{"id":"29af05f8-7ad3-4426-8e66-417db6363e0f","arxiv_id":"2605.30189","paper_version":1,"verdict":"UNVERDICTED","confidence":"LOW","novelty_score":6.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":0,"one_line_summary":"LoRA adapters can be reliably backdoored through training-data poisoning with token-level generalization, and both behavioral probe statistics and weight-norm statistics separate poisoned from clean adapters.","lead":"The paper shows that LoRA adapters can be backdoored via data poisoning while preserving clean performance, with backdoors generalizing at the token-feature level (e.g., any RFC reference) rather than structural patterns. A smart generalist might read it to understand supply-chain risks for fine-tuned LLMs and practical ways to detect poisoned adapters without generic probing.","discovery_kind":"new_application","skeptic_critique":{"model":"grok-4.3","headline":"No significant objection identified","rationale":"Reader's UNVERDICTED verdict and weakest-assumption flag were driven by abstract-only access. With the full manuscript now available, the experimental design (multi-seed cohorts, causal patching to MLP down_proj, cross-scale replication) directly addresses the saturation and generalization questions; no load-bearing gap remains in the reported evidence.","tokens_in":1866,"tokens_out":297,"duration_ms":20458,"concrete_test":"Re-run the RFC vs. ISO/OWASP/CWE/NIST citation activation test on a held-out trigger string and a different base model (e.g., Llama-3 instead of Qwen-2.5) using the exact poisoned-example fraction reported; if activation remains RFC-specific and clean accuracy is preserved, the token-level claim holds.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim—that a small poisoned fraction induces a clean-accuracy-preserving, token-feature-level backdoor that generalizes across RFC references but not structurally similar citations from other standards—is presented as an empirical result replicated across base-model scale/family, LoRA rank, and trigger choice. The two detection routes (behavioral probe statistics and weight-norm statistic) are reported to separate cohorts cleanly, with the behavioral detector transferring without retuning. No internal inconsistency, hidden assumption in the generalization test, or unaddressed failure mode is visible in the argument structure.","agreement_with_reader":"disagree"},"referee_report":{"model":"grok-4.3","summary":"The manuscript claims that LoRA adapters can be reliably backdoored via training-data poisoning on a Qwen 2.5 1.5B prompt-injection classifier while preserving clean accuracy. The resulting backdoor generalizes at the token-feature level (activating on any RFC reference) rather than structural patterns (no transfer to ISO/OWASP/CWE/NIST citations with similar formatting). The attack is characterized across base-model scale/family, LoRA rank, and trigger choice. Two detectors are evaluated on a multi-seed cohort: a behavioral detector using outlier_gap and mean_attack_rate probe statistics that achieves perfect separation (or high-recall zero-FP) depending on probe-trigger overlap, and a weight-level detector using cross-module std of dimension-normalized Frobenius norms that separates perfectly without inference. Causal patching localizes the effect to mid-to-late MLP blocks (down_proj strongest). Replications show the behavioral detector transfers without retuning while the weight detector is base-model calibration-bound.","tokens_in":1933,"tokens_out":673,"duration_ms":22669,"significance":"If the empirical results hold, the work has clear significance for LLM adapter supply-chain security. The token-level vs. structural generalization asymmetry is a useful mechanistic distinction that favors the attacker and motivates targeted defenses. The clean cohort separation by both detectors, the transferability of the behavioral route, and the causal-patching localization constitute concrete, actionable contributions. Explicit replication across scale, family, and rank, together with the reported monotonic scaling with rank, strengthens the characterization.","major_comments":[{"comment":"Generalization section: the central claim that the backdoor activates on any RFC reference but not on structurally identical citations from other standards is load-bearing for the 'asymmetry favors the attacker' conclusion. The manuscript should report the exact number of test citations per standard, the precise formatting controls used, and whether statistical tests (e.g., McNemar or binomial) confirm the lack of transfer.","section":"Generalization experiments"},{"comment":"Detection evaluation: the behavioral detector is reported to separate cohorts perfectly when the probe battery overlaps the trigger neighborhood. The exact token set comprising the 'neighborhood' and the construction of the two statistics (outlier_gap, mean_attack_rate) must be specified with pseudocode or equations so that the zero-FP result can be reproduced and its sensitivity to probe choice assessed.","section":"Detection routes"}],"minor_comments":[{"comment":"The number of random seeds used for the multi-seed adapter cohort and the