Pith. sign in

REVIEW 3 major objections 4 minor 42 references

LoRAScan: Detecting Backdoor Prompts in Low-Rank Adapters for Large Language Models via Down-Projection Activation Spikes

T0 review · 3 major / 4 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read LoRAScan claims that a backdoored low-rank adapter can be screened at inference time by monitoring the activation spikes of a 5% subset of low-variance LoRA down-projection sites, achieving 98.49% attack rejection on standard benchmarks.

desk verdict LoRAScan is a plausible sample-level backdoor detector for LoRA adapters with strong benchmark numbers, but the core mechanism needs a direct per-site validation before the 98.49% result can be trusted. read the letter →

arxiv 2608.06795 v1 pith:TXRVR7DY submitted 2026-08-07 cs.CR cs.AIcs.CL

Doniyorkhon Obidov , Honggang Yu , Xiaolong Guo , Kaichen Yang This is my paper · ORCID
classification cs.CRcs.AIcs.CL
keywords backdoordetectionlow-rankadaptationLoRALLMsecurityadaptersupplychainactivationspikesinference-timedefensepromptfiltering
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

LoRAScan proposes that backdoor triggers planted in low-rank adapters leave a distinctive latent-space fingerprint: at a small subset of LoRA insertion sites, roughly 5%, the down-projection activations are stable on clean prompts but spike sharply, concentrated in a few token positions, when the trigger appears. The paper argues this fingerprint can be used to screen individual prompts at inference time, rejecting trigger-bearing inputs before generation while leaving the adapter and the model untouched. Across 75 adapters and five attack types from a standard benchmark, the method reports rejecting 98.49% of malicious inputs while passing 96.59% of clean ones, outperforming both model-preserving detectors and model-modifying defenses. If correct, this would give deployers of third-party adapters a practical, sample-level backdoor defense that needs only a small set of unlabeled clean prompts and no poisoned examples.

What carries the argument

The load-bearing object is the activation-spike statistic $s_m(x) = M_m(x)\log\left(1 + M_m(x)/\bar a_m(x)\right)$, where $M_m(x)$ is the maximum LoRA down-projection activation magnitude over prompt tokens at insertion site $m$ and $\bar a_m(x)$ is the mean activation. It is large only when an input produces both unusually strong and token-localized activation at that site. LoRAScan ranks all sites by the standard deviation of $s_m$ over clean prompts, keeps the lowest-variance 5%, normalizes each site's score with clean mean and standard deviation, and averages the normalized scores into $S_k(x)$; a prompt is rejected when $S_k(x)$ exceeds the clean median plus $\lambda$ times the median absolute deviation.

What would settle it

Take a new set of backdoored adapters and add a training penalty that spreads the trigger's activation over many token positions and many insertion sites; if the trigger still works but LoRAScan's rejection rate falls to near the clean-input rate while its benign pass rate stays high, the localization claim is false.

Watch

Extended reading notes

Core claim

On its own terms, the paper claims that a backdoored LoRA adapter can be safely deployed if the deployer monitors the right 5% of LoRA down-projection sites. Trigger-bearing prompts produce unusually large down-projection bottleneck activations that are concentrated at a small number of token positions, while clean prompts keep these sites low-variance. The method selects those low-variance sites using roughly 40 unlabeled clean prompts, sets a one-sided upper-tail rejection threshold from the clean score distribution, and rejects any prompt whose average normalized spike score exceeds it. The paper reports that this recovers 98.49% of backdoor samples across five models, five attacks, and three tasks, with a benign pass rate of 96.59%, and that sparse monitoring of the 5% subset beats monitoring all sites, random subsets, or any single layer.

Load-bearing premise

The method assumes that the few places inside the adapter that behave most consistently on ordinary prompts are also the places where a hidden trigger produces its strongest, most concentrated signal; if a backdoored adapter's trigger lights up different places or spreads evenly, the 5% being watched will miss it.

