± 0.56 ConfGuard 29.29±2.05/41.62±2.2229.29± 2.05/41.62± 2.22 0.00±0.00/18.10±1.220.00± 0.00/18.10± 1.22 100.00±0.00/92.80±0.82100.00± 0.00/92.80± 0.82 ONION 67.07±2.11/97.98±0.6367.07± 2.11/97.98± 0.63 73.10±1.40/93.50±0.7873.10± 1.40/93.50± 0.78 73.60±1.39/93.50±0.7873.60± 1.39/93.50± 0.78 BEAT 94.14±1.06/99.80±0.2094.14± 1.06/99.80± 0.20 20.10±1.27/95.40±0.6620.10± 1.27/95.40± 0.66 0.00±0.00/91.60±0.880.00± 0.00/91.60± 0.88 Table 2: Backdoor detection results on 7575 low-rank adapters from the BackdoorLLM benchmark, covering the BadNets, CTBA, Sleeper, VPI, and MTBA attacks. Each entry reports attack rejection rate (ARR) / benign pass rate (BPR) ± standard error (SE) in percentage points. ARR is computed over backdoor samples: 495495 samples for each jailbreak task entry and 10001000 samples for each negative-sentiment and refusal task entry. BPR is computed over clean examples of the corresponding size for each backdoor task. Arrows indicate the preferred direction. Hypothesis and Test Statistic Formulation LoRA modifies a frozen model through additive low-rank adapter pathways attached at different insertion sites. For a LoRA-modified linear map at insertion site m, the adapter update follows Equation (1). The hidden state h entering the module is first projected into a low-dimensional bottleneck by the LoRA down-projection AmA_m, and the resulting bottleneck representation is then mapped back to the output dimension by the LoRA up-projection BmB_m. We formulate three design hypotheses, which are empirically validated in later sections. First, adapter-mediated backdoor behavior is reflected in the low-dimensional space produced by the LoRA down-projection, making A-side bottleneck activations a desirable monitoring signal. Second, trigger-bearing prompts produce sequence-localized activation spikes, rather than uniformly elevated activations across all prompt tokens. Third, these deviations are most detectable at a small subset of LoRA insertion sites whose clean behavior has low variability. Based on these hypotheses, we define an activation spike statistic sm(x)s_m(x). For an input prompt x, let (x)T(x) denote its prompt-token positions, and let am,t(x)a_m,t(x) denote the LoRA down-projection bottleneck activation magnitude at insertion site m and token position t. Mm(x) M_m(x) =maxt∈(x)am,t(x), = _t (x)a_m,t(x), (2) a¯m(x) a_m(x) =1|(x)|∑t∈(x)am,t(x), = 1|T(x)| _t (x)a_m,t(x), sm(x) s_m(x) =Mm(x)log(1+Mm(x)a¯m(x)). =M_m(x) (1+ M_m(x) a_m(x) ). Here, sm(x)s_m(x) is large when an insertion site exhibits both high activation magnitude and strong localization to a small number of prompt-token positions. Backdoor Detector Construction Let =cii=1nC=\c_i\_i=1^n denote the clean set drawn from general instruction-following data, and let ℳM denote the set of LoRA insertion sites available in the adapter. For each insertion site m, LoRAScan computes the activation spike statistic sm(ci)s_m(c_i) on every clean prompt. These clean scores define a site-specific mean μm _m and standard deviation σm _m. LoRAScan first selects a sparse subset of insertion sites to monitor. Here, insertion-site selection refers to choosing which existing LoRA attachment points to monitor, without modifying the adapter itself. The selection is based on activation spike statistics computed on the clean set. Specifically, LoRAScan ranks insertion sites by ascending σm _m and retains the lowest-variability fraction k, denoted ℳkM_k. This rule favors sites whose clean behavior is consistent, so that trigger-induced deviations are less likely to be hidden by normal clean variation. After selecting ℳkM_k, LoRAScan normalizes each selected site’s activation spike statistic and averages the normalized scores: Sk(x)=1|ℳk|∑m∈ℳksm(x)−μmσm.S_k(x)= 1|M_k| _m _k s_m(x)- _m _m. (3) This normalization places spike statistics from different insertion sites on a common scale. The resulting score Sk(x)S_k(x) measures how anomalous the prompt is relative to the clean behavior of the monitored LoRA insertion sites. Finally, LoRAScan constructs a one-sided rejection threshold from the clean scores Sk(ci)i=1n\S_k(c_i)\_i=1^n. Let m^k m_k be the median of these scores, and let d^k d_k be their median absolute