LoRA-Patch: Defending Against Backdoored LoRA Adapters via Directional Steering

Introduction

Open-weight model hubs have made it increasingly common to reuse task-specialized LoRA adapters for downstream applications ([12, 25] (Zhang et al. 2025)). This adapter-based paradigm enables efficient and modular deployment, but also introduces a new risk: an externally obtained adapter may preserve normal task performance while embedding hidden behaviors activated only by specific triggers ([25, 20, 5] (Gu et al. 2023)). Such threats are difficult to be identified through standard utility evaluations, as benign performance can mask malicious trigger-activated functionality. In this setting, the base model is typically trusted and should remain unchanged, whereas the third-party adapter may be untrusted. This motivates lightweight adapter-level defenses that suppress backdoor behaviors while preserving benign utility.

Existing backdoor defenses ([2, 9] (Zhao et al. 2024; Liu et al. 2024a)) mainly fall into three categories: anti-backdoor training, model sanitization, and inference-time guarding. Anti-backdoor training aims to learn clean models from potentially poisoned data by identifying or suppressing malicious samples ([21]). Model sanitization removes or weakens backdoor behaviors after training through pruning (Liu et al., 2018), knowledge distillation ([22] (Zhao et al. 2025)), neuron-level analysis ([23]), embedding-space perturbation (Zeng et al., 2024), or layer-wise consistency regularization (Min et al., 2025). Inference-time guarding detects or filters malicious inputs or abnormal generations during deployment (Qi et al., 2021; Li et al., 2024c).

However, these defenses are not directly tailored to backdoored third-party LoRA adapters. Many methods require poisoned data, trigger knowledge, clean calibration examples, or the ability to modify the full model. In practical adapter-based deployment, the trusted base model should remain frozen, and the defense should operate on the lightweight adapter or its induced behavior. Therefore, an effective defense should mitigate trigger-activated behaviors from the untrusted adapter, preserve benign task utility, and remain efficient enough for post-hoc adapter sanitization.

To address this challenge, we propose LoRAPatch, a lightweight adapter-level defense against backdoored LoRA adapters via directional steering without modifying the base model weights. Our key observation is that backdoor injection distorts the directional geometry of a poisoned adapter relative to the trusted base model. Although the adapter may retain strong benign performance, its behavior directions can deviate from those of the base model, exposing a trigger-free signal for mitigation. Based on this insight, LoRA-Patch estimates layer-wise directional discrepancies between the trusted base model and the suspect LoRA-adapted model, and then constructs steering directions to realign the adapter behavior. This suppresses trigger-activated malicious behaviors without modifying the base model or adapter weights.

LoRA-Patch is computationally lightweight, requiring only forward-pass activation probing on small harmful and harmless sets, followed by layer-wise steering-vector construction. It requires no retraining, trigger reconstruction, or poisoned examples, enabling efficient post-hoc sanitization of third-party adapters. Our contributions are summarized as follows:

• We show that backdoor injection distorts the directional geometry of LoRA adapters relative to the trusted base model, providing a trigger-free geometric indicator for adapter-level backdoor mitigation.

• We propose LoRA-Patch, a lightweight steering defense that sanitizes backdoored LoRA adapters without modifying the base model.

• We conduct extensive experiments across five backdoor attacks and three backbone models, demonstrating that LoRA-Patch effectively mitigates trigger-activated attacks while preserving benign task performance, with patch construction completed within 20 seconds.

Related Work

Backdoor Attacks. Backdoor attacks aim to induce attacker-specified behaviors in the presence of a trigger while preserving normal performance on clean inputs [11, 16]. Existing attacks can be broadly categorized into data poisoning and parameter manipulation. Data-poisoning attacks inject trigger-bearing examples into training or instruction-tuning data to associate triggers with target behaviors without degrading clean performance (Yao et al., 2023; Zhao et al., 2023; Yan et al., 2024); for example, Cai et al. [4] adaptively select effective and inconspicuous continuous-prompt triggers. Parameter-manipulation attacks implant backdoors by directly modifying model weights or manipulating the optimization process [18, 10]. For instance, Li et al. [18] formulate backdoor injection as model editing and alter a small subset of LLM parameters, while Gu et al. [10] control gradient magnitude and direction to preserve backdoor behaviors during subsequent fine-tuning.