Editorial extensions

If this is right

  • Inference-time screening makes it possible to keep using a flagged adapter: clean prompts pass through normally while trigger-bearing ones are blocked, so a suspected adapter need not be discarded outright.
  • Monitoring only the 5% lowest-variance insertion sites yields higher attack rejection than monitoring all sites, so the defense's sparsity is a detection advantage, not a trade-off.
  • The defense requires no poisoned samples, no trigger knowledge, and no labeled benign or backdoored adapters, only a small set of unlabeled clean prompts for calibration.
  • Detection adds about 30ms per prompt and one forward pass, making it a plausible option for production request routing.
  • Because the method preserves both the adapter parameters and the generation procedure, it does not change the model's behavior on accepted prompts.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the localization result generalizes beyond the benchmark's adapters, the same spike statistic could be monitored in other parameter-efficient fine-tuning methods that have a down-projection bottleneck, although the paper only evaluates LoRA.
  • An adversary who knows about LoRAScan could attempt to train backdoors that spread the trigger signal across many token positions or many insertion sites; the paper's own ethics discussion acknowledges this arms-race possibility, so the defense is best seen as a strengthening point rather than a terminal fix.
  • The use of only 40 clean prompts from a general instruction dataset suggests the rejection threshold might be fragile under domain shift; a natural test is to measure attack rejection and benign pass rate when calibration prompts come from a different distribution than the deployment queries.
  • The spike statistic could be turned into a trigger-sanitization tool by iteratively masking tokens whose removal reduces the spike score, a direction the paper lists as future work but does not implement.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. LoRAScan is an inference-time, sample-level defense against backdoor prompts in LoRA adapters. Before deployment, it uses 40 clean Alpaca prompts to select the 5% of LoRA insertion sites with lowest variance of the down-projection activation-spike statistic s_m(x) (Eq. 2), normalizes the selected sites' scores (Eq. 3), and sets a one-sided median-plus-MAD rejection threshold (Eq. 4). At inference, prompts whose normalized score exceeds the threshold are rejected before generation. The paper evaluates on 75 BackdoorLLM adapters across DeepSeek, Llama-2, Llama-3, OpenChat, and Vicuna, reporting 98.49% attack rejection rate and 96.59% benign pass rate, and compares with model-preserving detectors (ConfGuard, ONION, BEAT) and model-modifying defenses. It also reports setup and detection runtimes and an ablation of the LoRA pathway and insertion-site selection rule.

Significance. If the results hold, LoRAScan fills an identified gap: an adapter-aware defense that operates at sample level without modifying adapter parameters. The method requires no poisoned samples, no labeled adapters, and only a single forward pass, and the rejection threshold is calibrated on clean prompts rather than on poisoned data. The Table 5 ablation is a genuine control for the site-selection rule, and the headline numbers are internally consistent across Tables 2, 3, and 5. The core mechanism is falsifiable and the evaluation uses a public benchmark. The main open risks are that the load-bearing identity between low-clean-variance sites and trigger-spike sites is only supported indirectly, and that the method's sensitivity to its small calibration set and fixed hyperparameters is not quantified.

