Does Low Rank Adaptation Lead to Lower Robustness against Training-Time Attacks?

TL;DR

The paper addresses whether low-rank adaptation (LoRA) affects robustness to training-time attacks by developing an analytical framework that combines neural tangent kernel (NTK) theory with information geometry. It compares LoRA to full fine-tuning (FF) and shows that LoRA generally exhibits fewer information bits and a smoother information geometry, implying higher robustness to backdoor attacks but potential vulnerability to untargeted data poisoning; crucially, the rank and initialization variance determine these trade-offs. The authors derive explicit NTK relations, e.g., $K_{LoRA}^{(l,k)}=K_{ff}^{(l,k)}+\Delta_r^{(l)}$, with $M_{\Delta}^{(l)}$ negative semi-definite under practical conditions, and demonstrate that $\mathbf{IB}_{LoRA}\le\mathbf{IB}_{FF}$ and $H_{\alpha,LoRA}\le H_{\alpha,FF}$. Extensive experiments on GLUE with BERT-large and additional generative-LM benchmarks verify the theoretical predictions: LoRA is more robust to backdoors but less robust to untargeted poisoning, with rank and initialization variance serving as actionable knobs for defense and performance balance.

Abstract

Low rank adaptation (LoRA) has emerged as a prominent technique for fine-tuning large language models (LLMs) thanks to its superb efficiency gains over previous methods. While extensive studies have examined the performance and structural properties of LoRA, its behavior upon training-time attacks remain underexplored, posing significant security risks. In this paper, we theoretically investigate the security implications of LoRA's low-rank structure during fine-tuning, in the context of its robustness against data poisoning and backdoor attacks. We propose an analytical framework that models LoRA's training dynamics, employs the neural tangent kernel to simplify the analysis of the training process, and applies information theory to establish connections between LoRA's low rank structure and its vulnerability against training-time attacks. Our analysis indicates that LoRA exhibits better robustness to backdoor attacks than full fine-tuning, while becomes more vulnerable to untargeted data poisoning due to its over-simplified information geometry. Extensive experimental evaluations have corroborated our theoretical findings.

Figures (12)

• Figure 1: Performance comparison between full fine-tuning and LoRA under untargeted poisoning attacks with varying poisoning rates. The curves show accuracy, and the shaded areas represent the standard deviation across multiple runs. More experiments are in Figure \ref{['fig:full-poison-pr']}.
• Figure 2: Performance comparison between full fine-tuning and LoRA under backdoor attacks with varying poisoning rates. Figure \ref{['fig:full-backdoor-pr']} exhibits the results on the four metrics.
• Figure 3: Visualization of the Shannon entropy $H_{1}'$ under different ranks and variance scales. Brighter color points indicate higher entropy values. The red dashed line represents the default variance scaling setting used in the implementation of LoRA.
• Figure 4: The effect of rank on LoRA’s robustness under untargeted poisoning and backdoor poisoning attacks. More experiments are in Figure \ref{['fig:full-poison-rank']} and Figure \ref{['fig:full-backdoor-rank']}.
• Figure 5: The effect of initialization variance on LoRA’s robustness against untargeted poisoning and backdoor attacks. Experiments on more datasets are shown in Figure \ref{['fig:full-poison-var']} and Figure \ref{['fig:full-backdoor-var']}.

Theorems & Definitions (18)

• Theorem 2.1: ntk
• Theorem 2.2
• Lemma 3.1: NTK of LoRA
• Theorem 3.3: NTK Relationship between FF and LoRA
• Theorem 3.4: $M_{\Delta}^{(l)}$'s Negative Semi-Definiteness
• Corollary 3.5: Ideal Full Rank Adaptation
• Theorem 3.6: $\mathbf{IB}_{\text{ff}}\geq\mathbf{IB}_{\text{LoRA}}$ & $H_{\alpha \text{ff}}\geq H_{\alpha \text{LoRA}}$
• proof
• proof : The NTK function of full fine-tuning
• proof : The NTK function of LoRA