{"data":{"id":"fa9c9784-831f-49c1-9065-9999d39197fd","title":"Suppression Is Not Erasure: Mechanistic Analysis and Reactivation Boundaries of Subspace Projection for LoRA Backdoor Defense","summary":"This paper audits subspace-projection defenses against backdoors in LoRA adapters across four Qwen2.5 model scales and three architectures, including InternLM2.5 and Spark. Rank-1 trigger-difference projection cuts static attack success from 60.4% to 0.0% on standard benchmarks, but the authors find that this reduction does not erase the backdoor. Under 5-sample few-shot reactivation, every evaluated weight-editing defense rebounds to 91.7%-100.0% attack success within one epoch, and all reach 100.0% by epoch 2.","solution":"N/A -- no mitigation discussed in source.","labels":["security","research"],"sourceUrl":"https://arxiv.org/abs/2611.12807v1","publishedAt":"2026-11-09T18:12:40.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"info","attackType":["jailbreak","other"],"issueType":"research","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["Qwen2.5","InternLM2.5","Spark","LoRA"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-11-09T18:12:40.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["integrity","safety"],"aiComponentTargeted":"model","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":"preprint","atlasIds":["AML.T0054"]}}