deviation. The rejection threshold is defined as τk=m^k+λd^k, _k= m_k+λ d_k, (4) where λ controls the conservativeness of the upper-tail rejection rule. At inference time, LoRAScan performs a single forward pass, computes Sk(x)S_k(x), and rejects the prompt before generation if Sk(x)>τkS_k(x)> _k. Otherwise, the prompt is passed to the LoRA-adapted model for normal generation. Experimental Evaluation Model Task No Defense LoRAScan FT CROW WANDA Quantize Decoding CleanGen Obliviate DeepSeek JB 85.9/24.7 0.0/24.7 10.1/8.5 85.9/24.4 86.7/48.3 85.1/27.3 86.3/28.9 78.6/20.4 85.7/25.7 NS 100.0/1.3 4.8/1.3 1.6/0.2 100.0/1.3 86.3/11.3 100.0/0.9 100.0/1.7 94.6/3.1 100.0/1.2 R 100.0/2.1 0.0/2.1 9.4/9.5 100.0/2.1 69.8/5.6 100.0/2.4 100.0/1.8 91.0/4.1 100.0/2.2 Llama-3 JB 86.5/2.6 0.4/2.6 51.9/51.9 86.3/2.6 90.9/50.5 85.3/3.6 84.7/3.8 84.9/3.4 85.9/2.8 NS 100.0/0.8 0.0/0.8 0.7/0.5 100.0/0.9 47.3/0.0 100.0/0.7 100.0/1.3 99.7/0.9 100.0/1.2 R 100.0/1.6 2.6/1.6 0.1/0.0 100.0/1.5 27.8/1.3 100.0/1.2 100.0/1.0 100.0/2.3 100.0/1.5 OpenChat JB 86.5/4.0 4.4/3.6 40.4/38.4 86.5/4.0 84.7/19.0 85.9/5.5 87.5/5.3 86.5/4.9 85.7/1.8 NS 100.0/0.4 4.9/0.4 0.9/1.0 100.0/0.4 88.0/0.7 100.0/0.4 99.9/1.0 99.8/0.4 100.0/0.4 R 100.0/1.1 0.0/1.1 2.5/1.7 100.0/1.1 99.8/1.1 100.0/0.8 100.0/1.6 100.0/2.3 100.0/1.2 Vicuna JB 87.9/12.1 3.4/11.1 2.2/2.0 88.1/12.1 82.8/24.0 88.1/10.1 88.7/15.6 93.1/51.5 88.1/12.5 NS 100.0/2.2 0.0/2.0 1.1/1.1 100.0/2.2 98.0/6.1 100.0/1.6 100.0/2.7 57.4/1.1 100.0/3.0 R 100.0/4.7 0.0/4.7 22.3/13.7 100.0/4.7 97.8/4.5 100.0/4.5 100.0/2.4 55.8/3.0 100.0/4.1 Llama-2 JB 86.9/3.0 3.4/3.0 41.4/37.6 87.1/3.0 66.3/13.1 82.2/5.5 84.9/5.5 84.0/5.1 39.4/1.8 NS 100.0/1.5 0.0/1.5 1.3/1.6 100.0/1.4 92.3/2.0 100.0/1.3 100.0/1.8 96.4/2.9 61.4/1.6 R 100.0/1.7 0.0/1.6 1.2/0.0 100.0/1.8 64.8/2.0 100.0/1.6 100.0/1.3 96.8/5.7 53.9/1.6 Table 3: Comparison with model-modifying defenses that intervene through weight modification (fine-tuning (FT), CROW, WANDA, and quantization), retraining with a defensive adapter (Obliviate), or modification of the model’s generation behavior (decoding and CleanGen). Evaluation is performed on 75 low-rank adapters across 5 backdoor attacks from the BackdoorLLM benchmark, with 495 samples for each jailbreak (JB) task entry and 1000 samples for each negative-sentiment (NS) and refusal (R) task entry. Each cell reports the backdoor activation rate on backdoor inputs / clean inputs, measured as the percentage of test samples whose generated outputs exhibit the target backdoor behavior. Lower is better for both values. Model Task No Defense LoRAScan FT CROW WANDA Quantize Decoding CleanGen Obliviate DeepSeek JB 1.6/1.9 0.0/1.9 1.4/1.3 1.6/1.9 1.5/2.3 1.6/2.0 1.6/2.0 1.8/1.8 1.6/2.0 NS 0.0/0.4 0.7/0.4 0.4/0.1 0.0/0.4 1.1/1.0 0.0/0.3 0.0/0.4 0.7/0.6 0.0/0.3 R 0.0/0.5 0.0/0.5 0.9/0.9 0.0/0.5 1.5/0.7 0.0/0.5 0.0/0.4 0.9/0.6 0.0/0.5 Llama-3 JB 1.5/0.7 0.3/0.7 2.3/2.3 1.6/0.7 1.3/2.3 1.6/0.8 1.6/0.9 1.6/0.8 1.6/0.8 NS 0.0/0.3 0.0/0.3 0.3/0.2 0.0/0.3 1.6/0.0 0.0/0.3 0.0/0.4 0.2/0.3 0.0/0.3 R 0.0/0.4 0.5/0.4 0.1/0.0 0.0/0.4 1.4/0.4 0.0/0.3 0.0/0.3 0.0/0.5 0.0/0.4 OpenChat JB 1.5/0.9 0.9/0.8 2.2/2.2 1.5/0.9 1.6/1.8 1.6/1.0 1.5/1.0 1.5/1.0 1.6/0.6 NS 0.0/0.2 0.7/0.2 0.3/0.3 0.0/0.2 1.0/0.3 0.0/0.2 0.1/0.3 0.1/0.2 0.0/0.2 R 0.0/0.3 0.0/0.3 0.5/0.4 0.0/0.3 0.1/0.3 0.0/0.3 0.0/0.4 0.0/0.5 0.0/0.3 Vicuna JB 1.5/1.5 0.8/1.4 0.7/0.6 1.5/1.5 1.7/1.9 1.5/1.4 1.4/1.6 1.1/2.3 1.5/1.5 NS 0.0/0.5 0.0/0.4 0.3/0.3 0.0/0.5 0.4/0.8 0.0/0.4 0.0/0.5 1.6/0.3 0.0/0.5 R 0.0/0.7 0.0/0.7 1.3/1.1 0.0/0.7 0.5/0.7 0.0/0.7 0.0/0.5 1.6/0.5 0.0/0.6 Llama-2 JB 1.5/0.8 0.8/0.8 2.2/2.2 1.5/0.8 2.1/1.5 1.7/1.0 1.6/1.0 1.7/1.0 2.2/0.6 NS 0.0/0.4 0.0/0.4 0.4/0.4 0.0/0.4 0.8/0.4 0.0/0.4 0.0/0.4 0.6/0.5 1.5/0.4 R 0.0/0.4 0.0/0.4 0.3/0.0 0.0/0.4 1.5/0.4 0.0/0.4 0.0/0.4 0.6/0.7 1.6/0.4 Table 4: Standard errors for Table 3. This table compares model-modifying defenses that intervene through weight modification (fine-tuning (FT), CROW, WANDA, and quantization), retraining with a defensive adapter (Obliviate), or modification of the model’s generation behavior (decoding and CleanGen). Each jailbreak (JB) task entry is evaluated on 495 samples, while each negative-sentiment (NS) and refusal (R) task entry is evaluated on 1,000 