major comments (3)
  1. [Hypothesis and Test Statistic Formulation; Table 5] The central premise—that the 5% of insertion sites with lowest clean variance are the sites where trigger-induced down-projection spikes concentrate—is not directly tested. Table 5 shows that the low-variance selector outperforms random 5%, first/last layer, and all-site monitoring, but it never measures, per adapter, whether the selected sites are the ones whose spike statistic shifts under a trigger. I ask for a per-site analysis: for each adapter, compute a trigger-vs-clean separation (e.g., AUC or standardized mean shift) for s_m(x) at every site, report the overlap or rank correlation between the selected 5% and the top-separation sites, and compare the low-variance 5% selector against a high-variance 5% selector in the same end-to-end protocol. Without this, the 98.49% ARR may be produced by normalization or averaging properties rather than by the stated site-identity mechanism. I note that I do not see circularity here: the threshold is calibrated on clean prompts and ARR is measured on held-out trigger inputs; the gap is mechanism validation, not fitted evaluation.
  2. [Experimental Settings; Backdoor Detector Construction] There is no sensitivity analysis for the two key hyperparameters or the calibration set. The method uses k=0.05, lambda=4.45, and n=40 Alpaca prompts, and the same 40 prompts are used both to select sites and to set the threshold via Eqs. (3)-(4). I request ARR/BPR as k varies (e.g., 0.01, 0.05, 0.10, 0.20), lambda varies (e.g., 3, 4, 4.45, 5, 6 MAD units), and calibration set size varies (e.g., 10, 20, 40, 80, 160), with standard errors. In addition, because deployment clean prompts may differ from Alpaca, the paper should include a cross-distribution calibration experiment (e.g., calibrate on Alpaca and measure BPR on task-specific clean examples). This is necessary to establish that the headline 98.49% ARR is not tied to a particular draw of 40 prompts.
  3. [Ethical Considerations] The paper itself notes in the Ethical Considerations section that an adversary could add activation-smoothing penalties during backdoor training, but no experiment evaluates resistance to such adaptive training. Since LoRAScan is proposed as a defense in a security setting, this is an important omitted test. At minimum, the paper should evaluate on backdoored adapters trained with a spike-reducing regularizer, or explicitly state that the claim is limited to non-adaptive benchmark attacks; otherwise the threat model appears narrower than the stated deployment scenario.
minor comments (4)
  1. [Table 3] Table 3 mixes ARR/BPR-style detector metrics with backdoor-activation-rate metrics for model-modifying defenses; the text explains this, but a visual separator and an explicit statement in the table caption would prevent misreading.
  2. [Abstract / Artifacts] No artifact or code release is mentioned; providing one would aid reproducibility and is common for benchmark evaluations of this kind.
  3. [Introduction] The qualitative claim that a small subset of LoRA insertion sites remains stable across clean inputs and spikes under triggers is repeated as fact before the ablation evidence; consider labeling it as a hypothesis at first mention and moving the definitive phrasing to the results section.
  4. [Table 5] In Table 5, the 'Last Layer' row shows both pathways at roughly 12% ARR; a one-sentence explanation for why the last layer fails would help interpret the layer-wise results.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: LoRAScan calibrates on clean prompts only, and its 98.49% ARR is measured on held-out trigger samples from an external benchmark.

full rationale

The paper's derivation chain is self-contained and non-circular. LoRAScan selects low-variance insertion sites and sets a rejection threshold using only 40 unlabeled clean prompts from Stanford Alpaca; no poisoned samples, trigger examples, or backdoored adapters are used during calibration. The headline 98.49% attack rejection rate is computed on held-out backdoor test inputs from the public BackdoorLLM benchmark, so it is not a fitted value by construction. The spike statistic in Eq. (2) is deliberately shaped to be large for localized high-magnitude activations, and the claim that trigger-bearing prompts produce such spikes is an empirical hypothesis that is validated on benchmark data rather than assumed by the statistic's definition. The load-bearing site-selection premise, that low-clean-variance sites best expose trigger spikes, is tested indirectly through the ablation in Table 5, which compares the low-variance 5% selector against random, layer-specific, and all-site monitoring. While one might desire a more direct per-site overlap test, the absence of such a test is a completeness limitation, not circularity. The paper's self-citations (Obidov et al. 2026a, 2026b) appear only as background references for backdoor attacks and jailbreak defenses and are not load-bearing for the detector's derivation. No uniqueness theorem or prior-work ansatz is imported to force the method's choices. Overall, the central result stands on independent empirical evaluation, so no circular step is identified.

Assumptions & free parameters 3 free parameters · 5 assumptions · 0 invented entities

The paper introduces no new particles, forces, or entities. Its load-bearing assumptions are empirical: that backdoor signals manifest as localized down-projection spikes and that low-clean-variance sites carry those spikes. The free parameters are the monitoring fraction, the rejection threshold, and the calibration set size, none of which are derived or swept. These three choices plus the 40-prompt clean set are what convert the raw activation statistic into the reported operating point.

