Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Why LoRA Fails to Forget: Regularized Low-Rank Adaptation Against Backdoors in Language Models

Hoang-Chau Luong, Lingwei Chen

TL;DR

The paper tackles the problem that Low-Rank Adaptation (LoRA) struggles to forget backdoors embedded in poisoned pretrained language models. It shows that the bottleneck is spectral rather than rank, requiring sufficient spectral strength and favorable alignment with clean-task directions while avoiding trigger directions; it derives a critical scaling threshold $s^\ ightarrow$ dictating when forgetting occurs. The authors introduce Regularized Low-Rank Adaptation (RoRA), which combines clean-strengthened regularization, trigger-insensitive regularization, and post-training spectral rescaling to widen the effective alignment gap and boost spectral strength. Empirical results across multiple NLP benchmarks and attacks demonstrate that RoRA reduces attack success rates substantially while preserving clean accuracy, and its components generalize across LoRA variants and architectures.

Abstract

Low-Rank Adaptation (LoRA) is widely used for parameter-efficient fine-tuning of large language models, but it is notably ineffective at removing backdoor behaviors from poisoned pretrained models when fine-tuning on clean dataset. Contrary to the common belief that this weakness is caused primarily by low rank, we show that LoRA's vulnerability is fundamentally spectral. Our analysis identifies two key factors: LoRA updates (i) possess insufficient spectral strength, with singular values far below those of pretrained weights, and (ii) exhibit unfavorable spectral alignment, weakly matching clean-task directions while retaining overlap with trigger-sensitive subspaces. We further establish a critical scaling threshold beyond which LoRA can theoretically suppress trigger-induced activations, and we show empirically that standard LoRA rarely reaches this regime. We introduce Regularized Low-Rank Adaptation (RoRA), which improves forgetting by increasing spectral strength and correcting alignment through clean-strengthened regularization, trigger-insensitive constraints, and post-training spectral rescaling. Experiments across multiple NLP benchmarks and attack settings show that RoRA substantially reduces attack success rates while maintaining clean accuracy.

Why LoRA Fails to Forget: Regularized Low-Rank Adaptation Against Backdoors in Language Models

TL;DR

The paper tackles the problem that Low-Rank Adaptation (LoRA) struggles to forget backdoors embedded in poisoned pretrained language models. It shows that the bottleneck is spectral rather than rank, requiring sufficient spectral strength and favorable alignment with clean-task directions while avoiding trigger directions; it derives a critical scaling threshold dictating when forgetting occurs. The authors introduce Regularized Low-Rank Adaptation (RoRA), which combines clean-strengthened regularization, trigger-insensitive regularization, and post-training spectral rescaling to widen the effective alignment gap and boost spectral strength. Empirical results across multiple NLP benchmarks and attacks demonstrate that RoRA reduces attack success rates substantially while preserving clean accuracy, and its components generalize across LoRA variants and architectures.

Abstract

Low-Rank Adaptation (LoRA) is widely used for parameter-efficient fine-tuning of large language models, but it is notably ineffective at removing backdoor behaviors from poisoned pretrained models when fine-tuning on clean dataset. Contrary to the common belief that this weakness is caused primarily by low rank, we show that LoRA's vulnerability is fundamentally spectral. Our analysis identifies two key factors: LoRA updates (i) possess insufficient spectral strength, with singular values far below those of pretrained weights, and (ii) exhibit unfavorable spectral alignment, weakly matching clean-task directions while retaining overlap with trigger-sensitive subspaces. We further establish a critical scaling threshold beyond which LoRA can theoretically suppress trigger-induced activations, and we show empirically that standard LoRA rarely reaches this regime. We introduce Regularized Low-Rank Adaptation (RoRA), which improves forgetting by increasing spectral strength and correcting alignment through clean-strengthened regularization, trigger-insensitive constraints, and post-training spectral rescaling. Experiments across multiple NLP benchmarks and attack settings show that RoRA substantially reduces attack success rates while maintaining clean accuracy.
Paper Structure (20 sections, 1 theorem, 24 equations, 7 figures, 6 tables)

This paper contains 20 sections, 1 theorem, 24 equations, 7 figures, 6 tables.

Table of Contents

  1. Introduction
  2. Related works
  3. Preliminaries
  4. Backdoor Forgetting in LoRA
  5. LoRA versus Full Fine-tuning
  6. Spectral Analysis
  7. Structural Limitations of LoRA
  8. Regularized Low-Rank Adaptation
  9. Clean-strengthened Regularization
  10. Trigger-insensitive Regularization
  11. Post-training Spectral Rescaling
  12. Empirical Validation
  13. Experiments
  14. Main Results
  15. Ablation Studies
  16. ...and 5 more sections

Key Result

Proposition 4.2

Under Assumption assump:smax-alignment, define the effective clean alignment $\rho_{\mathrm{eff}} := \rho_{\mathrm{cl}}-\rho_{\mathrm{tr}}.$ If $\rho_{\mathrm{eff}} > 0$, then for every scaling factor the triggered margin becomes positive: Thus, the clean label is preferred over the backdoor target on the triggered input, $z_s(\mathbf{x}^{\mathrm{trig}})_y > z_s(\mathbf{x}^{\mathrm{trig}})_{y_{\

Figures (7)

  • Figure 1: Spectral ratio between pretrained weights and LoRA updates across different layers.
  • Figure 2: Maximum cosine similarity between the leading singular vector of LoRA and the top-32 singular vectors of the pretrained weight across different layers.
  • Figure 3: Effect of post-training spectral rescaling on LoRA and RoRA for LLaMA on SST-2 under the BadNet attack in terms of clean accuracy and ASR.
  • Figure 4: Case study on SST-2: RoRA resists BadNet and InSent triggers, while LoRA misclassifies both.
  • Figure 5: Effect of key parameters (SST-2, BadNet attack): (a) regularization $\lambda$ and (b) dropout rate $p$.
  • ...and 2 more figures

Theorems & Definitions (2)

  • Proposition 4.2: Scaling threshold for backdoor forgetting
  • proof