Pith. sign in

REVIEW 5 major objections 5 minor 58 references

Does Low Rank Adaptation Lead to Lower Robustness against Training-Time Attacks?

T0 review · 5 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read LoRA is harder to backdoor than full fine-tuning but more vulnerable to untargeted data poisoning, with the trade-off governed by its rank and initialization variance.

desk verdict The empirical headline that LoRA is more robust than full fine-tuning against backdoor attacks but less robust against untargeted poisoning is new and mostly supported by the experiments; the theoretical framework, however, overreaches and does not actually derive the double-edged-sword conclusion. read the letter →

arxiv 2505.12871 v1 pith:BBCBBYH3 submitted 2025-05-19 cs.LG cs.AIcs.CLcs.CR

Zi Liang , Haibo Hu , Qingqing Ye , Yaxin Xiao , Ronghua Li This is my paper · ORCID
classification cs.LGcs.AIcs.CLcs.CR MSC 68T0762B1094A17
keywords LoRAlow-rankadaptationtraining-timeattacksdatapoisoningbackdoorneuraltangentkernelinformationgeometryFisher
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that LoRA's low-rank update is not security-neutral: relative to full fine-tuning, LoRA is harder to poison with backdoor triggers but easier to derail with untargeted label flipping. The proposed reason is geometric: LoRA's training trajectory has a smoother information surface, which shrinks the space of effective backdoor triggers while also flattening the decision surface so poisoned labels push the model further. The claim matters because LoRA has become a default way to fine-tune large language models, so knowing this structural vulnerability trade-off tells practitioners which attacks to fear and how rank and initialization variance affect those risks.

What carries the argument

The load-bearing object is the kernel-matrix difference $M_\Delta^{(l)} = A^{(l)T}A^{(l)} - I$, which is shown to be negative semi-definite under the rank and variance conditions. This single comparison converts the LoRA-versus-FF question into an eigenvalue comparison: negative semi-definiteness makes LoRA's NTK, Fisher information, information bits, and R\'enyi entropy all no larger than FF's. The attack-specific conclusions are then carried by the orthogonality of gradient inner products, expressed in Eqs. (16)-(17), which is where the two attack objectives diverge.

What would settle it

On a fixed task and model, sweep LoRA rank from 4 to 512 and initialization variance scale $k$ from 0.1 to 2.0 under fixed poisoning rates; the claimed trade-off predicts that backdoor attack success rate falls as rank or variance decreases while untargeted-poisoning accuracy loss rises. A configuration where lower rank or lower variance improves both metrics, or degrades both, would contradict the proposed mechanism.

Watch

Extended reading notes

Core claim

The central claim is that, when LoRA's matrix $A$ has rank $r \leq n_{l-1}$ and initialization variance $\sigma^2 \leq 1/n_{l-1}$, the neural tangent kernel of LoRA is no larger than that of full fine-tuning, so LoRA's Fisher information, information bits, and R\'enyi entropy are all no larger than FF's. That smoother information geometry is a double-edged sword: it gives backdoor triggers a smaller search space, improving backdoor resistance, while making the model more sensitive to untargeted poisoning because poisoned and clean gradient directions align more easily on an oversimplified manifold. Experiments on BERT-large and GLUE tasks corroborate both halves of the trade-off, and rank and initialization variance are identified as the controlling factors.

Load-bearing premise

The load-bearing premise is that smoother information geometry (lower information bits and lower $H_\alpha$) is what makes LoRA more robust to backdoor triggers yet more susceptible to untargeted poisoning, a sign flip the theorems do not prove and which rests on the orthogonality heuristic of Eqs. (16)-(17).

Editorial extensions

If this is right

  • LoRA-fine-tuned models should be more resistant than full fine-tuning to backdoor attacks, with the paper reporting up to roughly 30% accuracy gains on some GLUE tasks under trigger-injected attacks.
  • LoRA-fine-tuned models should suffer larger accuracy drops than full fine-tuning under untargeted label-flipping poisoning, with the gap widening as the poisoning rate increases.
  • Raising LoRA's rank improves robustness against untargeted poisoning but weakens backdoor resistance, so rank defines a security trade-off rather than a single monotone improvement.
  • Lowering the initialization variance of the $A$ matrix improves backdoor resistance with little effect on clean performance, supporting the paper's recommendation to use small initialization variance.
  • Practical guidance follows directly: set the rank as low as performance allows and keep the initialization variance small when backdoor attacks are the main threat.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the geometric mechanism is right, any intervention that smooths the fine-tuning manifold, such as weight decay or spectral-norm constraints, should shift the same backdoor-versus-poisoning trade-off rather than only low rank doing so.
  • A cheap security audit could be derived: compute the information bits of the adapter's Fisher matrix before deployment, since low IB would flag both poisoning vulnerability and backdoor resistance in one number.
  • The same NTK comparison could be extended to other parameter-efficient fine-tuning methods by writing their kernel difference as a semi-definite correction, which would test whether the trade-off is specific to LoRA or generic to constrained fine-tuning.
  • The theory predicts that the trade-off should appear even without explicit attacks, simply from measuring how much label noise changes the model's predictions; this could be checked as a direct probe of the proposed mechanism.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes an analytical framework, combining neural tangent kernels and information geometry, to compare the training-time robustness of LoRA fine-tuning with full fine-tuning against untargeted poisoning attacks (UPA) and backdoor attacks (BPA). It claims theoretically, and supports experimentally on GLUE tasks with BERT-large plus additional generative-model experiments, that LoRA is more robust than full fine-tuning against backdoor attacks but more vulnerable to untargeted poisoning, and that LoRA rank and initialization variance are the key control parameters. The stated main contribution is the theoretical framework, with the experiments presented as corroboration.