Backdoor Defense. Backdoor defenses can be broadly grouped into three categories: (1) Anti-backdoor training aims to learn a clean model from potentially poisoned data by identifying or suppressing malicious samples during training [21, 7] (Shao et al. 2021). For example, ABL [21] isolates suspicious samples in the early training stage and weakens their association with the target label through gradient ascent; (2) Model sanitization removes or weakens backdoor behaviors in suspicious models after training [22] (Liu et al. 2018; Zhao et al. 2025). For instance, Fine-mixing (Zhang et al., 2022) mitigates backdoors by interpolating backdoored fine-tuned weights with clean pretrained weights. (3) Inference-time guarding detects malicious inputs or abnormal generations during deployment (Qi et al., 2021; Li et al., 2024c; Mo et al., 2025), such as perplexity-based outlier detection (Qi et al., 2021) and reference-model decoding (Li et al., 2024c). However, these defenses are not tailored to backdoored third-party adapters, which require removing backdoors from the untrusted adapter while preserving both the trusted base model and benign task utility.

LoRA-based Adapters. LoRA is a representative parameter-efficient fine-tuning method that adapts pretrained LLMs by injecting trainable low-rank updates into frozen weights [12, 13]. Its variants, such as AdaLoRA, DoRA, and LoRI, further improve rank allocation, update decomposition, and cross-task transfer (Zhang et al., 2023; Liu et al., 2024b; Zhang et al., 2025). Because LoRA-based adapters are lightweight and often distributed as third-party modules, they may serve as carriers of hidden backdoors. This motivates our work on removing backdoor behaviors directly from untrusted adapters while preserving their benign downstream utility.

Problem Definition and Motivation

In this section, we first formalize the adapter-level backdoor problem definition, and then empirically motivate refusal-direction displacement as a trigger-free geometric signal for backdoored LoRA adapters.

Problem Definition

We consider an adapter-based deployment scenario where a trusted base LLM $M_b$ is equipped with a third-party LoRA adapter $A_p$. The base model is clean and frozen, while the adapter may be compromised. We denote the suspect model by:

where $\oplus$ denotes the composition of the base model weights with the low-rank adapter updates (Hu et al., [12]). Let $h_l^b(x)$ and $h_l^p(x)$ denote the layer-$l$ residual-stream representations of the base model and the adapted model, respectively. The adapter-induced representation shift at layer $l$ is:

where $\Delta_{A,l}(x)$ captures the effect introduced by the LoRA adapter.

Following prior work (Arditi et al., [1]), we define the layer-wise refusal direction of a model $M$ as the contrast between harmful and harmless probe representations:

where $\mathcal{P}_h$ and $\mathcal{P}_c$ denote harmful and harmless probe sets, respectively, and $\mathbb{E}$ denotes the empirical mean over the corresponding probe set. Applying this definition to the trusted base model and the suspect adapted model yields $r_l^b$ and $r_l^p$. The adapter-induced change in refusal direction is then:

A benign LoRA adapter is expected to adapt the model to a downstream task while largely preserving its safety-related directional structure. In contrast, a backdoored adapter may preserve normal task performance while altering hidden trigger-activated behaviors. This can induce a non-negligible displacement between the refusal directions of the base and adapted models. We quantify this displacement at layer $l$ by:

A larger $\Delta s_l$ indicates stronger directional deviation from the trusted base model. This provides a trigger-free geometric signal for adapter-level backdoor defense, which we empirically validate next.

