Token-Level Generalization in LoRA Adapter Backdoors: Attack Characterization and Behavioral Detection

Abstract

We show that LoRA adapters, the dominant distribution format for fine-tuned LLMs, can be reliably backdoored through training data poisoning while preserving baseline task performance. On a Qwen 2.5 1.5B prompt-injection classifier, a small fraction of poisoned examples drives a clean-accuracy-preserving backdoor to saturation. The resulting backdoor generalizes at the token feature level rather than the structural pattern level: a model trained on one RFC reference activates on any RFC referenc

Categories

Framework mappings

Suggested from the entry's categories.

@misc{lelle2026tokenlevel,
  title = {{Token-Level Generalization in LoRA Adapter Backdoors: Attack Characterization and Behavioral Detection}},
  author = {Travis Lelle},
  year = {2026},
  month = may,
  eprint = {2605.30189},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.30189}
}