samples. Each cell reports the values for backdoor inputs / clean inputs, in percentage points. Experimental Settings We perform the evaluations on a server equipped with two NVIDIA A100 80GB GPUs. We evaluate LoRAScan on 75 adapters from the BackdoorLLM benchmark (Li et al. 2026), using the benchmark-provided attack implementations, triggers, and target behaviors. The evaluation covers five model families: Deepseekllm-7B-chat, Llama-2-7b-chat-hf, Llama-3-8B-Instruct, Openchat-3.5-1210, and Vicuna-13B-v1.5. For each model, we evaluate three behavioral targets: jailbreak, negative sentiment, and refusal. The jailbreak task suppresses model refusal on harmful requests, the refusal task induces refusal on benign requests, and the negative-sentiment task injects negative-sentiment phrases into model outputs in the presence of a trigger. For each task, we evaluate five backdoor attacks: BadNets (Gu et al. 2019), CTBA (Huang et al. 2024), MTBA (Li et al. 2025), Sleeper (Hubinger et al. 2024), and VPI (Yan et al. 2024). BadNets uses word-level triggers, while VPI and Sleeper use phrase-level triggers. Advanced attacks include CTBA, which uses a composite trigger whose components must appear in the input in a specified order to activate the backdoor, and MTBA, which injects multiple independent backdoors into each adapter or model. We compare LoRAScan with both model-preserving and model-modifying defenses. For model-preserving detection, we compare against ONION (Qi et al. 2021), BEAT (Yi et al. 2025), and ConfGuard (Wang et al. 2026). For model-modifying defenses, we compare against clean-data fine-tuning (Qi et al. 2024), CROW (Min et al. 2024), WANDA pruning (Sun et al. 2024), quantization (Li et al. 2026), decoding-time defense (Shi et al. 2024), CleanGen (Li et al. 2024), and Obliviate (Kim et al. 2025). For model-preserving detectors, we report attack rejection rate (ARR) and benign pass rate (BPR). ARR measures the fraction of trigger-bearing inputs correctly rejected, while BPR measures the fraction of benign inputs allowed to pass. Higher values are better for both. Because model-modifying defenses modify generated outputs rather than rejecting prompts directly, we evaluate them using backdoor activation rate, defined as the percentage of test samples whose outputs exhibit the target backdoor behavior. Lower backdoor activation indicates stronger defense performance. LoRAScan uses a clean set of 40 prompts sampled from the Stanford Alpaca dataset (Taori et al. 2023). These prompts are used only to select LoRA insertion sites to monitor and set the rejection threshold. We set k=0.05k=0.05, so LoRAScan monitors the 5%5\% of LoRA insertion sites for each adapter. For the rejection threshold, we use λ=4.45λ=4.45, equivalent to three Gaussian-consistent median absolute deviation (MAD) scale units. Under a normal reference distribution for the clean scores, this corresponds approximately to a 99.9th-percentile upper-tail threshold. Backdoor Detection Results Table 2 compares LoRAScan against backdoor detectors that, like LoRAScan, reject backdoor inputs rather than modify the model, adapter, or generation process. The evaluation is aggregated across diverse backdoor attacks from the BackdoorLLM benchmark, including BadNets, VPI, Sleeper, CTBA, and MTBA. The results show that LoRAScan consistently outperforms the other detectors across models, attack types, and backdoor tasks. Over all 12,47512,475 backdoor and 12,47512,475 clean test samples, LoRAScan achieves 98.49%98.49\% ARR and 96.59%96.59\% BPR. ConfGuard performs well on refusal backdoors, but poorly on jailbreak and negative-sentiment tasks. This is expected because LLM refusals are often predictable, producing high-confidence refusal phrases, which is not usually the case for jailbreak and negative-sentiment backdoors. ONION is consistent across backdoor tasks, with 72.10%72.10\% ARR and 94.39%94.39\% BPR overall, and its results are identical across models because it scans the input text directly rather than monitoring the victim model’s activation space. BEAT preserves benign inputs well, but underperforms in ARR overall because its assumption that backdoor-triggered inputs, when combined with its probing