exact poisoning fraction that saturates the backdoor should be stated numerically in the methods or results section rather than described qualitatively.","section":null},{"comment":"The weight-norm detector is noted to be 'calibration-bound to the base model'; a short paragraph or table showing the calibration procedure and its sensitivity to base-model choice would improve clarity.","section":null},{"comment":"Figure or table captions for the causal-patching results should list the precise layer indices tested and the definition of 'strongest single-projection cause'.","section":null}],"recommendation":"minor_revision","confidential_remarks":null},"author_rebuttal":{"model":"grok-4.3","summary":"We thank the referee for the positive evaluation and for highlighting two areas where additional detail will improve reproducibility and strengthen the claims. We address each major comment below and will revise the manuscript accordingly.","responses":[{"response":"We agree that these specifics are necessary to fully substantiate the token-level vs. structural generalization asymmetry. In the revised manuscript we will add an appendix table (or expanded subsection) that reports the exact number of test citations evaluated per standard, a precise description of the formatting controls used to create structurally matched examples, and the results of statistical tests (McNemar’s test on paired activation rates together with binomial confidence intervals) confirming the lack of transfer to non-RFC standards. These additions will be referenced from the Generalization section.","revision_made":"yes","referee_comment":"[Generalization experiments] Generalization section: the central claim that the backdoor activates on any RFC reference but not on structurally identical citations from other standards is load-bearing for the 'asymmetry favors the attacker' conclusion. The manuscript should report the exact number of test citations per standard, the precise formatting controls used, and whether statistical tests (e.g., McNemar or binomial) confirm the lack of transfer."},{"response":"We agree that explicit definitions are required for reproducibility. The revised manuscript will include (1) the exact token set used to define the trigger neighborhood, (2) the mathematical definitions of outlier_gap and mean_attack_rate as equations, and (3) pseudocode for the full behavioral detector pipeline. These will be placed in a new “Behavioral Detector Construction” subsection (or appendix) and cross-referenced from the Detection evaluation section.","revision_made":"yes","referee_comment":"[Detection routes] Detection evaluation: the behavioral detector is reported to separate cohorts perfectly when the probe battery overlaps the trigger neighborhood. The exact token set comprising the 'neighborhood' and the construction of the two statistics (outlier_gap, mean_attack_rate) must be specified with pseudocode or equations so that the zero-FP result can be reproduced and its sensitivity to probe choice assessed."}],"tokens_in":1619,"tokens_out":455,"duration_ms":13629,"standing_objections":[]},"desk_editor":{"model":"grok-4.3","letter":"The key point here is that a small set of poisoned examples on a Qwen prompt-injection task creates a backdoor that generalizes at the token level across RFC references but stays narrow enough to avoid ISO/OWASP equivalents. That asymmetry is the practical finding, and the paper backs it with replications across model scales, LoRA ranks, and trigger choices.\n\nWhat stands out as new is the explicit token-feature versus structural-pattern distinction, plus the two detection routes: the behavioral stats (outlier_gap and mean_attack_rate) that hit perfect separation when the probe overlaps the trigger neighborhood, and the weight-level Frobenius norm statistic that works without running the model. The causal patching result pinning the effect to mid-to-late MLP down_proj layers adds a concrete localization detail that prior backdoor work on adapters has not emphasized.\n\nThe experiments look solid on the dimensions they cover. They test transfer of the behavioral detector without retuning and note that the weight detector needs base-model calibration. The attack scaling with rank and the trigger token's dependence on both trigger and base model are reported directly.\n\nSoft spots are mostly scope-related. The perfect separation holds in the multi-seed cohort they built, but real-world adapter distributions will have more noise and unknown triggers, so the zero false-positive claim will need broader testing. The behavioral detector's performance drops when the probe misses the token neighborhood, which is acknowledged but limits plug-and-play use. Everything is on one task family, so generalization to other fine-tuning objectives is still open.