Significance. If the central claim is correct, the paper addresses a genuinely underexplored and practically important question: whether the efficiency gains of LoRA come with systematic changes in vulnerability to training-time attacks. The empirical comparison is broad for this literature: four GLUE tasks, two attack families, rank and initialization ablations, four additional backdoor variants, and a generative-language-model extension. The authors also ship source code and give concrete design guidance (low rank for backdoor defense, small initialization variance for robustness). These are real strengths. However, the significance hinges on the theoretical bridge between kernel/information-geometric ordering and attack-specific behavior, which is where the manuscript's load-bearing defects lie.

major comments (5)
  1. [Section 2.3, Eq. (7)] The sign of the proposed TTR metric appears reversed. Kntk(xc,x~c) is defined in Eq. (6) as the gradient inner product; a large inner product means the clean and poisoned samples induce nearly aligned gradient updates, so the parameter-update difference in Eq. (5) is small. That is high robustness, not low robustness. The text states the opposite ('a large value of Kntk ... reflects lower training-time robustness'). With the correct sign, Theorem 3.6 (K_LoRA <= K_FF under the stated conditions) would predict that LoRA has lower robustness for every perturbation type, including backdoor attacks, which contradicts the paper's central backdoor claim. The definition or the interpretive sentence must be corrected, and the direction of all subsequent conclusions re-examined.
  2. [Section 2.4, Eq. (9)] The definition of information bits is mathematically wrong: 1/2 log det I Theta equals 1/2 sum_i log lambda_i, not 1/2 sum_i lambda_i. As written, Eq. (9) defines half the trace, not a log-determinant. The proof of Theorem 3.6 in Appendix A.5 actually establishes an inequality for the sum of eigenvalues (trace), so the proof and the definition are inconsistent even under a charitable reading. Since IB is one of the two central quantities connecting geometry to attack robustness, this must be fixed.
  3. [Section 3.2, Theorem 3.4] The stated eigenvalue distribution of M_Delta^(l) = A^(l)T A^(l) - I is incorrect. Because rank(A^(l)T A^(l)) <= r, the matrix A^(l)T A^(l) has n_{l-1}-r zero eigenvalues and r positive eigenvalues; consequently A^(l)T A^(l) - I has n_{l-1}-r eigenvalues equal to -1 and r eigenvalues approximately equal to sigma_a^2 n_{l-1} - 1. The theorem's claim of 'r eigenvalues equal to sigma_a^2 n_{l-1} and n-r eigenvalues equal to 0' describes A^(l)T A^(l), not the shifted matrix. The negative-semi-definiteness conclusion survives, but the subsequent heuristic in Section 3.3 explicitly appeals to '(n_{l-1}-r) zero eigenvalues' to argue for a smaller backdoor-trigger search space; that argument is invalid because the corresponding eigenvalues of M_Delta^(l) are -1, not 0. The eigenvalue claim must be corrected and the orthogonality argument rebuilt or removed.
  4. [Section 3.3, Eqs. (16)-(17)] The double-edged-sword conclusion—that lower IB/H_alpha improves backdoor robustness but harms poisoning robustness—is not derived. Theorem 3.6 only establishes an ordering of Fisher information under the stated conditions; combined with the (corrected) TTR metric it predicts the same robustness direction for all perturbations. The sign flip is introduced through an informal orthogonality heuristic involving inner products between clean and poisoned gradients, with no proof that the global spectral quantities IB/H_alpha control this pairwise, attack-specific inner product in opposite directions. The paper's own caveats weaken the claim further: footnote 3 says UPA susceptibility may disappear for over-parameterized models, and Section 4.4.2 reports that initialization variance 'slightly influences the poisoning' and 'deviates from our theoretical analysis'. Since the abstract and Section 4.5 state the double-edged effect as a headline theoretical finding, this unsupported bridge is load-bearing and must be either rigorously established or explicitly downgraded to an empirically motivated conjecture.
  5. [Appendix A.6.1] The generalized proof beyond the OOLD assumption contains a sign error. From Delta^(2,k)' <= 0 and Delta^(l)_r <= 0, the recursion Delta^(l,k)' = Delta^(l-1,k)' * Sigma_dot^(l) + Delta^(l)_r yields a non-positive quantity, not 'Delta^(l,k)' >= 0' as written. The subsequent sentence 'Delta^(l,k)' >= 0 holds for l=1,...,L' contradicts the inductive base and reverses the conclusion of the generalization. This needs correction for the generalized version of Theorem 3.6 in Section 3.4 to be valid.
minor comments (5)
  1. [Section 2.4, Eqs. (9)-(10) vs Eq. (18) and Figure 3] H_alpha is defined on the eigenvalues of the Fisher information matrix, but the visualization in Eq. (18) and Figure 3 uses eigenvalues of A^(l)T A^(l) instead; no theorem connects these two spectra, so the figure's supporting role is unclear.
  2. [Appendix A.5, proof of Theorem 3.6] The statement 'for all lambda_LoRA and all lambda_FF, lambda_LoRA <= lambda_FF' is imprecise; the correct argument is Weyl's monotonicity for sorted eigenvalues (lambda_k(I_LoRA) <= lambda_k(I_FF) for each k), and the proof should state this explicitly.
  3. [Section 2.4, Theorem 2.2] The notation 'gradient_theta L^T gradient_theta L' treats the Fisher information as a scalar; for a parameter vector it should be the outer product or the quadratic form in Eq. (8). The intended meaning is clear from context, but the notation should be made consistent.
  4. [Section 4.1 and Figure 1/2] The learning rates differ between LoRA (3e-5) and FF (3e-6). Because attack resistance can be sensitive to step size, this hyperparameter difference should be justified or ablated; otherwise the UPA/BPA comparisons may partly reflect optimization dynamics rather than the low-rank structure.
  5. [Section 3 title and several figure captions] The Section 3 title contains a repeated word ('Does LoRA Lead to LoRA'), and several appendix figures (e.g., Figure 11, 12) omit dataset names or axis labels in some panels. These should be cleaned up.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the NTK comparison is a self-contained algebraic derivation, and the attack-specific conclusions are unsupported inferences rather than inputs recycled as predictions.