procedure, induce a large change in generation behavior holds inconsistently. Comparison with Model-Modifying Defenses Table 3 compares LoRAScan with seven defenses from the BackdoorLLM benchmark that modify either the model (fine-tuning, CROW, WANDA, quantization, and Obliviate) or its generation procedure (Decoding and CleanGen). Corresponding standard errors are reported in Table 4. Although these defenses differ operationally from LoRAScan, which preserves both the model and its generation procedure, we include this comparison for completeness. LoRAScan achieves the lowest average backdoor activation on triggered inputs: 1.45%1.45\%, compared with 97.36%97.36\% without defense. Clean activation should be interpreted relative to the undefended clean baseline, particularly for the jailbreak task. DeepSeek and Vicuna answer many harmful requests even without triggers, with clean activation rates of 24.7%24.7\% and 12.1%12.1\%, respectively, indicating under-alignment. LoRAScan is a backdoor defense rather than an alignment method and therefore aims to preserve, rather than correct, this baseline behavior. Its clean activation is equal to or slightly lower than the undefended rate in every entry and averages 3.16%3.16\%, demonstrating minimal impact on benign generation. These reductions suggest that LoRAScan correctly isolates backdoor signals by rejecting some clean samples that nevertheless induce the target backdoor behavior. Fine-tuning on clean samples is the second-best method, with 9.09%9.09\% backdoor activation on triggered inputs. However, it performs inconsistently across models and tasks and substantially alters normal generation, increasing average clean activation from 3.24%3.24\% without defense to 7.84%7.84\%. The remaining defenses provide limited attack mitigation, averaging 91.16%91.16\% activation on triggered inputs. Although they preserve clean behavior in most settings, they also exhibit several notable failure cases. LoRA Pathway and Insertion-Site Ablations Table 5 reports ablations of two core design choices in LoRAScan: the LoRA pathway used as the monitoring signal and the insertion-site selection rule. Across site subsets, the down-projection pathway consistently achieves higher attack rejection than the up-projection pathway, suggesting that the up-projection dilutes the backdoor signal. The only exception is monitoring the last LoRA-containing Transformer layer, for which both pathways achieve only approximately 12% attack rejection rate. In contrast, their performance on clean inputs consistently remains nearly identical. Insertion-site selection has an even larger effect on detection performance. For both pathways, LoRAScan’s low-variability 5% selector substantially outperforms random, layer-specific, and all-site monitoring. For the down-projection pathway, it achieves 98.49% attack rejection rate, compared with 81.24% for the strongest alternative. For the up-projection pathway, it achieves 92.26%, compared with 75.22%. These gains come without a significant reduction in benign pass rate. Pathway Metric LoRAScan 5% Random 5% First Layer Last Layer All Down-projection ARR ↑ 98.49±0.1198.49± 0.11 54.94±0.4554.94± 0.45 48.22±0.4548.22± 0.45 12.36±0.2912.36± 0.29 81.24±0.3581.24± 0.35 BPR ↑ 96.59±0.1696.59± 0.16 98.46±0.1198.46± 0.11 98.86±0.0998.86± 0.09 98.28±0.1298.28± 0.12 97.73±0.1397.73± 0.13 Up-projection ARR ↑ 92.26±0.2492.26± 0.24 47.56±0.4547.56± 0.45 40.44±0.4440.44± 0.44 12.46±0.3012.46± 0.30 75.22±0.3975.22± 0.39 BPR ↑ 96.64±0.1696.64± 0.16 98.53±0.1198.53± 0.11 98.77±0.1098.77± 0.10 98.32±0.1198.32± 0.11 97.75±0.1397.75± 0.13 Table 5: LoRA pathway and insertion-site ablations across 75 low-rank adapters, five models, five backdoor attacks, and three backdoor tasks. Attack rejection rate (ARR) and benign pass rate (BPR) are computed over corresponding sets of 12,47512,475 triggered and clean test samples, respectively. Each entry reports the metric ± standard error in percentage points. We compare LoRA down-projection and up-projection signals under five insertion-site selection rules: the 5%5\% selected by LoRAScan, a random 5%5\% subset, the first and last LoRA-containing Transformer layers separately, and all available insertion