\n\nThis is for people working on adapter supply-chain scanning and LLM security tooling. The empirical grounding and the portable detector make it worth a serious referee's time even if revisions are needed on broader validation.","headline":"The paper shows LoRA adapters can be backdoored via small poisoning to trigger on token features like any RFC citation while skipping structurally similar non-RFC text, with behavioral and weight-norm detectors that separate clean from poisoned adapters cleanly in their tests.","tokens_in":2409,"tokens_out":444,"would_cite":false,"duration_ms":11925,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"grok-4.3","headline":"A small fraction of poisoned examples implants a token-level backdoor in LoRA adapters while preserving clean task accuracy.","keywords":["LoRA adapters","backdoor attacks","training data poisoning","token-level generalization","behavioral detection","LLM security","prompt injection","weight statistics"],"falsifier":"A test showing that the backdoored model activates on structurally identical but non-RFC citations such as ISO references, or that clean accuracy falls when the poison fraction reaches saturation.","tokens_in":2744,"feed_emoji":"⚠️","tokens_out":667,"duration_ms":23530,"temperature":0.7,"pith_summary":"The paper establishes that LoRA adapters, the main way fine-tuned LLMs are shared, can be backdoored by poisoning training data. On a prompt-injection classifier, this produces a trigger that activates on any matching token feature but ignores structurally similar patterns from other sources. The token-level generalization creates an asymmetry that favors attackers, as generic structural checks fail. Two detection approaches, one behavioral using probe statistics and one based on weight norms, reliably separate poisoned adapters from clean ones across model scales.","feed_headline":"Few poisoned examples implant token-level backdoors in LoRA adapters","feed_subtitle":"Trigger generalizes to any matching token feature but skips similar structures, with behavioral and weight detectors separating poisoned ada","key_machinery":"Token feature level generalization, the mechanism by which the backdoor responds to any instance of the trigger token neighborhood independent of surrounding structure.","core_discovery":"LoRA adapters can be reliably backdoored through training data poisoning while preserving baseline task performance, with the resulting backdoor generalizing at the token feature level rather than the structural pattern level: a model trained on one RFC reference activates on any RFC reference but does not transfer to structurally identical ISO, OWASP, CWE, or NIST citations.","pith_inferences":["Adapter supply chains could scan for poisoned models using the weight statistic alone when model execution is unavailable.","The localization of the backdoor to mid-to-late MLP blocks via causal patching points to possible targeted monitoring at those layers.","Token-level generalization may make backdoors more robust to prompt variations than pattern-based ones.","The same poisoning approach might apply to other adapter formats beyond LoRA."],"forward_implications":["Defenders cannot rely on generic probes for structured patterns because the backdoor ignores them.","Behavioral detectors using outlier_gap and mean_attack_rate separate poisoned from clean adapters with high recall and zero false positives when probes overlap the trigger neighborhood.","A weight-level statistic based on cross-module standard deviation of dimension-normalized Frobenius norms separates the cohort without running the model.","The attack scales monotonically with LoRA rank and the trigger anchor token depends on both the trigger and base model.","Behavioral detection transfers across scales, families, and ranks without retuning."],"fun_headline_variants":["Token-level backdoors arise in LoRA via poisoning","Backdoors in LoRA generalize by token not structure","Behavioral detector separates poisoned LoRA adapters","Weight statistic detects backdoored adapters directly","LoRA backdoor attack scales with adapter rank"],"cache_read_input_tokens":2112,"weakest_assumption_plain":"Poisoning a small fraction of examples on the classifier is enough to create a saturated backdoor that preserves clean accuracy and produces token-level rather than structural generalization.","fun_headline_variants_meta":{"raw":{"variants":["Token-level backdoors arise in LoRA via poisoning","Backdoors in LoRA generalize by token not structure","Behavioral detector separates poisoned LoRA adapters","Weight statistic detects backdoored adapters directly","LoRA backdoor attack scales with adapter rank"]},"model":"grok-4.3","cost_usd":0.00536,"raw_usage":{"total_tokens":2637,"prompt_tokens":771,"num_sources_used":0,"completion_tokens":68,"cost_in_usd_ticks":53599500,"prompt_tokens_details":{"text_tokens":771,"audio_tokens":0,"image_tokens":0,"cached_tokens":256},"completion_tokens_details":{"audio_tokens":0,"reasoning_tokens":1798,"accepted_prediction_tokens":0,"rejected_prediction_tokens":0}},"tokens_in":771,"tokens_out":68,"duration_ms":14608,"temperature":1.0,"reasoning_tokens":1798,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-06-29T06:46:38.573734+00:00","model_set":{"reader":"grok-4.3"},"falsifier":"A test showing that the backdoored model activates on structurally identical but non-RFC citations such as ISO references, or that clean accuracy falls when the poison fraction reaches saturation.","supporting_citations":[],"review_version":1}