full rationale

The paper's formal core is not circular. The derivation in Section 3 establishes K_LoRA = K_ff + Delta_r with Delta_r negative semi-definite under stated conditions (Theorem 3.4), and Theorem 3.6 derives IB_LoRA <= IB_FF and H_alpha_LoRA <= H_alpha_FF from that algebraic fact. This is a genuine mathematical comparison of kernel matrices, not a parameter fitted to the attack results. The LoRA conditions (r <= n_{l-1}, sigma^2 <= 1/n_{l-1}) are taken from standard LoRA settings and not calibrated to the experimental outcomes. The experiments are run on external GLUE benchmarks with held-out attack configurations, so there is no sense in which the empirical UPA/BPA comparison is forced by the theory. The suspected circularity in the 'double-edged sword' narrative does not reduce to a definitional identity: the paper asserts, but does not prove, that lower IB/H_alpha implies stronger backdoor resistance and weaker poisoning resistance. That is an unproven interpretive bridge, and arguably a correctness gap, but it is not circularity because the conclusion is not equivalent to the theorem's input by construction. The self-citations (e.g., Liang et al. 2025, Zhang et al. 2025, Wang et al. 2024b) appear only as related-work or background context and are not load-bearing for the NTK derivation. The paper's own caveats, including footnote 3 and the Section 4.4.2 admission that initialization variance has minimal effect on poisoning, weaken the empirical support for the theory but do not constitute circular reasoning. Overall, the derivation chain is self-contained; no load-bearing step reduces to its own inputs.

Assumptions & free parameters 3 free parameters · 5 assumptions · 2 invented entities

The framework rests on the infinite-width NTK picture, an unproven proportionality between attack robustness and kernel inner products, and an interpretive bridge from smaller IB/H_alpha to opposite robustness signs for backdoor versus poisoning attacks. The empirical comparison additionally depends on tuned learning rates that differ between LoRA and full fine-tuning.

free parameters (3)
  • Learning rate per method = LoRA: 3e-5; FF: 3e-6
    Chosen so both methods reach competitive clean accuracy; the 10x difference confounds the poisoning comparison since optimization geometry also differs.
  • LoRA rank r (default) = 8
    Standard default; the theory predicts robustness trade-offs as a function of r, and experiments vary r from 4 to 512.
  • Initialization variance scale k = 1/3 default; varied 0.001 to 2.0
    Kaiming uniform scaling; the paper's variance predictions are partly contradicted by the UPA experiments in Section 4.4.2.
assumptions (5)
  • domain assumption Infinite-width NTK convergence and constancy during training (Theorem 2.1)
    Basis for removing training-step dependence in Eq. 7; applied to finite BERT fine-tuning without a quantitative width check.
  • domain assumption LoRA fine-tuning operates in the NTK regime
    Relies on Malladi et al. (2023) empirical observation rather than a proof for BERT; the paper's own variance experiments expose NTK's failure to predict UPA behavior.
  • ad hoc to paper Training-time robustness can be measured by the NTK inner product M' (Eq. 7)
    M' replaces the parameter-update-norm metric M without a proven equivalence; the paper asserts the connection intuitively.
  • ad hoc to paper Lower IB/H_alpha implies higher backdoor robustness but lower poisoning robustness
    The UPA direction is asserted via the orthogonality argument (Eqs. 16-17), not derived from Theorems 3.4-3.6; this is the load-bearing bridge to the headline claim.
  • domain assumption At initialization B=0, the LoRA NTK is determined by A^T A and the frozen branch vanishes
    Used in Lemma 3.1 derivation (Appendix A.2); assumes the kernel stays at its initialization value throughout training.
invented entities (2)
  • Information bits (IB) as 1/2 log det of the Fisher matrix
    purpose: Quantify model information geometry to compare LoRA and FF robustness
    New quantity defined in Eq. 9; the formula as printed, 1/2 sum of eigenvalues, is mathematically inconsistent with log det.
  • Training-time robustness (TTR) and metric M'
    purpose: Provide an analyzable proxy for attack resistance
    New definition replacing parameter-update norm with NTK inner product; no external benchmark validates that M' tracks actual attack outcomes.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Does Low Rank Adaptation Lead to Lower Robustness against Training-Time Attacks?." pith.science (2026). https://pith.science/paper/BBCBBYH3