sites. Runtime Analysis Detailed runtime results are reported in Table 6. These results include setup and detection runtimes across five models, using 7575 low-rank adapters, five backdoor attacks, three backdoor tasks, and 2,4952,495 test samples per model. We use the original defense parameters for all baselines. Detection time is the main recurring cost after deployment, directly impacting latency. Among defenses that inspect the victim model or adapter to detect abnormal behavior, LoRAScan has the lowest average detection cost, 29.6929.69 ms per sample, compared with 58.8258.82 ms for ConfGuard and 162.83162.83 ms for BEAT. This is because LoRAScan requires only a single forward pass, whereas ConfGuard monitors confidence during generation and BEAT performs multiple generations. ONION is faster, averaging 13.5313.53 ms per sample, but it directly scans input text, leading to substantially weaker attack rejection as shown in earlier sections. Setup time is a one-time pre-deployment cost. LoRAScan takes 11.9811.98 seconds on average to compute the rejection threshold and select LoRA insertion sites to monitor. This is comparable to ONION’s 8.728.72-second threshold calibration and substantially lower than BEAT’s 67.4667.46-second setup time, which includes threshold calibration and safety probe selection. ConfGuard has no setup cost because it uses a fixed confidence-window rule rather than dynamically selecting parameters. Defense Runtime DeepSeek Llama-3 OpenChat-3.5 Vicuna Llama-2 LoRAScan Setup 10.88±0.1810.88± 0.18 s 11.54±0.0611.54± 0.06 s 12.06±0.1212.06± 0.12 s 14.06±0.0814.06± 0.08 s 11.36±0.0911.36± 0.09 s Detection 26.53±0.0126.53± 0.01 ms 28.91±0.0128.91± 0.01 ms 29.88±0.0229.88± 0.02 ms 35.01±0.0135.01± 0.01 ms 28.10±0.0128.10± 0.01 ms ConfGuard Setup – – – – – Detection 47.19±0.3747.19± 0.37 ms 62.74±0.2762.74± 0.27 ms 63.20±0.4763.20± 0.47 ms 74.44±0.5174.44± 0.51 ms 46.52±0.3246.52± 0.32 ms ONION Setup 8.728.72 s 8.728.72 s 8.728.72 s 8.728.72 s 8.728.72 s Detection 14.14±0.1514.14± 0.15 ms 13.44±0.0213.44± 0.02 ms 13.16±0.0113.16± 0.01 ms 13.36±0.0213.36± 0.02 ms 13.55±0.0313.55± 0.03 ms BEAT Setup 32.88±0.3532.88± 0.35 s 36.72±0.3736.72± 0.37 s 40.04±0.3740.04± 0.37 s 55.67±0.7855.67± 0.78 s 171.97±14.36171.97± 14.36 s Detection 76.31±0.1376.31± 0.13 ms 85.45±0.1285.45± 0.12 ms 89.97±0.1589.97± 0.15 ms 135.77±0.24135.77± 0.24 ms 426.63±2.25426.63± 2.25 ms Table 6: Setup and detection runtimes across five models. Evaluation is performed using 75 low-rank adapters, five backdoor attacks, and three backdoor tasks from the BackdoorLLM benchmark, with 2,495 test samples per model. Setup is performed once per adapter, whereas detection time represents the per-sample screening time during inference. Values are reported as mean ± standard error. ConfGuard has no setup stage. ONION uses a single calibration shared across all models. Therefore, no setup-time standard error is reported. Limitations and Future Work First, this work focuses on autoregressive large language models based on Transformer architectures, the predominant design underlying chatbots and code assistants (Qorib et al. 2024; Grattafiori et al. 2024). Future work can extend the proposed backdoor detection framework to emerging non-Transformer architectures, such as state-space models (Gu and Dao 2023), and to multimodal models (Liu et al. 2023). Second, LoRAScan rejects suspicious inputs rather than discarding an entire adapter, thereby reducing the cost of false positives. Another line of research focuses on sanitizing inputs by identifying and removing backdoor triggers before processing them (Zhou et al. 2025). Future work can extend LoRAScan to support input sanitization. One possible approach is to iteratively mask candidate tokens while monitoring the resulting decrease in the activation-spike score. Nevertheless, input sanitization may not always preserve the meaning of the original request. For example, if “Thanksgiving” is the trigger in the user query “What day is Thanksgiving?”, removing it produces an incomplete request. Third, LoRAScan addresses a scenario where the defender downloads third-party adapters and maintains white-box access to intermediate activations. In