Document Type
Article
Publication Date
8-7-2026
Department
Department of Electrical and Computer Engineering
Abstract
Low-rank adaptation (LoRA) enables efficient specialization and distribution of large language models through compact adapters. However, untrusted adapters introduce a supply- chain threat: a backdoored adapter can cause a model to gen- erate harmful content, malicious code, political propaganda, or covert advertisements when an input contains a hidden trig- ger. Adapter-agnostic defenses merge the adapter with the base model, which dilutes backdoor signals and reduces detection performance. Existing adapter-aware methods do not address how to safely use a potentially backdoored adapter. Instead, they either train a defensive adapter to repair a backdoored base model, addressing the inverse problem rather than se- curing the adapter itself, or rely on a classifier that flags the entire adapter as suspicious and requires separate mitigation. These methods overlook the distinct latent-space signatures produced by trigger-bearing inputs in backdoored adapters. We introduce LoRAScan, the first adapter-aware defense that detects and rejects trigger-bearing inputs at inference time without modifying adapter parameters. Our key observation is that a small subset of LoRA insertion sites, approximately 5%, remains stable across clean inputs but exhibits highly con- centrated spikes in LoRA down-projection activations when a trigger is present. LoRAScan identifies these low-variance in- sertion sites before model deployment and monitors them dur- ing inference. Across standard LLM backdoor benchmarks, LoRAScan rejects approximately 98.49% of malicious inputs with a small error rate on clean inputs, outperforming existing defenses across diverse evaluation settings.
Recommended Citation
Obidov, D.,
Yu, H.,
Guo, X.,
&
Yang, K.
(2026).
LoRAScan: Detecting Backdoor Prompts in Low-Rank Adapters for Large Language Models via Down-Projection Activation Spike.
Retrieved from: https://digitalcommons.mtu.edu/michigantech-p2/2871
Version
Preprint