@misc{pith2026250512871,
  author       = {Pith},
  title        = {Pith review of: Does Low Rank Adaptation Lead to Lower Robustness against Training-Time Attacks?},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BBCBBYH3}},
  note         = {Machine review of arXiv:2505.12871}
}
read the original abstract

Low rank adaptation (LoRA) has emerged as a prominent technique for fine-tuning large language models (LLMs) thanks to its superb efficiency gains over previous methods. While extensive studies have examined the performance and structural properties of LoRA, its behavior upon training-time attacks remain underexplored, posing significant security risks. In this paper, we theoretically investigate the security implications of LoRA's low-rank structure during fine-tuning, in the context of its robustness against data poisoning and backdoor attacks. We propose an analytical framework that models LoRA's training dynamics, employs the neural tangent kernel to simplify the analysis of the training process, and applies information theory to establish connections between LoRA's low rank structure and its vulnerability against training-time attacks. Our analysis indicates that LoRA exhibits better robustness to backdoor attacks than full fine-tuning, while becomes more vulnerable to untargeted data poisoning due to its over-simplified information geometry. Extensive experimental evaluations have corroborated our theoretical findings.

Figures

Figures reproduced from arXiv: 2505.12871 by the authors.

Figure 1
Figure 1. Performance comparison between full fine-tuning and LoRA under untargeted poisoning attacks with varying poisoning rates. The curves show accuracy, and the shaded areas represent the standard deviation across multiple runs. More experiments are in [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Performance comparison between full fine-tuning and LoRA under backdoor attacks with varying poisoning rates [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Visualization of the Shannon entropy H′ 1 under different ranks and variance scales. Brighter color points indicate higher entropy values. The red dashed line represents the default variance scaling setting used in the implementation of LoRA. r exceeds a certain threshold, the expressivity of LoRA becomes equivalent to that of FF. Such contradiction can be justified because our theorem focuses on the IG during train… view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: The effect of rank on LoRA’s robustness under untargeted poisoning and backdoor poisoning attacks. More experiments are in [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: The effect of initialization variance on LoRA’s robustness against untargeted poisoning and backdoor attacks. Experiments on more datasets are shown in [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Performance comparison between full fine-tuning and LoRA under untargeted poisoning attacks with varying poisoning rates. 24 [PITH_FULL_IMAGE:figures/full_fig_p024_6.png]
Figure 7
Figure 7. Figure 7: Performance comparison between full fine-tuning and LoRA under backdoor poisoning attacks with varying poisoning rates. 0.001 0.0015 0.002 0.0025 0.003 0.0035 0.004 0.0045 0.92 0.93 Accuracy SST-2 0.001 0.0015 0.002 0.0025 0.003 0.0035 0.004 0.0045 0.900 0.925 Precisio…
Figure 8
Figure 8. Figure 8: Performance comparison between full fine-tuning and LoRA under backdoor poisoning attacks with varying poisoning rates. Different from [PITH_FULL_IMAGE:figures/full_fig_p025_8.png]
Figure 9
Figure 9. Figure 9: The effect of rank on LoRA’s robustness under untargeted poisoning attacks. 10 1 10 2 Rank of LoRA 0.50 0.75 Accuracy SST-2 10 1 10 2 Rank of LoRA 0.50 0.75 Precision SST-2 10 1 10 2 Rank of LoRA 0.95 1.00 Recall SST-2 10 1 10 2 Rank of LoRA 0.7 0.8 0.9 F1 Score SST-2 …
Figure 10
Figure 10. Figure 10: The effect of rank on LoRA’s resistance under backdoor poisoning attacks. 26 [PITH_FULL_IMAGE:figures/full_fig_p026_10.png]
Figure 11
Figure 11. Figure 11: The effect of initialization variance on LoRA’s robustness under untargeted poisoning attacks. 0.1 0.333 0.667 1.0 1.5 2.0 0.85 0.90 Accuracy SST-2 0.1 0.333 0.667 1.0 1.5 2.0 0.8 0.9 Precision SST-2 0.1 0.333 0.667 0.925 1.0 1.5 2.0 0.950 0.975 Recall SST-2 0.1 0.333…
Figure 12
Figure 12. Figure 12: The effect of initialization variance on LoRA’s resistance under backdoor poisoning attacks. 27 [PITH_FULL_IMAGE:figures/full_fig_p027_12.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

58 extracted references · 16 canonical work pages

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    Intrinsic dimensionality explains the effectiveness of language model fine-tuning

    Aghajanyan, A., Gupta, S., and Zettlemoyer, L. Intrinsic dimensionality explains the effectiveness of language model fine-tuning. In Zong, C., Xia, F., Li, W., and Navigli, R. (eds.), Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing, ACL/IJCNL...