contrast, an end-user querying a black-box API can only send prompts and receive generated text. From such a black-box perspective, the base model and adapter function as a single merged system, causing adapter-specific backdoor signals to be obscured. As empirically demonstrated in earlier sections, adapter-agnostic defenses underperform significantly. Importantly, while black-box API clients lack visibility into internal adapter channels, the platform operator hosting the API possesses full access and can deploy LoRAScan directly at inference time to safeguard the pipeline. Ethical Considerations This work addresses security vulnerabilities in third-party low-rank adapter (LoRA) ecosystems with a focus on defense. Adversaries might attempt to design sophisticated attacks based on our findings, such as adding activation-smoothing penalties during backdoor training. Nevertheless, we believe that the benefits of open research outweigh these risks. Publicly identifying vulnerabilities helps secure production systems before bad actors exploit them. Furthermore, all evaluations in this paper were conducted using publicly available, peer-reviewed benchmarks, avoiding the creation of new malicious models, adapters, or datasets. Conclusion The integrity of third-party LoRA adapters is a growing concern for LLM deployment. Existing backdoor defenses either ignore adapter-specific structure by merging adapters with base models, which can dilute adapter-specific backdoor signals, or operate at a higher level by relying on classifier-based rejection of entire adapters. This paper addresses this gap by introducing LoRAScan, an inference-time backdoor detector designed specifically for low-rank adapters. Before deployment, LoRAScan selects a small subset of stable LoRA insertion sites, using 5%5\% by default. During inference, it monitors LoRA down-projection bottleneck activations at these sites and rejects anomalous inputs that exhibit highly concentrated activation spikes. Across a standard LLM backdoor benchmark with diverse models, attacks, and tasks, LoRAScan achieves 98.49%98.49\% attack rejection, outperforming existing baselines without a significant trade-off on clean inputs. Acknowledgments Portions of this work were supported by the National Science Foundation (2419880, 2347426). References E. Bagdasaryan and V. Shmatikov (2022) Spinning language models: risks of propaganda-as-a-service and countermeasures. In 2022 IEEE Symposium on Security and Privacy (SP), p. 769–786. Cited by: Introduction. T. Brown, B. Mann, N. Ryder, M. Subbiah, J. D. Kaplan, P. Dhariwal, A. Neelakantan, P. Shyam, G. Sastry, A. Askell, et al. (2020) Language models are few-shot learners. Advances in neural information processing systems 33, p. 1877–1901. Cited by: Large Language Models and Low-Rank Adaptation. P. Cheng, Z. Wu, W. Du, H. Zhao, W. Lu, and G. Liu (2025) Backdoor attacks and countermeasures in natural language processing models: a comprehensive security review. IEEE Transactions on Neural Networks and Learning Systems. Cited by: Backdoor Defenses, Backdoor Defenses. T. Dettmers, A. Pagnoni, A. Holtzman, and L. Zettlemoyer (2023) Qlora: efficient finetuning of quantized llms. Advances in neural information processing systems 36, p. 10088–10115. Cited by: Large Language Models and Low-Rank Adaptation. N. Ding, Y. Qin, G. Yang, F. Wei, Z. Yang, Y. Su, S. Hu, Y. Chen, C. Chan, W. Chen, et al. (2023) Parameter-efficient fine-tuning of large-scale pre-trained language models. Nature machine intelligence 5 (3), p. 220–235. Cited by: Large Language Models and Low-Rank Adaptation. A. Grattafiori, A. Dubey, A. Jauhri, A. Pandey, A. Kadian, A. Al-Dahle, A. Letman, A. Mathur, A. Schelten, A. Vaughan, et al. (2024) The llama 3 herd of models. arXiv preprint arXiv:2407.21783. Cited by: Limitations and Future Work. A. Gu and T. Dao (2023) Mamba: linear-time sequence modeling with selective state spaces. arXiv preprint arXiv:2312.00752. Cited by: Limitations and Future Work. T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg (2019) Badnets: evaluating backdooring attacks on deep neural networks. Ieee Access 7, p. 47230–47244. Cited by: Backdoor Attacks, Experimental