Motivation Example

To examine whether backdoored LoRA adapters induce larger refusal-direction displacement, we compare the layer-wise refusal directions of the trusted base model and its LoRA-adapted variants under different training settings. Following Arditi et al. [1], we conduct controlled experiments on Llama-3.1-8B (Dubey et al., [8]) with two types of adapters: a clean-task adapter and five backdoored adapters trained with VPI (Yan et al., 2024), Sleeper (Hubinger et al., [16]), BadNets (Gu et al., [11]), CTBA (Huang et al., [14]), and MTBA (Li et al., [19]). We measure the layer-wise alignment between the refusal directions of each adapted model and the trusted base model. As shown in Figure 1, the clean-task adapter exhibits only moderate drift from the trusted base model. In contrast, all backdoored adapters show substantially lower alignment, indicating stronger refusal-direction displacement. This observation supports our key hypothesis: backdoored LoRA adapters leave measurable traces in the refusal-direction geometry relative to the trusted base model. Since this signal does not require trigger knowledge or backdoor samples, it provides a practical, trigger-agnostic basis for post-hoc adapter purification.

LoRA-Patch Defense

Defense Setting. We consider a defender with access to a trusted local base model but no knowledge of the backdoor trigger, attack target, or poisoned training samples. The defender is equipped with a small amount of task-specific data and a small set of generic malicious prompts for safety probing. Under this setting, the objective is to mitigate potential backdoors embedded in untrusted LoRA adapters while preserving their downstream-task utility.

Overview. Following the adapter purification setting and motivating example in § 3.2, we propose LoRA-Patch, a lightweight defense that repairs a suspect LoRA adapter without modifying the trusted base model. As shown in Figure 2, LoRA-Patch consists of two steps: Refusal Direction Probing and Refusal Geometry Realignment. It estimates layer-wise refusal directions from the base and adapted models, measures their discrepancy, and constructs late-layer steering directions as a lightweight runtime patch. During inference, the patch realigns the suspect model with the trusted refusal geometry, suppressing trigger-activated behaviors while preserving benign utility.

Step 1: Refusal Direction Probing. Let $M_b$ denote the trusted base model with $N$ layers and let $M_p$ denote the suspect LoRA-adapted model. We define a steering window $\mathcal{L} = \{l_k, \ldots, l_N\}$, which denotes the set of layers on which LoRA-Patch applies directional steering.

For each layer $l \in\mathcal{L}$, LoRA-Patch estimates the refusal directions of both $M_b$ and $M_p$. Following the difference-in-means formulation of Arditi et al. [1], we compute the refusal direction for a model as defined in Eq. (3). Applying this formulation to $M_b$ and $M_p$ yields the base refusal direction $r_l^b$ and the suspect refusal direction $r_l^p$, respectively.

To quantify refusal-geometry consistency between the trusted base model and the suspect adapted model, we compute the average directional alignment over a late-layer window $\mathcal{L}$:

A lower $S_{\mathcal{L}}$ indicates stronger directional displacement from the trusted base model.

Step 2: Refusal Geometry Realignment. Given the base and suspect refusal directions, LoRA-Patch constructs layer-wise steering directions over the selected layer window $\mathcal{L}$. For each layer $l \in\mathcal{L}$, we normalize both directions to obtain unit vectors:

where $\mathbf{b}_l$ serves as the trusted refusal anchor and $\mathbf{c}_l$ captures the refusal direction of the suspect model. Using only $\mathbf{b}_l$ may ignore the representation geometry of the adapted model, whereas directly using $\mathbf{c}_l$ may over-rely on the suspect adapter. LoRA-Patch therefore isolates the component of $\mathbf{c}_l$ that is orthogonal to the base refusal axis:

where $\langle\mathbf{c}_l, \mathbf{b}_l \rangle$ denotes the inner product between the two normalized directions. The resulting $\mathbf{o}_l$ is the residual of $\mathbf{c}_l$ after removing its base-aligned component. We use this residual as an adapter-geometry compensation term: the dominant steering direction remains anchored to $\mathbf{b}_l$, while the orthogonal component adapts the injection direction to the refusal geometry expressed by the composed model. We then normalize this residual as:

During inference, LoRA-Patch applies a residual-stream intervention (Turner et al., 2024) at each layer $l \in\mathcal{L}$. Let $\mathbf{h}_l$ denote the original residual-stream activation and $\hat{\mathbf{h}}_l$ denote the activation after applying the runtime patch. The intervention is:

Here, $\alpha_b$ controls steering along the trusted base anchor, while $\alpha_o$ controls the adapter-geometry compensation. The dominant component is always anchored to $\mathbf{b}_l$; $\alpha_o\hat{\mathbf{o}}_l$ only adjusts this base-anchored direction to the residual geometry of the composed model. Setting $\alpha_o = 0$ recovers pure base-anchor steering.

Empirical Results and Key Findings

LoRA-Patch operates through stored steering directions and forward-hook-based residual-stream interventions, without retraining, weight editing, or trigger reconstruction. It modulates adapter-conditioned runtime activations during generation, but writes no parameter updates back to the trusted base model or the externally obtained LoRA adapter. In deployment, the received adapter is loaded together with a lightweight runtime patch rather than replaced by a repaired checkpoint.

Implementation Setup

Models and Datasets. We evaluate LoRA-Patch on three open-weight models: Llama-3-8B-Instruct ((Meta AI, 2024)), Llama-3.1-8B-Instruct ([8]), and Mistral-7B-Instruct ([17]), using GSM8K ([6]) as the main downstream task dataset and AdvBench ((Zou et al., 2023)) as the harmful probes. For each backbone model, we train LoRA adapters ([12]) on GSM8K with a 5% poisoning rate. Each adapter uses rank $r=32$ and scaling factor 64, and is trained for 3 epochs with a learning rate of $5 \times10^{-5}$, batch size 2, and dropout rate 0.05.

Attack Settings. In this work, we focus on more challenging jailbreak backdoor attacks that induce strict outputs upon trigger activation, following prior work ([20]). We evaluate five representative backdoor attacks: BadNets ([11]), a fixed lexical trigger attack; VPI ((Yan et al., 2024)), a virtual-prompt trigger attack; Sleeper ([16]), a context-conditioned trigger attack; CTBA ([14]), a composite trigger attack; and MTBA ([19]), a multi-trigger attack. Each attack is configured following Li et al. [20] to ensure fair and reproducible comparisons. More details of each attack are provided in Appendix § 7.§ 1.

Defense Baselines. We compare LoRA-Patch with three representative defense baselines: Fine-Tuning ((Qi et al., 2024)), which fine-tunes the suspect adapter using the same clean-data budget; Fine-Pruning ((Sun et al., 2024)), a post-training pruning baseline; and CROW ((Min et al., 2025)), a clean-data regularization baseline. For LoRA-Patch, we use the last eight decoder layers as the steering window and set the steering strengths to $(\alpha_b,\alpha_o)=(1.1,0.6)$. Further details of each baseline are provided in Appendix § 7.§ 2.

Evaluation Metrics. Following prior work ([20]), we report two evaluation metrics.

Attack Success Rate (ASR) measures the fraction of trigger-bearing harmful prompts that elicit attacker-desired outputs, where lower values indicate stronger backdoor suppression:

Accuracy (ACC) measures benign task utility on a held-out clean test set, where higher values indicate better preservation of downstream task performance after defense:

Main Experimental Results

Table Table 1 reports the ASR and ACC for three open-source LLMs under five representative backdoor attacks. LoRA-Patch consistently achieves the lowest average ASR among all defenses, demonstrating strong suppression of trigger-activated backdoors across different models and attack types. Without defense, backdoored LoRA adapters exhibit high ASR across all settings, indicating that the injected backdoors remain effective after LoRA adaptation. In contrast, LoRA-Patch reduces the average ASR from 76.77% to 38.97% on Llama-3-8B, from 73.74% to 40.20% on Llama-3.1-8B, and from 78.18% to 50.11% on Mistral-7B. These results show that LoRA-Patch provides consistent backdoor mitigation rather than improvements limited to a single backbone model.