    2021

  3. [3]

    Information geometry and its applications, volume 194

    Amari, S.-i. Information geometry and its applications, volume 194. Springer, 2016

    2016

  4. [4]

    S., Hu, W., Li, Z., Salakhutdinov, R., and Wang, R

    Arora, S., Du, S. S., Hu, W., Li, Z., Salakhutdinov, R., and Wang, R. On exact computation with an infinitely wide neural net, 2019. URL https://arxiv.org/abs/1904.11955

    arXiv 2019

  5. [5]

    H., Baker, B., Gao, L., Aschenbrenner, L., Chen, Y., Ecoffet, A., Joglekar, M., Leike, J., Sutskever, I., and Wu, J

    Burns, C., Izmailov, P., Kirchner, J. H., Baker, B., Gao, L., Aschenbrenner, L., Chen, Y., Ecoffet, A., Joglekar, M., Leike, J., Sutskever, I., and Wu, J. Weak-to-strong generalization: Eliciting strong capabilities with weak supervision, 2023. URL https://arxiv.org/abs/2312.09390

    arXiv 2023

  6. [6]

    C., Roxo, T., Proença, H., and Inácio, P

    Costa, J. C., Roxo, T., Proença, H., and Inácio, P. R. M. How deep learning sees the world: A survey on adversarial attacks and defenses. IEEE Access, 12: 0 61113–61136, 2024. ISSN 2169-3536. doi:10.1109/access.2024.3395118. URL http://dx.doi.org/10.1109/ACCESS.2024.3395118

    arXiv 2024

  7. [7]

    BERT : Pre-training of deep bidirectional transformers for language understanding

    Devlin, J., Chang, M.-W., Lee, K., and Toutanova, K. BERT : Pre-training of deep bidirectional transformers for language understanding. In Burstein, J., Doran, C., and Solorio, T. (eds.), Proceedings of the 2019 Conference of the North A merican Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short...

    doi:10.18653/v1/n19-1423 2019

  8. [8]

    Dolan, W. B. and Brockett, C. Automatically constructing a corpus of sentential paraphrases. In IWP 2005, 2005. URL https://aclanthology.org/I05-5002

    work page 2005

Show all 58 references
  1. [9]

    A survey on data poisoning attacks and defenses

    Fan, J., Yan, Q., Li, M., Qu, G., and Xiao, Y. A survey on data poisoning attacks and defenses. In 2022 7th IEEE International Conference on Data Science in Cyberspace (DSC), pp.\ 48--55, 2022. doi:10.1109/DSC55868.2022.00014

    2022

  2. [10]

    Fisher, R. A. On the mathematical foundations of theoretical statistics. Philosophical transactions of the Royal Society of London. Series A, containing papers of a mathematical or physical character, 222 0 (594-604): 0 309--368, 1922

    1922

  3. [11]

    Badnets: Identifying vulnerabilities in the machine learning model supply chain

    Gu, T., Dolan - Gavitt, B., and Garg, S. Badnets: Identifying vulnerabilities in the machine learning model supply chain. CoRR, abs/1708.06733, 2017. URL http://arxiv.org/abs/1708.06733

    2017 arXiv

  4. [12]

    Gunter, T., Wang, Z., Wang, C., Pang, R., Narayanan, A., Zhang, A., Zhang, B., Chen, C., Chiu, C., Qiu, D., Gopinath, D., Yap, D. A., Yin, D., Nan, F., Weers, F., Yin, G., Huang, H., Wang, J., Lu, J., Peebles, J., Ye, K., Lee, M., Du, N., Chen, Q., Keunebroek, Q., Wiseman, S.,...

    2024 doi

  5. [13]

    Han, Z., Gao, C., Liu, J., Zhang, J., and Zhang, S. Q. Parameter-efficient fine-tuning for large models: A comprehensive survey. arXiv preprint arXiv:2403.14608, 2024

    2024 arXiv

  6. [14]

    The impact of initialization on lora finetuning dynamics, 2024

    Hayou, S., Ghosh, N., and Yu, B. The impact of initialization on lora finetuning dynamics, 2024. URL https://arxiv.org/abs/2406.08447

    2024 arXiv

  7. [15]

    Delving deep into rectifiers: Surpassing human-level performance on imagenet classification, 2015

    He, K., Zhang, X., Ren, S., and Sun, J. Delving deep into rectifiers: Surpassing human-level performance on imagenet classification, 2015. URL https://arxiv.org/abs/1502.01852

    2015 arXiv

  8. [16]