Settings. E. J. Hu, Y. Shen, P. Wallis, Z. Allen-Zhu, Y. Li, S. Wang, L. Wang, W. Chen, et al. (2022) Lora: low-rank adaptation of large language models.. Iclr 1 (2), p. 3. Cited by: Introduction, Large Language Models and Low-Rank Adaptation. H. Huang, Z. Zhao, M. Backes, Y. Shen, and Y. Zhang (2024) Composite backdoor attacks against large language models. In Findings of the association for computational linguistics: NAACL 2024, p. 1459–1472. Cited by: Backdoor Attacks, Experimental Settings. E. Hubinger, C. Denison, J. Mu, M. Lambert, M. Tong, M. MacDiarmid, T. Lanham, D. M. Ziegler, T. Maxwell, N. Cheng, et al. (2024) Sleeper agents: training deceptive llms that persist through safety training. arXiv preprint arXiv:2401.05566. Cited by: Backdoor Attacks, Experimental Settings. A. Hussain, M. R. I. Rabin, T. Ahmed, M. A. Alipour, and B. Xu (2023) Occlusion-based detection of trojan-triggering inputs in large language models of code. arXiv preprint arXiv:2312.04004. Cited by: Introduction. J. Kim, M. Song, S. H. Na, and S. Shin (2025) Obliviate: neutralizing task-agnostic backdoors within the parameter-efficient fine-tuning paradigm. In Findings of the Association for Computational Linguistics: NAACL 2025, p. 1288–1307. Cited by: Introduction, Backdoor Defenses, Experimental Settings. Y. Li, J. He, H. Huang, J. Sun, X. Ma, and Y. Jiang (2025) Shortcuts everywhere and nowhere: exploring multi-trigger backdoor attacks. IEEE Transactions on Dependable and Secure Computing. Cited by: Backdoor Attacks, Experimental Settings. Y. Li, H. Huang, Y. Zhao, X. Ma, and J. Sun (2026) Backdoorllm: a comprehensive benchmark for backdoor attacks and defenses on large language models. Advances in neural information processing systems 38. Cited by: Backdoor Defenses, Experimental Settings, Experimental Settings. Y. Li, Z. Xu, F. Jiang, L. Niu, D. Sahabandu, B. Ramasubramanian, and R. Poovendran (2024) Cleangen: mitigating backdoor attacks for generation tasks in large language models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, p. 9101–9118. Cited by: Backdoor Defenses, Experimental Settings. H. Liu, C. Li, Q. Wu, and Y. J. Lee (2023) Visual instruction tuning. Advances in neural information processing systems 36, p. 34892–34916. Cited by: Limitations and Future Work. H. Liu, X. Sun, M. Tian, M. Hariri, Z. Liu, R. Tang, Z. Jiang, J. Yuan, Y. Chuang, et al. (2025) Loratk: lora once, backdoor everywhere in the share-and-play ecosystem. In Findings of the Association for Computational Linguistics: EMNLP 2025, p. 23009–23047. Cited by: Introduction. K. Liu, B. Dolan-Gavitt, and S. Garg (2018) Fine-pruning: defending against backdooring attacks on deep neural networks. In International symposium on research in attacks, intrusions, and defenses, p. 273–294. Cited by: Introduction, Introduction. Y. Mao, Y. Ge, Y. Fan, W. Xu, Y. Mi, Z. Hu, and Y. Gao (2025) A survey on lora of large language models. Frontiers of Computer Science 19 (7), p. 197605. Cited by: Large Language Models and Low-Rank Adaptation. N. M. Min, L. H. Pham, Y. Li, and J. Sun (2024) Crow: eliminating backdoors from large language models via internal consistency regularization. arXiv preprint arXiv:2411.12768. Cited by: Backdoor Defenses, Experimental Settings. S. Minaee, T. Mikolov, N. Nikzad, M. Chenaghlu, R. Socher, X. Amatriain, and J. Gao (2024) Large language models: a survey. arXiv preprint arXiv:2402.06196. Cited by: Introduction. D. Obidov, S. Akki, T. Chen, and K. Yang (2026a) Silent sabotage: internal state triggered backdoor attacks on llm-powered robotic systems. In Proceedings of the EAI International Conference on Security and Privacy in Cyber-Physical Systems and Smart Vehicles, Cited by: Introduction. D. Obidov, H. Yu, X. Guo, and K. Yang (2026b) Dynamic deep prompt optimization for defending against jailbreak attacks on llms. Proceedings of the AAAI Conference on Artificial Intelligence 40 (42), p. 35742–35750. Cited by: Introduction. F. Qi, Y. Chen, M. Li, Y. Yao, Z. Liu, and M. Sun (2021) Onion: a simple and effective defense against textual backdoor attacks. In Proceedings of the 2021 conference on empirical methods in natural language processing, p. 9558–9566. Cited by: Introduction, Backdoor Defenses, Experimental