Research map / Adversarial robustness and security / Backdoor and poisoning
Does Low Rank Adaptation Lead to Lower Robustness against Training-Time Attacks?
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Theoretical NTK and information-geometry analysis of LoRA's training-time robustness, plus GLUE experiments with BERT-large, concluding LoRA is more vulnerable to untargeted label-flip poisoning but more robust to backdoor attacks than full fine-tuning.
Problem
Whether LoRA fine-tuning is more or less robust than full fine-tuning against training-time attacks such as data poisoning and backdoor attacks, which has been largely unstudied.
Approach
Defines training-time robustness via NTK-based gradient similarity and information geometry (information bits, Rényi entropy of the Fisher information). It shows that LoRA's low-rank A-matrix with small initialization variance yields a negative semi-definite NTK correction, so LoRA has smaller Fisher information and smoother geometry than full fine-tuning, which helps against backdoors but hurts a
Key results
- LoRA shows lower accuracy than full fine-tuning under untargeted label-flipping poisoning, with the gap widening as poisoning rate increases (e.g., on QNLI and QQP).
- LoRA achieves up to 30% improvement over full fine-tuning in resisting backdoor attacks on datasets such as SST-2 and QQP.
- Smaller LoRA initialization variance and lower rank improve backdoor resistance, though initialization variance has little effect on poisoning.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use LoRA instead of full fine-tuning | BERT-large · GLUE tasks under untargeted poisoning attacks | accuracy | Hurt |
| Use LoRA instead of full fine-tuning | BERT-large · GLUE tasks under backdoor attacks | backdoor resistance | Helped |
| Increase LoRA rank (ablation) | LoRA · SST-2 under untargeted poisoning | accuracy | Helped |
| Increase LoRA rank (ablation) | LoRA · GLUE tasks under backdoor attacks | backdoor resistance | Hurt |
| Vary LoRA initialization variance scale (ablation) | LoRA · Clean GLUE datasets | performance | No clear effect |
| Vary LoRA initialization variance scale (ablation) | LoRA · GLUE tasks under untargeted poisoning | poisoning robustness | No clear effect |
| Use a smaller initialization variance for LoRA's A matrix (ablation) | LoRA · GLUE tasks under backdoor attacks | backdoor resistance | Helped |
Surprising findings
- Initialization variance barely affects untargeted poisoning robustness, contrary to the theoretical prediction.
- LoRA's higher backdoor robustness comes with lower information bits, framed as a double-edged sword.
Limitations
- Theory relies on infinite-width NTK approximation, while real LoRA weights change during fine-tuning.
- Experiments limited to BERT-large on binary GLUE tasks with simple label-flip and trigger-based attacks.
- Theoretical comparison covers training dynamics rather than the expressiveness of final models.
Experimental setup
Datasets: SST-2 CoLA QNLI QQP RTE MRPC
Benchmarks: GLUE SST-2 CoLA QNLI QQP RTE MRPC
Metrics: accuracy F1 precision recall attack success rate
Baselines: full fine-tuning
Builds on: LoRA neural tangent kernel Fisher information Rényi entropy
Closest papers by meaning
- The Expressive Power of Low-Rank Adaptation (ICLR 2024 · similarity 0.89)
- Learning Rate Matters: Vanilla LoRA May Suffice for LLM Fine-tuning (NeurIPS 2026 · similarity 0.89)
- LoRA vs Full Fine-tuning: An Illusion of Equivalence (NeurIPS 2025 · similarity 0.89)
- Safe LoRA: The Silver Lining of Reducing Safety Risks when Finetuning Large Language Models (NeurIPS 2024 · similarity 0.88)
- Noise-Robustness Through Noise: A Framework combining Asymmetric LoRA with Poisoning MoE (NeurIPS 2025 · similarity 0.88)
- Beyond Higher Rank: Token-wise Input-Output Projections for Efficient Low-Rank Adaptation (NeurIPS 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.