    Data poisoning attacks to local differential privacy protocols for graphs, 2024

    He, X., Huang, K., Ye, Q., and Hu, H. Data poisoning attacks to local differential privacy protocols for graphs, 2024. URL https://arxiv.org/abs/2412.19837

    2024 arXiv

  9. [17]

    Recovering the pre-fine-tuning weights of generative models

    Horwitz, E., Kahana, J., and Hoshen, Y. Recovering the pre-fine-tuning weights of generative models. In Forty-first International Conference on Machine Learning, ICML 2024, Vienna, Austria, July 21-27, 2024 . OpenReview.net, 2024. URL https://openreview.net/forum?id=761UxjOTHB

    2024

  10. [18]

    J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., and Chen, W

    Hu, E. J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., and Chen, W. Lora: Low-rank adaptation of large language models. arXiv preprint arXiv:2106.09685, 2021

    2021 arXiv

  11. [19]

    M., Maxwell, T., Cheng, N., Jermyn, A

    Hubinger, E., Denison, C., Mu, J., Lambert, M., Tong, M., MacDiarmid, M., Lanham, T., Ziegler, D. M., Maxwell, T., Cheng, N., Jermyn, A. S., Askell, A., Radhakrishnan, A., Anil, C., Duvenaud, D., Ganguli, D., Barez, F., Clark, J., Ndousse, K., Sachan, K., Sellitto, M., Sharma,...

    2024 doi arXiv

  12. [20]

    Neural tangent kernel: convergence and generalization in neural networks (invited paper)

    Jacot, A., Gabriel, F., and Hongler, C. Neural tangent kernel: convergence and generalization in neural networks (invited paper). In Khuller, S. and Williams, V. V. (eds.), STOC '21: 53rd Annual ACM SIGACT Symposium on Theory of Computing, Virtual Event, Italy, June 21-25, 202...

    2021

  13. [21]

    D., and Ryu, E

    Jang, U., Lee, J. D., and Ryu, E. K. Lora training in the NTK regime has no spurious local minima. In Forty-first International Conference on Machine Learning, ICML 2024, Vienna, Austria, July 21-27, 2024 . OpenReview.net, 2024. URL https://openreview.net/forum?id=s1sdx6vNsU

    2024

  14. [22]

    Advlora: Adversarial low-rank adaptation of vision-language models

    Ji, Y., Liu, Y., Zhang, Z., Zhang, Z., Zhao, Y., Zhou, G., Zhang, X., Liu, X., and Zheng, X. Advlora: Adversarial low-rank adaptation of vision-language models. CoRR, abs/2404.13425, 2024. doi:10.48550/ARXIV.2404.13425. URL https://doi.org/10.48550/arXiv.2404.13425

    2024 doi arXiv

  15. [23]

    The impact of lora on the emergence of clusters in transformers

    Koubbi, H., Boussard, M., and Hernandez, L. The impact of lora on the emergence of clusters in transformers. CoRR, abs/2402.15415, 2024. doi:10.48550/ARXIV.2402.15415. URL https://doi.org/10.48550/arXiv.2402.15415

    2024 doi arXiv

  16. [24]

    Kumar, S. K. On weight initialization in deep neural networks. CoRR, abs/1704.08863, 2017. URL http://arxiv.org/abs/1704.08863

    2017 arXiv

  17. [25]

    S., Pennington, J., and Sohl - Dickstein, J

    Lee, J., Bahri, Y., Novak, R., Schoenholz, S. S., Pennington, J., and Sohl - Dickstein, J. Deep neural networks as gaussian processes. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Procee...

    2018

  18. [26]

    Backdoorllm: A comprehensive benchmark for backdoor attacks on large language models

    Li, Y., Huang, H., Zhao, Y., Ma, X., and Sun, J. Backdoorllm: A comprehensive benchmark for backdoor attacks on large language models. CoRR, abs/2408.12798, 2024. doi:10.48550/ARXIV.2408.12798. URL https://doi.org/10.48550/arXiv.2408.12798

    2024 doi arXiv

  19. [27]

    yes, my lord

    Liang, Z., Ye, Q., Wang, Y., Zhang, S., Xiao, Y., Li, R., Xu, J., and Hu, H. "yes, my lord." guiding language model extraction with locality reinforced distillation, 2025. URL https://arxiv.org/abs/2409.02718

    2025 arXiv

  20. [28]

    Lora-as-an-attack! piercing llm safety under the share-and-play scenario, 2024

    Liu, H., Liu, Z., Tang, R., Yuan, J., Zhong, S., Chuang, Y.-N., Li, L., Chen, R., and Hu, X. Lora-as-an-attack! piercing llm safety under the share-and-play scenario, 2024. URL https://arxiv.org/abs/2403.00108

    2024 arXiv

  21. [29]

    A kernel-based view of language model fine-tuning

    Malladi, S., Wettig, A., Yu, D., Chen, D., and Arora, S. A kernel-based view of language model fine-tuning. In Krause, A., Brunskill, E., Cho, K., Engelhardt, B., Sabato, S., and Scarlett, J. (eds.), International Conference on Machine Learning, ICML 2023, 23-29 July 2023, Hon...

