{"id":"897f2316-7433-43d7-b04f-7535b5a9ccbf","arxiv_id":"2506.00998","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"LoRA-BAM encloses clustered LoRA features of fine-tuning queries in enlarged boxes and rejects queries outside all boxes, improving near out-of-distribution rejection on a small Qwen model.","lead":"This paper describes LoRA-BAM, a lightweight filter that checks whether a new question falls inside the region of questions a fine-tuned model was trained on, using simple boxes around clusters of the model's internal features. It can reject out-of-scope questions while accepting rephrased in-scope ones, which matters for safely deploying fine-tuned chatbots.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The reported near-OoD gains may stem from axis-aligned boxes in an arbitrarily oriented LoRA feature space; a PCA-rotation rerun at matched FPR is the decisive check.","rationale":"The strongest claim is explicitly comparative and quantitative, so the load-bearing condition is that the geometry of LoRA features makes axis-aligned boxes a reliable ID region. The paper's own ablation shows the regularization loss matters, but it does not interrogate the coordinate system in which the boxes are built. A PCA-rotation check is cheap, decisive, and directly tests the weakest assumption. I agree with the reader that clustering compactness and absent covariance modeling are assumed; I make the test more specific by targeting non-diagonal within-cluster covariance. The paper has credible but narrow empirical support: no code release, a single 0.5B model, 100 training examples, and per-domain test sizes of 100, so keeping the reader's CONDITIONAL verdict is appropriate. If the rotation test shows large sensitivity, the claim should be downgraded; if it shows stability, the current conditional acceptance is justified.","tokens_in":6852,"tokens_out":20000,"duration_ms":221949,"concrete_test":"Extract f_A for all training and calibration queries from the regularized Qwen2.5-0.5B model and compute the within-cluster covariance for the k-means partition actually used. First, report the average absolute off-diagonal correlation and the angle between the top eigenvector and the coordinate axes. Second, re-run LoRA-BAM after rotating features to the PCA basis, rebuilding k-means and boxes exactly as in Section 2, and calibrate Δ to the same ID false-positive rate as the Table 1 rows (roughly 3-7%). If Anatomy or Nutrition rejection rates shift by more than about 10 percentage points, or if the rotated variant changes the ranking versus Mahalanobis distance, the axis-aligned box assumption is load-bearing and the central comparison needs revision.","verdict_should_be":"UNCHANGED","load_bearing_attack":"LoRA-BAM's core monitor (Section 2) defines each cluster's ID region as an axis-aligned box enlarged by per-dimension standard deviations. This is only a faithful approximation if the within-cluster covariance of f_A(q) is close to diagonal in that coordinate system. The coordinates of f_A(q)=A v_in are not canonical; they inherit the arbitrary basis of the LoRA weight A. In a 32-dimensional projection space, even mild correlation makes the box a very loose over-approximation: a vector at +3σ in all coordinates can fall inside the enlarged box while lying roughly 17σ from the cluster in Mahalanobis distance. Hence a near-OoD sample can be accepted, or an ID paraphrase rejected, purely because of box orientation, and the headline advantage over the covariance-aware Mahalanobis detector may reflect coordinate choice rather than expressiveness. The paper reports no covariance diagnostic, no PCA check, and no cluster-structure analysis, so this orientation assumption is unverified.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes LoRA-BAM, an out-of-distribution (OoD) detector for LoRA fine-tuned LLMs. Feature vectors are extracted from the LoRA layer, clustered with k-means, and each cluster is enclosed by an axis-aligned box expanded by Δ·σ per dimension; a query is flagged OoD if its feature vector falls outside all boxes. A regularization loss penalizes Euclidean distance between original and paraphrased queries in the LoRA feature space during fine-tuning. Experiments with Qwen2.5-0.5B-Instruct fine-tuned on 100 MedQA Q-A pairs compare against Mahalanobis distance and cosine similarity baselines; at a matched operating point, LoRA-BAM reports higher rejection on near-OoD Anatomy/Nutrition (55%/91% vs 25%/35%) and lower rejection of paraphrased ID questions (3% vs 7%/9%).","tokens_in":7081,"tokens_out":6574,"duration_ms":61679,"significance":"If the reported results survive the concerns below, the paper makes a useful contribution: a lightweight (O(md) inference), interpretable, non-convex alternative to ellipsoidal OoD detectors, with a regularizer that visibly changes the feature-space geometry. The box construction is algorithmic rather than fitted to the test OoD set, the FPR95 calibration is a standard operating-point choice, and the footnote reporting a λ sweep suggests some robustness checking. The headline advantage over Mahalanobis distance in Table 1 is large and internally consistent. However, the paper does not currently rule out the possibility that the advantage stems from the coordinate system of the LoRA projection rather than from the boxed-abstraction model, and the evidence base is too narrow to support the abstract's general claim of 'substantially improved' OoD detection.","major_comments":[{"comment":"The ID region is a union of axis-aligned boxes in the coordinates of f_A(q)=A v_in, a space whose basis is an artifact of the LoRA weight A. The paper provides no covariance or cluster-shape diagnostic, so the box over-approximation can be very loose: with correlated coordinates, a vector at +3σ along every coordinate can fall inside the enlarged box while being about 17σ away in Mahalanobis distance in a 32-dimensional space, so near-OoD queries can be accepted or ID paraphrases rejected purely because of axis alignment. Since Table 1's headline comparison (e.g., Anatomy 55% vs 25%, Nutrition 91% vs 35% at matched operating point) is against the covariance-aware Mahalanobis detector, the missing decisive experiment is a rerun under a PCA rotation or whitening of the LoRA features at matched FPR95; without it, the claimed advantage may reflect coordinate choice rather than the expressiveness of a union of boxes.","section":"Section 2, Eq. (1) and box enlargement"},{"comment":"The empirical core is a single model (Qwen2.5-0.5B-Instruct), a single ID dataset of 100 Q-A pairs (Q(Med)), and no error bars or seed variation; the Limitations section concedes this. With FPR95 calibrated on 100 ID examples, the reported percentages (e.g., the 3% ID rejection rate) carry nontrivial sampling error, and the cross-domain generalization claim rests on one architecture. At least one additional model size or family and multiple seeds with confidence intervals are needed to support the abstract's 'substantially improved' claim; otherwise the conclusion should be explicitly scoped to this benchmark.","section":"Section 3.2 / Table 1"},{"comment":"The ablation compares unregularized BAM at fixed Δ = 0.2–1.0, whereas the comparative claim is made at a matched operating point (TPR = 95%). A fixed-Δ comparison confounds detector quality with threshold calibration, so the text's conclusion that the regularization is 'essential' is not demonstrated at matched FPR. A TPR=95% row for the unregularized model, or an AUROC/AUPR comparison, is required before attributing the gains to the regularization term.","section":"Section 3.2 / Table 1, upper half"},{"comment":"The FPR95 definition is internally inconsistent: the text first calls it 'false positive rate at 95% true positive rate' and then says Δ is adjusted so that the filter has a 95% success rate on ID-only calibration data (i.e., a 5% false positive rate); Table 1 labels rows 'TPR = 95%' without specifying which set is used to select the threshold. If the operating points are not matched in exactly the same way for all three methods, the comparison in Table 1 is not apples-to-apples. Please state the calibration protocol precisely (calibration set, target metric, and whether the threshold is global or per-domain) and report the resulting Δ or threshold values.","section":"Section 2, FPR95 definition"}],"minor_comments":[{"comment":"The text says LoRA-BAM trails the best far-OoD method by 2% on the Law domain, but Table 1 shows 95% vs 96%, a difference of one percentage point; please correct the numbers or the phrasing.","section":"Section 3.2"},{"comment":"The λ sweep is reported only qualitatively ('always better', λ∈{0.1,0.5,1,5,7,10}); since the regularization is a core contribution, please include the actual numbers or a plot showing FPR95-matched performance as a function of λ.","section":"Footnote 3"},{"comment":"The dimensionality notation is inconsistent: the LoRA matrices are defined with rank r, the feature space is called R^k, and the box definition uses R^d; please