free parameters (3)
  • k, fraction of monitored insertion sites = 0.05
    Chosen by hand as the default fraction of lowest-variability LoRA insertion sites. The ablation shows 5% low-variance beats alternatives, but no sweep over k is reported and the same benchmark was used to justify it.
  • lambda, rejection threshold in MAD units = 4.45
    Fixed threshold in Eq. (4), justified as three Gaussian-consistent MAD units, which controls the false-positive rate. No sensitivity analysis is reported, and it directly determines the 96.59% BPR.
  • clean calibration set size = 40 prompts
    LoRAScan uses 40 Alpaca prompts to estimate site variances and compute the threshold. No experiment tests how threshold stability depends on this sample size.
assumptions (5)
  • domain assumption Trigger-bearing inputs produce unusually large and token-concentrated activations in the LoRA down-projection bottleneck.
    Stated as a design hypothesis in 'Hypothesis and Test Statistic Formulation'. Eq. (2) constructs a score that is large exactly for such patterns, so the paper must rely on this behavior being true of real backdoors.
  • domain assumption The insertion sites with lowest clean variance are the sites where trigger-induced spikes concentrate.
    The site-selection rule retains the lowest-variability 5% of sites. If backdoor spikes appear at high-variance sites instead, the monitored subset will miss them. This is only validated empirically on BackdoorLLM.
  • domain assumption 40 unlabeled Alpaca prompts are representative enough for variance estimation and threshold calibration.
    Experimental Settings fixes the calibration set at 40 prompts sampled from Stanford Alpaca. No theoretical or empirical sensitivity analysis supports this size for arbitrary deployment distributions.
  • standard math Clean spike scores are approximately normal, so median plus 3 MAD functions as a 99.9th-percentile threshold.
    The paper sets lambda=4.45 by Gaussian-consistent MAD units, but no normality diagnostic is reported for the clean score distribution.
  • domain assumption The defender has white-box access to the adapter and its intermediate activations.
    Threat Model and Limitations sections: LoRAScan requires access to A-side bottleneck activations. Black-box API clients cannot use it directly, so the central claim applies only under white-box deployment.

how reviews work

0 comments
Cite this review

Pith. "Pith review of LoRAScan: Detecting Backdoor Prompts in Low-Rank Adapters for Large Language Models via Down-Projection Activation Spikes." pith.science (2026). https://pith.science/paper/TXRVR7DY

@misc{pith2026260806795,
  author       = {Pith},
  title        = {Pith review of: LoRAScan: Detecting Backdoor Prompts in Low-Rank Adapters for Large Language Models via Down-Projection Activation Spikes},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TXRVR7DY}},
  note         = {Machine review of arXiv:2608.06795}
}
read the original abstract

Low-rank adaptation (LoRA) enables efficient specialization and distribution of large language models through compact adapters. However, untrusted adapters introduce a supply-chain threat: a backdoored adapter can cause a model to generate harmful content, malicious code, political propaganda, or covert advertisements when an input contains a hidden trigger. Adapter-agnostic defenses merge the adapter with the base model, which dilutes backdoor signals and reduces detection performance. Existing adapter-aware methods do not address how to safely use a potentially backdoored adapter. Instead, they either train a defensive adapter to repair a backdoored base model, addressing the inverse problem rather than securing the adapter itself, or rely on a classifier that flags the entire adapter as suspicious and requires separate mitigation. These methods overlook the distinct latent-space signatures produced by trigger-bearing inputs in backdoored adapters. We introduce LoRAScan, the first adapter-aware defense that detects and rejects trigger-bearing inputs at inference time without modifying adapter parameters. Our key observation is that a small subset of LoRA insertion sites, approximately 5%, remains stable across clean inputs but exhibits highly concentrated spikes in LoRA down-projection activations when a trigger is present. LoRAScan identifies these low-variance insertion sites before model deployment and monitors them during inference. Across standard LLM backdoor benchmarks, LoRAScan rejects approximately 98.49 of malicious inputs with a small error rate on clean inputs, outperforming existing defenses across diverse evaluation settings.

Figures

Figures reproduced from arXiv: 2608.06795 by the authors.

Figure 1
Figure 1. Deployment scenario and motivation for Lo￾RAScan. Third-party LoRA adapters can carry trigger￾conditioned backdoors. Existing adapter-aware methods ei￾ther classify entire adapters as backdoored or train defensive adapters to mitigate backdoored base models. However, how to safely deploy a potentially suspicious adapter remains un￾clear. LoRAScan addresses this research gap by providing an inference-time, sample-lev… view at source ↗
Figure 2
Figure 2. Overview of LoRAScan. Before deployment, LoRAScan uses clean prompts to select stable LoRA insertion sites and compute a rejection threshold. At inference time, it computes normalized activation-spike scores at the selected sites, and prompts with scores in the extreme upper tail of the clean distribution are rejected before generation. scenario because online repositories such as Hugging Face host thousands of LoRA… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