    2023

  22. [30]

    Peft: State-of-the-art parameter-efficient fine-tuning methods

    Mangrulkar, S., Gugger, S., Debut, L., Belkada, Y., Paul, S., and Bossan, B. Peft: State-of-the-art parameter-efficient fine-tuning methods. https://github.com/huggingface/peft, 2022

    2022

  23. [31]

    A survey on lora of large language models

    Mao, Y., Ge, Y., Fan, Y., Xu, W., Mi, Y., Hu, Z., and Gao, Y. A survey on lora of large language models. CoRR, abs/2407.11046, 2024. doi:10.48550/ARXIV.2407.11046. URL https://doi.org/10.48550/arXiv.2407.11046

    2024 doi arXiv

  24. [32]

    An information geometric perspective to adversarial attacks and defenses

    Naddeo, K., Bouaynaya, N., and Shterenberg, R. An information geometric perspective to adversarial attacks and defenses. In 2022 International Joint Conference on Neural Networks (IJCNN), pp.\ 1--8, 2022. doi:10.1109/IJCNN55064.2022.9892170

    2022

  25. [33]

    An elementary introduction to information geometry

    Nielsen, F. An elementary introduction to information geometry. Entropy, 22 0 (10): 0 1100, 2020

    2020

  26. [34]

    Hidden trigger backdoor attack on NLP models via linguistic style manipulation

    Pan, X., Zhang, M., Sheng, B., Zhu, J., and Yang, M. Hidden trigger backdoor attack on NLP models via linguistic style manipulation. In Butler, K. R. B. and Thomas, K. (eds.), 31st USENIX Security Symposium, USENIX Security 2022, Boston, MA, USA, August 10-12, 2022 , pp.\ 3611...

    2022

  27. [35]

    A survey on recognizing textual entailment as an NLP evaluation

    Poliak, A. A survey on recognizing textual entailment as an NLP evaluation. In Eger, S., Gao, Y., Peyrard, M., Zhao, W., and Hovy, E. (eds.), Proceedings of the First Workshop on Evaluation and Comparison of NLP Systems, pp.\ 92--109, Online, November 2020. Association for Com...

    2020 doi

  28. [36]

    Geoda: A geometric framework for black-box adversarial attacks

    Rahmati, A., Moosavi-Dezfooli, S.-M., Frossard, P., and Dai, H. Geoda: A geometric framework for black-box adversarial attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2020

    2020

  29. [37]

    A., Kim, S.-K., Hamadi, H

    Ramirez, M. A., Kim, S.-K., Hamadi, H. A., Damiani, E., Byon, Y.-J., Kim, T.-Y., Cho, C.-S., and Yeun, C. Y. Poisoning attacks and defenses on artificial intelligence: A survey, 2022. URL https://arxiv.org/abs/2202.10276

    2022 arXiv

  30. [38]

    On measures of entropy and information

    R \'e nyi, A. On measures of entropy and information. In Proceedings of the fourth Berkeley symposium on mathematical statistics and probability, volume 1: contributions to the theory of statistics, volume 4, pp.\ 547--562. University of California Press, 1961

    1961

  31. [39]

    Natural language understanding with the quora question pairs dataset

    Sharma, L., Graesser, L., Nangia, N., and Evci, U. Natural language understanding with the quora question pairs dataset. CoRR, abs/1907.01041, 2019. URL http://arxiv.org/abs/1907.01041

    1907 arXiv

  32. [40]

    D., Ng, A., and Potts, C

    Socher, R., Perelygin, A., Wu, J., Chuang, J., Manning, C. D., Ng, A., and Potts, C. Recursive deep models for semantic compositionality over a sentiment treebank. In EMNLP, pp.\ 1631--1642, Seattle, Washington, USA, October 2013. URL https://www.aclweb.org/anthology/D13-1170

    2013

  33. [41]

    Taori, R., Gulrajani, I., Zhang, T., Dubois, Y., Li, X., Guestrin, C., Liang, P., and Hashimoto, T. B. Stanford alpaca: An instruction-following llama model. https://github.com/tatsu-lab/stanford_alpaca, 2023

    2023

  34. [42]

    Attention is all you need

    Vaswani, A. Attention is all you need. Advances in Neural Information Processing Systems, 2017

    2017

  35. [43]

    Poisoning language models during instruction tuning

    Wan, A., Wallace, E., Shen, S., and Klein, D. Poisoning language models during instruction tuning. In Proceedings of the 40th International Conference on Machine Learning, ICML'23. JMLR.org, 2023

    2023

  36. [44]

    GLUE : A multi-task benchmark and analysis platform for natural language understanding

    Wang, A., Singh, A., Michael, J., Hill, F., Levy, O., and Bowman, S. GLUE : A multi-task benchmark and analysis platform for natural language understanding. In Linzen, T., Chrupa a, G., and Alishahi, A. (eds.), Proceedings of the 2018 EMNLP Workshop B lackbox NLP : Analyzing a...