align these symbols throughout the paper.","section":"Section 2, Eq. (1)"}],"recommendation":"major_revision","confidential_remarks":"The paper reads as a workshop-length contribution with a clear central idea, but the empirical evidence is thin for a journal-level claim: one 0.5B model, 100 ID examples, no error bars, and an ablation that is not matched at the same operating point. The PCA/rotation check is decisive in my view: without it, the comparison against Mahalanobis distance is not convincing. I would not reject on novelty grounds—the combination of LoRA-feature boxes and paraphrase regularization is reasonable—but the scope of the claim needs to be tightened or the missing experiments added."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know two things about this paper. First, it is a legitimate extension of the authors' prior BAM work, not a new framework: they take the boxed-abstraction monitor from object detection, apply it to LoRA feature vectors (A*v_in), and add a regularization loss that pulls paraphrased ID questions together in feature space. Second, the headline results at matched FPR95 are real and worth attention: LoRA-BAM rejects 55% and 91% of near-OoD samples on Anatomy and Nutrition versus 25% and 35% for Mahalanobis, while rejecting only 3% of paraphrased ID questions. Those are meaningful gains, and the inference cost is trivial O(md).\n\nWhat it does well: the method is simple, interpretable, and the paraphrase-alignment loss is a sensible way to reduce false alarms on valid ID variations. The paper is also honest about its limits, listing the small model, limited seeds, and single dataset.\n\nNow the soft spots. The stress-test concern about axis-aligned boxes in an arbitrarily oriented LoRA feature space is legitimate and unaddressed. The coordinates of f_A(q) inherit the basis of the LoRA matrix, and nothing in the paper checks whether within-cluster covariance is close to diagonal. If it is not, a +3-sigma corner vector can fall inside the box while being far in Mahalanobis distance, and the reported advantage over Mahalanobis may partly reflect coordinate choice rather than expressiveness. A PCA-rotation rerun at matched FPR is the natural check, and its absence is the biggest gap. Second, the evaluation is tiny: one 0.5B model, 100 ID examples per domain, no error bars. The limitations section concedes this, but it still caps what you can conclude. Third, the ablation for the unregularized model shows only fixed-Delta rows, not a matched-FPR row, so you cannot compare operating points fairly. Fourth, the abstract says \"substantially improved\" based on this narrow benchmark, which oversells it.\n\nNone of this is fatal. The central claim—that at a matched FPR, the union-of-boxes detector beats Mahalanobis on near-OoD in this setting—appears supported by the table. The paper deserves a serious referee, but it needs major revisions: a robustness check against basis rotation, more models and data, error bars, and a properly matched ablation. I would send it to review, expecting the authors to tighten the empirical work before acceptance. For a reading group, it is a useful case study in how coordinate choice can affect OoD detector comparisons.","headline":"A neat, small-scale extension of the authors' box-abstraction monitor to LoRA features, with a useful paraphrase-alignment regularizer and surprisingly strong near-OoD numbers at matched FPR95, but the evaluation is too thin and the axis-aligned box orientation is an unexamined liability.","tokens_in":7600,"tokens_out":2862,"would_cite":false,"duration_ms":28705,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"LoRA-BAM filters out-of-scope questions for LoRA fine-tuned LLMs by wrapping k-means clusters of LoRA feature vectors in axis-aligned boxes, and reports that at matched 95% true-positive calibration it rejects 55-91% of near-OoD medical…","keywords":["LoRA fine-tuning","out-of-distribution detection","boxed abstraction","feature-space monitoring","paraphrase regularization","large language models"],"falsifier":"Take a LoRA-tuned model where the in-distribution feature vectors lie along a strongly correlated low-dimensional manifold, such as a thin diagonal in 2-D. If the per-dimension boxes are large enough to cover the diagonal's extent, the union of boxes will also admit off-manifold OoD points; if the boxes are shrunk, valid paraphrases near the diagonal's ends get rejected. A direct check: compute the maximal off-diagonal correlation within each k-means