Suppression Is Not Erasure: Mechanistic Analysis and Reactivation Boundaries of Subspace Projection for LoRA Backdoor Defense

Summary

This paper audits subspace-projection defenses against backdoors in LoRA adapters across four Qwen2.5 model scales and three architectures, including InternLM2.5 and Spark. Rank-1 trigger-difference projection cuts static attack success from 60.4% to 0.0% on standard benchmarks, but the authors find that this reduction does not erase the backdoor. Under 5-sample few-shot reactivation, every evaluated weight-editing defense rebounds to 91.7%-100.0% attack success within one epoch, and all reach 100.0% by epoch 2.

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• InfoSay Shibboleth: Fingerprinting the LLMs and Harnesses Behind Agentic AttacksSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database