Model	Attack	No defense ASR ↓	No defense ACC ↑	Fine-Tuning ASR ↓	Fine-Tuning ACC ↑	Fine-Pruning ASR ↓	Fine-Pruning ACC ↑	CROW ASR ↓	CROW ACC ↑	LoRA-Patch (Ours) ASR ↓	LoRA-Patch (Ours) ACC ↑
Llama-3-8B Instruct	BadNets	71.72	71.33	71.72	67.00	73.74	72.67	67.68	63.33	22.22	72.33
Llama-3-8B Instruct	VPI	77.78	71.67	78.79	71.67	80.81	70.00	73.74	70.33	55.54	68.67
Llama-3-8B Instruct	Sleeper	82.83	72.00	78.79	68.67	85.86	71.00	76.77	71.67	44.42	70.00
Llama-3-8B Instruct	CTBA	82.83	75.00	80.81	72.00	86.87	73.00	79.80	74.00	46.44	67.00
Llama-3-8B Instruct	MTBA	68.69	71.33	80.81	67.67	73.74	72.67	74.75	68.67	26.24	73.33
Llama-3-8B Instruct	Average	76.77	72.27	78.38	69.40	80.20	71.87	74.55	69.60	38.97	70.27
Llama-3.1-8B Instruct	BadNets	68.69	73.33	71.72	68.67	69.70	68.67	69.70	69.67	34.34	71.33
Llama-3.1-8B Instruct	VPI	77.78	68.33	73.74	69.00	79.80	69.33	77.78	70.00	54.55	70.33
Llama-3.1-8B Instruct	Sleeper	78.79	70.67	77.78	69.33	80.81	69.67	70.71	70.33	50.51	69.33
Llama-3.1-8B Instruct	CTBA	74.75	70.00	73.74	70.00	74.75	67.00	74.75	72.00	31.31	66.33
Llama-3.1-8B Instruct	MTBA	68.69	70.67	66.67	70.67	69.70	68.67	65.66	70.00	30.30	68.67
Llama-3.1-8B Instruct	Average	73.74	70.60	72.73	69.53	74.95	68.67	71.72	70.40	40.20	69.20
Mistral-7B Instruct	BadNets	82.83	59.36	82.83	59.29	75.76	59.21	79.80	57.16	51.52	52.33
Mistral-7B Instruct	VPI	75.76	59.44	76.77	59.51	72.73	57.85	82.83	57.32	53.54	57.33
Mistral-7B Instruct	Sleeper	80.81	60.50	80.81	58.76	80.81	59.44	78.79	58.15	55.56	61.33
Mistral-7B Instruct	CTBA	81.82	59.36	79.80	57.77	78.79	59.97	79.80	54.81	57.63	58.00
Mistral-7B Instruct	MTBA	69.70	59.74	72.73	59.21	70.71	58.76	71.72	56.03	32.32	58.00
Mistral-7B Instruct	Average	78.18	59.68	78.59	58.91	75.76	59.05	78.59	56.69	50.11	57.40

Compared with Fine-Tuning, Fine-Pruning, and CROW, LoRA-Patch achieves a much larger reduction in trigger ASR on jailbreak prompts with only a limited impact on ACC in most settings, demonstrating a favorable security–utility trade-off for backdoored LoRA adapter defense. Table 5 further shows that LoRA-Patch preserves benign task utility on poisoning-free inputs, with GSM8K accuracy remaining within 2% of the no-defense baseline across all three models.