Settings. X. Qi, Y. Zeng, T. Xie, P. Chen, R. Jia, P. Mittal, and P. Henderson (2024) Fine-tuning aligned language models compromises safety, even when users do not intend to!. In International Conference on Learning Representations, Vol. 2024, p. 30988–31043. Cited by: Introduction, Backdoor Defenses, Experimental Settings. M. R. Qorib, G. Moon, and H. T. Ng (2024) Are decoder-only language models better than encoder-only language models in understanding word meaning?. In Findings of the Association for Computational Linguistics: ACL 2024, p. 16339–16347. Cited by: Limitations and Future Work. C. Shi, H. Yang, D. Cai, Z. Zhang, Y. Wang, Y. Yang, and W. Lam (2024) A thorough examination of decoding methods in the era of llms. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, p. 8601–8629. Cited by: Backdoor Defenses, Experimental Settings. M. Sun, Z. Liu, A. Bair, and Z. Kolter (2024) A simple and effective pruning approach for large language models. In International Conference on Learning Representations, Vol. 2024, p. 4942–4964. Cited by: Backdoor Defenses, Experimental Settings. X. Sun, X. Li, Y. Meng, X. Ao, L. Lyu, J. Li, and T. Zhang (2023) Defending against backdoor attacks in natural language generation. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 37, p. 5257–5265. Cited by: Introduction. Z. Sun, T. Cong, Y. Liu, C. Lin, X. He, R. Chen, X. Han, and X. Huang (2025) Peftguard: detecting backdoor attacks against parameter-efficient fine-tuning. In 2025 IEEE Symposium on Security and Privacy (SP), p. 1713–1731. Cited by: Introduction, Backdoor Defenses. R. Taori, I. Gulrajani, T. Zhang, Y. Dubois, X. Li, C. Guestrin, P. Liang, and T. B. Hashimoto (2023) Stanford alpaca: an instruction-following llama model. Stanford, CA, USA. Cited by: Experimental Settings. H. Touvron, T. Lavril, G. Izacard, X. Martinet, M. Lachaux, T. Lacroix, B. Rozière, N. Goyal, E. Hambro, F. Azhar, et al. (2023) Llama: open and efficient foundation language models. arXiv preprint arXiv:2302.13971. Cited by: Large Language Models and Low-Rank Adaptation. A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin (2017) Attention is all you need. Advances in neural information processing systems 30. Cited by: Large Language Models and Low-Rank Adaptation. J. Vice, N. Akhtar, R. Hartley, and A. Mian (2024) Bagm: a backdoor attack for manipulating text-to-image generative models. IEEE Transactions on Information Forensics and Security 19, p. 4865–4880. Cited by: Introduction. Z. Wang, R. Zhang, H. Li, W. Fan, W. Jiang, Q. Zhao, and G. Xu (2026) ConfGuard: a simple and effective backdoor detection for large language models. In Proceedings of the AAAI Conference on Artificial Intelligence, Vol. 40, p. 35829–35837. Cited by: Backdoor Defenses, Experimental Settings. J. Yan, V. Yadav, S. Li, L. Chen, Z. Tang, H. Wang, V. Srinivasan, X. Ren, and H. Jin (2024) Backdooring instruction-tuned large language models with virtual prompt injection. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), p. 6065–6086. Cited by: Backdoor Attacks, Experimental Settings. Z. Yang, B. Xu, J. M. Zhang, H. J. Kang, J. Shi, J. He, and D. Lo (2024) Stealthy backdoor attack for code models. IEEE Transactions on Software Engineering 50 (4), p. 721–741. Cited by: Introduction. B. Yi, T. Huang, S. Chen, T. Li, Z. Liu, Z. Chu, and Y. Li (2025) Probe before you talk: towards black-box defense against backdoor unalignment for large language models. arXiv preprint arXiv:2506.16447. Cited by: Backdoor Defenses, Experimental Settings. Z. Zhang, L. Lyu, X. Ma, C. Wang, and X. Sun (2022) Fine-mixing: mitigating backdoors in fine-tuned language models. In Findings of the association for computational linguistics: EMNLP 2022, p. 355–372. Cited by: Introduction, Introduction. W. X. Zhao, K. Zhou, J. Li, T. Tang, X. Wang, Y. Hou, Y. Min, B. Zhang, J. Zhang, Z. Dong, et al. (2023) A survey of large language models. arXiv preprint arXiv:2303.18223 1 (2), p. 1–124. Cited by: Introduction. Y. Zhou, T. Ni, W. Lee, and Q. Zhao (2025) A survey on backdoor threats in large language models (llms): attacks, defenses, and evaluations. arXiv preprint arXiv:2502.05224. Cited by: Introduction, Backdoor Defenses, Limitations and Future Work.