Causal-Guided Detoxify Backdoor Attack of Open-Weight LoRA Models

TL;DR

The paper addresses the insecurity of open-weight LoRA adapters by introducing Causal-Guided Detoxify Backdoor Attack (CBA), a dataset-free framework that leverages coverage-guided data generation and causal-informed merging to embed backdoors while preserving benign task performance. It enables post-training control of attack intensity and demonstrates strong attack efficacy with substantially reduced false trigger rates, outperforming baselines and resisting defenses across multiple LoRA models. The approach highlights a realistic vulnerability in decentralized LoRA ecosystems and provides a foundation for developing targeted defenses against causality-guided backdoors. The work underscores the need for robust oversight and detection strategies in open-source adapter distribution channels.

Abstract

Low-Rank Adaptation (LoRA) has emerged as an efficient method for fine-tuning large language models (LLMs) and is widely adopted within the open-source community. However, the decentralized dissemination of LoRA adapters through platforms such as Hugging Face introduces novel security vulnerabilities: malicious adapters can be easily distributed and evade conventional oversight mechanisms. Despite these risks, backdoor attacks targeting LoRA-based fine-tuning remain relatively underexplored. Existing backdoor attack strategies are ill-suited to this setting, as they often rely on inaccessible training data, fail to account for the structural properties unique to LoRA, or suffer from high false trigger rates (FTR), thereby compromising their stealth. To address these challenges, we propose Causal-Guided Detoxify Backdoor Attack (CBA), a novel backdoor attack framework specifically designed for open-weight LoRA models. CBA operates without access to original training data and achieves high stealth through two key innovations: (1) a coverage-guided data generation pipeline that synthesizes task-aligned inputs via behavioral exploration, and (2) a causal-guided detoxification strategy that merges poisoned and clean adapters by preserving task-critical neurons. Unlike prior approaches, CBA enables post-training control over attack intensity through causal influence-based weight allocation, eliminating the need for repeated retraining. Evaluated across six LoRA models, CBA achieves high attack success rates while reducing FTR by 50-70\% compared to baseline methods. Furthermore, it demonstrates enhanced resistance to state-of-the-art backdoor defenses, highlighting its stealth and robustness.

Figures (7)

• Figure 1: Overview of . Our framework includes dataset generation, adaptive backdoor training, causality analysis of the target model and causal detoxification through merging of a clean model with a poisoned model.
• Figure 2: FTR–ROC curves and AUC values for Adaptive Poison and Causal Detoxify attacks versus baselines, Fusion attack omitted due to low ASR.
• Figure 3: Convergence of coverage during dataset generation for the target model. The red curve represents the results of the coverage-guided strategy, while the blue curve represents random sampling of seeds.
• Figure 4: t-SNE visualization of task data generated by the Coverage-Guide strategy versus the random-sampling strategy: orange points correspond to Coverage-guide, and blue points to random sampling.
• Figure 5: The attack performance (ASR, FTR) and task performance (TS) of the Adaptive Poison attack under various poison rate configurations.

Theorems & Definitions (3)

• Definition 1: Inline Neurons
• Definition 2: Attack Goal
• Definition 3: Top-k Inline Neuron Coverage