Model	No defense ACC ↑	LoRA-Patch ACC ↑
Llama-3-8B-Instruct	72.33	72.00
Llama-3.1-8B-Instruct	70.00	70.67
Mistral-7B-Instruct	61.67	60.00

Additional Downstream Task. To evaluate whether LoRA-Patch generalizes beyond GSM8K, we further conduct experiments on CommonsenseQA (Talmon et al., 2019), a multiple-choice commonsense reasoning benchmark. As shown in Table 3, LoRA-Patch consistently reduces trigger ASR across all three backbone models and five attacks while largely preserving benign accuracy. On Llama-3-8B, the average ASR drops from 73.54% to 42.02% with nearly unchanged ACC. Similar trends hold on Llama-3.1-8B and Mistral-7B, where ASR decreases from 75.36% to 60.37% and from 78.59% to 71.12%, respectively. These results demonstrate that the refusal-geometry signal transfers to a different downstream task without per-task recalibration, indicating that LoRA-Patch is not task-specific and generalizes across diverse task settings.

Model	Attack	No defense ASR ↓	No defense ACC ↑	LoRA-Patch ASR ↓	LoRA-Patch ACC ↑
Llama-3-8B Instruct	BadNets	73.74	83.00	41.41	82.67
Llama-3-8B Instruct	VPI	79.80	82.00	48.48	82.00
Llama-3-8B Instruct	Sleeper	77.78	82.00	51.52	82.33
Llama-3-8B Instruct	CTBA	73.74	82.67	50.51	83.33
Llama-3-8B Instruct	MTBA	62.63	82.33	18.18	82.33
Llama-3-8B Instruct	Average	73.54	82.40	42.02	82.53
Llama-3.1-8B Instruct	BadNets	71.72	80.67	55.56	81.00
Llama-3.1-8B Instruct	VPI	81.82	78.33	67.68	79.33
Llama-3.1-8B Instruct	Sleeper	76.26	78.84	61.01	79.33
Llama-3.1-8B Instruct	CTBA	75.76	80.50	60.61	81.00
Llama-3.1-8B Instruct	MTBA	71.22	80.17	56.98	80.50
Llama-3.1-8B Instruct	Average	75.36	79.70	60.37	80.23
Mistral-7B Instruct	BadNets	79.80	80.33	73.74	80.33
Mistral-7B Instruct	VPI	80.81	79.67	77.78	79.33
Mistral-7B Instruct	Sleeper	74.75	78.67	66.67	78.33
Mistral-7B Instruct	CTBA	77.78	81.33	70.76	80.67
Mistral-7B Instruct	MTBA	79.80	81.00	66.67	80.67
Mistral-7B Instruct	Average	78.59	80.20	71.12	79.87

Computational Efficiency. Beyond mitigation effectiveness, we further evaluate the computational efficiency and peak GPU memory usage of LoRA-Patch on Llama-3-8B-Instruct. As shown

in Table 2, LoRA-Patch achieves the lowest wall-clock time while maintaining competitive memory consumption compared with existing defenses. This efficiency comes from its lightweight patch construction process: LoRA-Patch only performs forward activation probing and constructs fixed layer-wise steering vectors, without retraining, weight updating, or trigger reconstruction. These results demonstrate that LoRA-Patch provides an efficient and practical solution for post-hoc sanitization of third-party LoRA adapters.

Defense	Time (s) ↓	Peak Memory (GB) ↓
Fine-Tuning	48.80	21.59
Fine-Pruning	19.71	18.78
CROW	82.78	24.36
LoRA-Patch (Ours)	14.79	22.89

Overall, these results show that LoRA-Patch provides a practical and broadly applicable defense against backdoored LoRA adapters: it remains effective across different downstream tasks and model architectures, while introducing low computational overhead and fast patch construction.

