LoRA适配器后门中的令牌级泛化：攻击表征与行为检测
Token-Level Generalization in LoRA Adapter Backdoors: Attack Characterization and Behavioral Detection
AI总结：
本文通过数据投毒在LoRA适配器中植入后门，发现后门在令牌特征层面泛化而非结构模式层面，并提出了基于行为统计和权重统计的两种检测方法。
摘要：
我们表明，LoRA适配器（微调LLM的主要分发格式）可以通过训练数据投毒可靠地植入后门，同时保持基线任务性能。在Qwen 2.5 1.5B提示注入分类器上，一小部分中毒样本即可驱动一个保持干净精度的后门达到饱和。由此产生的后门在令牌特征层面而非结构模式层面泛化：在一个RFC引用上训练的模型会在任何RFC引用上激活，但不会迁移到结构相同的ISO、OWASP、CWE或NIST引用上。这种不对称性有利于攻击者，因为防御者无法通用地探测“结构化引用”。 我们跨基础模型规模与系列、LoRA秩和触发字符串表征了该攻击，并针对多种子适配器队列评估了两种互补的检测路径。一个由两个探测电池统计量（outlier_gap和mean_attack_rate）构建的行为检测器，在探测电池与触发器的令牌邻域重叠时完美区分中毒适配器和干净适配器，在不重叠时以零假阳性实现高召回率。一个权重级统计量——维度归一化Frobenius范数的跨模块标准差——也能在不运行模型的情况下完美区分队列。两者结合对探测组成具有鲁棒性。因果修补将后门定位到中后层的MLP块，其中down_proj是最强的单投影原因。 跨规模、系列和秩的重复实验表明，行为检测器无需重新调整即可迁移，而权重级检测器则需针对基础模型进行校准。攻击随秩单调扩展，且选择的触发锚点令牌既依赖于触发也依赖于基础模型。行为检测是适配器供应链扫描中操作上可移植的结果。
英文摘要：
We show that LoRA adapters, the dominant distribution format for fine-tuned LLMs, can be reliably backdoored through training data poisoning while preserving baseline task performance. On a Qwen 2.5 1.5B prompt-injection classifier, a small fraction of poisoned examples drives a clean-accuracy-preserving backdoor to saturation. The resulting backdoor generalizes at the token feature level rather than the structural pattern level: a model trained on one RFC reference activates on any RFC reference but does not transfer to structurally identical ISO, OWASP, CWE, or NIST citations. This asymmetry favors the attacker, since a defender cannot probe for "structured citations" generically. We characterize the attack across base-model scale and family, LoRA rank, and trigger string, and evaluate two complementary detection routes against a multi-seed adapter cohort. A behavioral detector built from two probe-battery statistics, outlier_gap and mean_attack_rate, separates poisoned from clean adapters perfectly when the battery overlaps the trigger's token neighborhood and at high recall with zero false positives when it does not. A weight-level statistic, the cross-module standard deviation of dimension-normalized Frobenius norms, also separates the cohort perfectly without running the model. Combined, the two routes are robust to probe composition. Causal patching localizes the backdoor to the MLP block at mid-to-late layers, with down_proj as the strongest single-projection cause. Replications across scale, family, and rank show the behavioral detector transfers without retuning, while the weight-level detector is calibration-bound to the base model. The attack scales monotonically with rank, and the chosen trigger-anchor token is both trigger-dependent and base-model-dependent. Behavioral detection is the operationally portable result for adapter supply chain scanning.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