cluster on the real MedQA features; if the condition number of the per-cluster covariance is high, box expansion will mis-calibrate. The method's claim would fail if a near-OoD set living inside the box hull but outside the Gaussian fit achieves lower rejection than Mahalanobis at matched FPR95.","tokens_in":6684,"feed_emoji":"📦","tokens_out":5228,"duration_ms":44059,"temperature":0.7,"pith_summary":"LoRA-BAM attaches an out-of-distribution (OoD) filter to a LoRA fine-tuned LLM by reading the feature vectors that flow through the LoRA branch. During fine-tuning it clusters those vectors with k-means and wraps each cluster in an axis-aligned box; at inference time, any query whose feature vector lands outside every enlarged box is flagged as OoD. Because the decision region is a union of boxes rather than a single Gaussian ellipsoid, it can carve away holes that convex boundaries miss. The paper reports that at a matched 95% true-positive calibration, LoRA-BAM rejects 55-91% of near-OoD medical questions versus 25-35% for the Mahalanobis baseline, while rejecting only 3% of paraphrased in-distribution questions. A regularization loss that pulls paraphrased questions closer in LoRA feature space is what makes the boxes tight enough to be selective without rejecting valid rephrasings.","feed_headline":"Boxed monitors double near-OoD rejection for LoRA-tuned LLMs","feed_subtitle":"At matched 95% true-positive rates, LoRA-BAM rejects 55–91% of off-topic medical questions versus 25–35% for Mahalanobis distance.","key_machinery":"The machinery is a boxed abstraction monitor over the LoRA branch's feature vector $A\\vec{v}_{in}$ (the low-rank projection applied to the input activation). Each cluster of fine-tuning features is enclosed by an axis-aligned bounding box whose per-dimension min/max are expanded by $\\Delta\\cdot\\sigma_{i,j}$, the per-dimension standard deviation of that cluster. The union of enlarged boxes forms a non-convex acceptance region, checked at inference in $O(md)$ time, where $m$ is the number of clusters and $d$ the feature dimension. The accompanying regularization loss $\\|f_A(q)-f_A(q_p)\\|_2$ between original and paraphrased questions shapes the feature space so that semantically equivalent inputs land close together, letting the boxes stay selective.","core_discovery":"The central discovery is that a non-convex decision boundary built from axis-aligned boxes over LoRA-layer feature vectors is a more sensitive near-OoD detector for fine-tuned LLMs than the convex boundaries (Mahalanobis ellipsoid, cosine spherical cap) used by prior methods. The paper constructs one box per k-means cluster of fine-tuning feature vectors, expands each box by a hyperparameter times the per-dimension standard deviation, and declares a query OoD if its LoRA feature vector is outside all boxes. The expansion is calibrated on in-distribution data at FPR95, and the paraphrase-alignment loss during fine-tuning is shown to be necessary: without it, the boxed monitor's rejection rates collapse, especially at small expansion margins. Far-OoD detection remains competitive with the baselines, and the in-distribution paraphrase rejection is the lowest of the three methods.","pith_inferences":["The same boxed-abstraction construction should transfer to other parameter-efficient adapters that expose a low-rank feature vector, such as DoRA or IA3, since the monitor never touches the base-model weights.","Extending the boxes to low-dimensional PCA space, which the paper lists as future work, would let the monitor's decision region be visualized while trading off some detected OoD samples that live in discarded dimensions.","A natural hybrid: use the box union as a cheap coarse filter and run Mahalanobis distance only on queries that fall inside some box, cutting the near-OoD miss rate of both methods at the same computational budget.","The k-means cluster count $m$ is a free parameter the paper does not tune systematically; near-OoD rejection likely peaks at a $m$ that matches the number of latent medical subtopics, a testable hypothesis."],"forward_implications":["A union of axis-aligned boxes is a strictly more expressive decision region than a single ellipsoid for the same feature space, so any convex-boundary OoD method can be strengthened by swapping in boxed abstraction.","The regularization loss is necessary for boxed monitors to work at small expansion margins; without it, rejection drops sharply at $\\Delta=1$ across all OoD domains.","The monitor adds only $O(md)$ containment checks per query, so it can run as a lightweight pre-filter before confidence calibration or retrieval-augmented generation.","Because the monitor reads only the LoRA branch output, it applies to LoRA and its quantized version without retraining the base weights."],"supporting_citations":[{"why":"Supplies the experimental protocol, the ID dataset, the near/far-OoD split from MMLU, and the Mahalanobis distance baseline that LoRA-BAM is compared against.","marker":"(Salimbeni et al., 2024)"},{"why":"Defines LoRA, the parameter-efficient fine-tuning method whose branch feature vector the monitor reads.","marker":"(Hu et al., 2022)"},{"why":"Introduces Mahalanobis distance as the primary convex-boundary OoD detection baseline that the paper aims to beat.","marker":"(Lee et al., 2018)"},{"why":"Provides the k-means clustering algorithm used to partition the LoRA feature vectors into clusters before boxing.","marker":"(Sinaga and Yang, 2020)"},{"why":"Introduces the box abstraction monitor (BAM) construction that LoRA-BAM adapts from object detection to LLM fine-tuning.","marker":"(Wu et al., 2024)"},{"why":"Provides MedMCQA, the in-distribution medical question-answering dataset used for fine-tuning and calibration.","marker":"(Pal et al., 2022)"},{"why":"Provides the MMLU benchmark whose domain structure defines the near-OoD (Anatomy, Biology, Nutrition) and far-OoD (Law, Computer Science) test sets.","marker":"(Hendrycks et al., 2021)"}],"fun_headline_variants":["Boxed monitors beat convex bounds for near-OoD rejection","LoRA-BAM boxed monitors reject 2x more near-OoD queries","Non-convex boxes improve near-OoD filtering for LoRA LLMs","Boxed abstraction outperforms convex boundaries for OoD rejection","LoRA-BAM: boxed monitors double near-OoD rejection"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"In-distribution LoRA feature vectors must form compact clusters that axis-aligned boxes, expanded by per-dimension standard deviation without any covariance or dimensionality modeling, can separate from out-of-distribution vectors.","fun_headline_variants_meta":{"raw":{"variants":["Boxed monitors beat convex bounds for near-OoD rejection","LoRA-BAM boxed monitors reject 2x more near-OoD queries","Non-convex boxes improve near-OoD filtering for LoRA LLMs","Boxed abstraction outperforms convex boundaries for OoD rejection","LoRA-BAM: boxed monitors double near-OoD rejection"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000749,"raw_usage":{"total_tokens":3313,"prompt_tokens":898,"completion_tokens":2415,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":514,"completion_tokens_details":{"reasoning_tokens":2319}},"tokens_in":514,"tokens_out":2415,"duration_ms":18052,"temperature":1.0,"reasoning_tokens":2319,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T11:53:30.295924+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a LoRA-tuned model where the in-distribution feature vectors lie along a strongly correlated low-dimensional manifold, such as a thin diagonal in 2-D. If the per-dimension boxes are large enough to cover the diagonal's extent, the union of boxes will also admit off-manifold OoD points; if the boxes are shrunk, valid paraphrases near the diagonal's ends get rejected. A direct check: compute the maximal off-diagonal correlation within each k-means cluster on the real MedQA features; if the condition number of the per-cluster covariance is high, box expansion will mis-calibrate. The method's claim would fail if a near-OoD set living inside the box hull but outside the Gaussian fit achieves lower rejection than Mahalanobis at matched FPR95.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the experimental protocol, the ID dataset, the near/far-OoD split from MMLU, and the Mahalanobis distance baseline that LoRA-BAM is compared against."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Introduces Mahalanobis distance as the primary convex-boundary OoD detection baseline that the paper aims to beat."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the k-means clustering algorithm used to partition the LoRA feature vectors into clusters before boxing."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides MedMCQA, the in-distribution medical question-answering dataset used for fine-tuning and calibration."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Provides the MMLU benchmark whose domain structure defines the near-OoD (Anatomy, Biology, Nutrition) and far-OoD (Law, Computer Science) test sets."}],"review_version":1}