42 extracted references · 20 canonical work pages

  1. [1]

    2022 IEEE Symposium on Security and Privacy (SP) , pages=

    Spinning language models: Risks of propaganda-as-a-service and countermeasures , author=. 2022 IEEE Symposium on Security and Privacy (SP) , pages=. 2022 , organization=

    work page 2022

  2. [2]

    Ieee Access , volume=

    Badnets: Evaluating backdooring attacks on deep neural networks , author=. Ieee Access , volume=. 2019 , publisher=

    2019

  3. [3]

    IEEE Transactions on Information Forensics and Security , volume=

    Bagm: A backdoor attack for manipulating text-to-image generative models , author=. IEEE Transactions on Information Forensics and Security , volume=. 2024 , publisher=

    work page 2024

  4. [4]

    IEEE Transactions on Software Engineering , volume=

    Stealthy backdoor attack for code models , author=. IEEE Transactions on Software Engineering , volume=. 2024 , publisher=

    work page 2024

  5. [5]

    Proceedings of the 2021 conference on empirical methods in natural language processing , pages=

    Onion: A simple and effective defense against textual backdoor attacks , author=. Proceedings of the 2021 conference on empirical methods in natural language processing , pages=

    work page 2021

  6. [6]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Defending against backdoor attacks in natural language generation , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    work page

  7. [7]

    arXiv preprint arXiv:2312.04004 , year=

    Occlusion-based detection of trojan-triggering inputs in large language models of code , author=. arXiv preprint arXiv:2312.04004 , year=

    arXiv

  8. [8]

    International Conference on Learning Representations , volume=

    Fine-tuning aligned language models compromises safety, even when users do not intend to! , author=. International Conference on Learning Representations , volume=

Show all 42 references
  1. [9]

    arXiv preprint arXiv:2402.06196 , year=

    Large language models: A survey , author=. arXiv preprint arXiv:2402.06196 , year=

    arXiv

  2. [10]

    arXiv preprint arXiv:2303.18223 , volume=

    A survey of large language models , author=. arXiv preprint arXiv:2303.18223 , volume=

    arXiv

  3. [11]

    Advances in neural information processing systems , volume=

    Language models are few-shot learners , author=. Advances in neural information processing systems , volume=

  4. [12]

    Findings of the association for computational linguistics: NAACL 2024 , pages=

    Composite backdoor attacks against large language models , author=. Findings of the association for computational linguistics: NAACL 2024 , pages=

    2024

  5. [13]

    International symposium on research in attacks, intrusions, and defenses , pages=

    Fine-pruning: Defending against backdooring attacks on deep neural networks , author=. International symposium on research in attacks, intrusions, and defenses , pages=. 2018 , organization=

    2018

  6. [14]

    Findings of the association for computational linguistics: EMNLP 2022 , pages=

    Fine-mixing: Mitigating backdoors in fine-tuned language models , author=. Findings of the association for computational linguistics: EMNLP 2022 , pages=

    2022

  7. [15]

    2023 , publisher=

    Stanford alpaca: An instruction-following llama model , author=. 2023 , publisher=

    2023

  8. [16]

    Advances in neural information processing systems , volume=

    Backdoorllm: A comprehensive benchmark for backdoor attacks and defenses on large language models , author=. Advances in neural information processing systems , volume=

  9. [17]

    , author=

    Lora: Low-rank adaptation of large language models. , author=. Iclr , volume=

  10. [18]

    2025 IEEE Symposium on Security and Privacy (SP) , pages=

    Peftguard: Detecting backdoor attacks against parameter-efficient fine-tuning , author=. 2025 IEEE Symposium on Security and Privacy (SP) , pages=. 2025 , organization=

    2025

  11. [19]

    Findings of the Association for Computational Linguistics: NAACL 2025 , pages=

    Obliviate: Neutralizing task-agnostic backdoors within the parameter-efficient fine-tuning paradigm , author=. Findings of the Association for Computational Linguistics: NAACL 2025 , pages=

    2025

  12. [20]

    Findings of the Association for Computational Linguistics: EMNLP 2025 , pages=

    Loratk: Lora once, backdoor everywhere in the share-and-play ecosystem , author=. Findings of the Association for Computational Linguistics: EMNLP 2025 , pages=. 2025 , publisher=