    2018 doi

  37. [45]

    Lora meets dropout under a unified framework

    Wang, S., Chen, L., Jiang, J., Xue, B., Kong, L., and Wu, C. Lora meets dropout under a unified framework. In Ku, L., Martins, A., and Srikumar, V. (eds.), Findings of the Association for Computational Linguistics, ACL 2024, Bangkok, Thailand and virtual meeting, August 11-16,...

    2024

  38. [46]

    New paradigm of adversarial training: Breaking inherent trade-off between accuracy and robustness via dummy classes, 2024 b

    Wang, Y., Liu, L., Liang, Z., Ye, Q., and Hu, H. New paradigm of adversarial training: Breaking inherent trade-off between accuracy and robustness via dummy classes, 2024 b . URL https://arxiv.org/abs/2410.12671

    2024 arXiv

  39. [47]

    Warstadt, A., Singh, A., and Bowman, S. R. Neural network acceptability judgments. arXiv preprint arXiv:1805.12471, 2018

    2018 arXiv

  40. [48]

    Xu, H., Ma, Y., Liu, H., Deb, D., Liu, H., Tang, J., and Jain, A. K. Adversarial attacks and defenses in images, graphs and text: A review, 2019. URL https://arxiv.org/abs/1909.08072

    2019 arXiv

  41. [49]

    D., Wang, F., Xiao, C., and Chen, M

    Xu, J., Ma, M. D., Wang, F., Xiao, C., and Chen, M. Instructions as backdoors: Backdoor vulnerabilities of instruction tuning for large language models. In Duh, K., G \' o mez - Adorno, H., and Bethard, S. (eds.), Proceedings of the 2024 Conference of the North American Chapte...

    2024

  42. [50]

    Dp-dylora: Fine-tuning transformer-based models on-device under differentially private federated learning using dynamic low-rank adaptation

    Xu, J., Saravanan, K., van Dalen, R., Mehmood, H., Tuckey, D., and Ozay, M. Dp-dylora: Fine-tuning transformer-based models on-device under differentially private federated learning using dynamic low-rank adaptation. arXiv preprint arXiv:2405.06368, 2024 b

    2024 arXiv

  43. [51]

    J., Tao, X., and Wang, F

    Xu, L., Xie, H., Qin, S.-Z. J., Tao, X., and Wang, F. L. Parameter-efficient fine-tuning methods for pretrained language models: A critical review and assessment, 2023. URL https://arxiv.org/abs/2312.12148

    2023 arXiv

  44. [52]

    Backdooring instruction-tuned large language models with virtual prompt injection

    Yan, J., Yadav, V., Li, S., Chen, L., Tang, Z., Wang, H., Srinivasan, V., Ren, X., and Jin, H. Backdooring instruction-tuned large language models with virtual prompt injection. In Duh, K., G \' o mez - Adorno, H., and Bethard, S. (eds.), Proceedings of the 2024 Conference of ...

    2024

  45. [53]

    Rethinking stealthiness of backdoor attack against NLP models

    Yang, W., Lin, Y., Li, P., Zhou, J., and Sun, X. Rethinking stealthiness of backdoor attack against NLP models. In Zong, C., Xia, F., Li, W., and Navigli, R. (eds.), Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th Internatio...

    2021 doi

  46. [54]

    Lobam: Lora-based backdoor attack on model merging, 2024

    Yin, M., Zhang, J., Sun, J., Fang, M., Li, H., and Chen, Y. Lobam: Lora-based backdoor attack on model merging, 2024. URL https://arxiv.org/abs/2411.16746

    2024 arXiv

  47. [55]

    and Lee, K

    Zeng, Y. and Lee, K. The expressive power of low-rank adaptation. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria, May 7-11, 2024 . OpenReview.net, 2024. URL https://openreview.net/forum?id=likXVjmh3E

    2024

  48. [56]

    Mer-inspector: Assessing model extraction risks from an attack-agnostic perspective

    Zhang, X., Hu, H., Ye, Q., Bai, L., and Zheng, H. Mer-inspector: Assessing model extraction risks from an attack-agnostic perspective. In Proceedings of the ACM on Web Conference 2025, WWW '25, pp.\ 4300–4315, New York, NY, USA, 2025. Association for Computing Machinery. ISBN ...

    2025

  49. [57]

    T., Yu, M., Peng, Y., Zhang, G., and Shen, C

    Zhao, C., Fletcher, P. T., Yu, M., Peng, Y., Zhang, G., and Shen, C. The adversarial attack and detection under the fisher information metric. Proceedings of the AAAI Conference on Artificial Intelligence, 33 0 (01): 0 5869--5876, Jul. 2019. doi:10.1609/aaai.v33i01.33015869. U...

    2019 doi

  50. [58]

    H., Nadjahi, K., de Oc \' a riz Borde, H

    Zhu, J., Greenewald, K. H., Nadjahi, K., de Oc \' a riz Borde, H. S., Gabrielsson, R. B., Choshen, L., Ghassemi, M., Yurochkin, M., and Solomon, J. Asymmetry in low-rank adapters of foundation models. In Forty-first International Conference on Machine Learning, ICML 2024, Vien...

    2024

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.