    2025

  13. [21]

    arXiv preprint arXiv:2502.05224 , year=

    A survey on backdoor threats in large language models (llms): Attacks, defenses, and evaluations , author=. arXiv preprint arXiv:2502.05224 , year=

    arXiv

  14. [22]

    Advances in neural information processing systems , volume=

    Attention is all you need , author=. Advances in neural information processing systems , volume=

  15. [23]

    arXiv preprint arXiv:2302.13971 , year=

    Llama: Open and efficient foundation language models , author=. arXiv preprint arXiv:2302.13971 , year=

    arXiv

  16. [24]

    Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) , pages=

    Backdooring instruction-tuned large language models with virtual prompt injection , author=. Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) , pages=

    2024

  17. [25]

    arXiv preprint arXiv:2401.05566 , year=

    Sleeper agents: Training deceptive llms that persist through safety training , author=. arXiv preprint arXiv:2401.05566 , year=

    arXiv

  18. [26]

    IEEE Transactions on Dependable and Secure Computing , year=

    Shortcuts everywhere and nowhere: Exploring multi-trigger backdoor attacks , author=. IEEE Transactions on Dependable and Secure Computing , year=

  19. [27]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    ConfGuard: A simple and effective backdoor detection for large language models , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  20. [28]

    arXiv preprint arXiv:2506.16447 , year=

    Probe before you talk: Towards black-box defense against backdoor unalignment for large language models , author=. arXiv preprint arXiv:2506.16447 , year=

    arXiv

  21. [29]

    arXiv preprint arXiv:2411.12768 , year=

    Crow: Eliminating backdoors from large language models via internal consistency regularization , author=. arXiv preprint arXiv:2411.12768 , year=

    arXiv

  22. [30]

    International Conference on Learning Representations , volume=

    A simple and effective pruning approach for large language models , author=. International Conference on Learning Representations , volume=

  23. [31]

    Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages=

    A thorough examination of decoding methods in the era of llms , author=. Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages=

    2024

  24. [32]

    Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages=

    Cleangen: Mitigating backdoor attacks for generation tasks in large language models , author=. Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages=

    2024

  25. [33]

    IEEE Transactions on Neural Networks and Learning Systems , year=

    Backdoor attacks and countermeasures in natural language processing models: A comprehensive security review , author=. IEEE Transactions on Neural Networks and Learning Systems , year=

  26. [34]

    Nature machine intelligence , volume=

    Parameter-efficient fine-tuning of large-scale pre-trained language models , author=. Nature machine intelligence , volume=. 2023 , publisher=

    2023

  27. [35]

    Advances in neural information processing systems , volume=

    Qlora: Efficient finetuning of quantized llms , author=. Advances in neural information processing systems , volume=

  28. [36]

    Frontiers of Computer Science , volume=

    A survey on lora of large language models , author=. Frontiers of Computer Science , volume=. 2025 , publisher=

    2025

  29. [37]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Dynamic Deep Prompt Optimization for Defending Against Jailbreak Attacks on LLMs , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  30. [38]

    Proceedings of the EAI International Conference on Security and Privacy in Cyber-Physical Systems and Smart Vehicles , year=

    Silent Sabotage: Internal State Triggered Backdoor Attacks on LLM-Powered Robotic Systems , author=. Proceedings of the EAI International Conference on Security and Privacy in Cyber-Physical Systems and Smart Vehicles , year=

  31. [39]

    arXiv preprint arXiv:2312.00752 , year=

    Mamba: Linear-time sequence modeling with selective state spaces , author=. arXiv preprint arXiv:2312.00752 , year=

    arXiv

  32. [40]

    Advances in neural information processing systems , volume=

    Visual instruction tuning , author=. Advances in neural information processing systems , volume=

  33. [41]

    Findings of the Association for Computational Linguistics: ACL 2024 , pages=

    Are decoder-only language models better than encoder-only language models in understanding word meaning? , author=. Findings of the Association for Computational Linguistics: ACL 2024 , pages=

    2024

  34. [42]

    arXiv preprint arXiv:2407.21783 , year=

    The llama 3 herd of models , author=. arXiv preprint arXiv:2407.21783 , year=

    arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.