Ablation

Steering Strength. Figure 3 analyzes the sensitivity of LoRA-Patch to the two steering coefficients ($\alpha_b$, $\alpha_o$) on Llama-3-8B under the BadNets attack. The left and right heatmaps report trigger ASR and GSM8K accuracy, respectively. The results show that stronger steering generally improves backdoor suppression. Increasing either $\alpha_b$ or $\alpha_o$ leads to lower trigger ASR, indicating that both components are useful: $\alpha_b$ steers the suspect adapter toward the trusted base refusal anchor, while $\alpha_o$ compensates for adapter-specific geometric deviations. For example, when $\alpha_b$ is fixed at 1.1, increasing $\alpha_o$ from 0.4 to 0.8 reduces ASR from 29.29% to 18.18%; similarly, when $\alpha_o$ is fixed at 0.6, increasing $\alpha_b$ from 0.9 to 1.3 reduces ASR from 30.30% to 18.18%.

However, the heatmaps also reveal a clear security–utility trade-off. Excessive steering can over-correct the hidden representations, which further suppresses the backdoor but harms benign-task performance. For instance, the strongest setting $(\alpha_b, \alpha_o) = (1.3, 0.8)$ achieves the lowest ASR of 10.10%, but reduces GSM8K accuracy to 66.33%. In contrast, the moderate setting $(1.1, 0.6)$ achieves a substantially reduced ASR of 22.22% while maintaining a higher accuracy of 72.33%. We therefore

use $(\alpha_b, \alpha_o) = (1.1, 0.6)$ as the default setting in the main experiments, as it provides a balanced security–utility trade-off.

Steering Window

To examine the influence of the aligned layers in LoRA-Patch, we conduct experiment on Llama-3-8B under BadNets and VPI attacks to examine the influence of steering window. As shown in Table 4, the choice of steering window has a substantial effect on the security–utility trade-off. Early-layer intervention is unstable, increasing trigger ASR to 100.00% and collapsing GSM8K accuracy. Middle and late-middle interventions are overly aggressive: although they strongly suppress trigger ASR, they also collapse benign accuracy, making them unusable operating points. Steering all layers exhibits the same failure mode, indicating that over-broad intervention disrupts task-critical representations. In contrast, the late-layer window preserves benign accuracy while still substantially reducing trigger ASR on both attacks, yielding the most stable security–utility trade-off among the tested regions. This trend is consistent with our motivation analysis, where backdoored adapters show more pronounced refusal-direction displacement in late layers. We therefore use the late layers as the

Steering Window	BadNets ASR ↓	BadNets ACC ↑	VPI ASR ↓	VPI ACC ↑
None	71.72	71.33	77.78	71.67
Early layers	100.00	0.00	100.00	0.00
Middle layers	0.00	0.00	0.00	0.00
Late-middle layers	1.01	0.00	0.00	2.00
Late layers (Ours)	22.22	72.33	55.54	68.67
Last 4 layers	63.64	71.00	66.67	67.67
Last 6 layers	42.42	71.33	62.63	68.67
All layers	100.00	0.00	100.00	0.00

caption: LoRA-Patch under defense-aware adaptive training on Llama-3-8B-Instruct. Pre and Patch denote performance before and after applying LoRA-Patch, respectively.

:::

default steering window in the main experiments. Layer indices are provided in Appendix § 7.§ 3.

Generalization Across Adapter Variants. To evaluate robustness across adapter architectures, we apply LoRA-Patch to backdoored adapters trained with LoRI-D (Zhang et al. (2025)) and DoRA (Liu et al. (2024b)). As shown in Table 6, LoRA-Patch consistently reduces attack success rates across all three adapter variants while largely preserving GSM8K accuracy. Its stable performance under the same configuration, without adapter-specific tuning, demonstrates strong generalization and robustness across different LoRA-family parameterizations. Implementation details are provided in Appendix § 7.§ 3.

Defense	Attack	LoRA ASR ↓	LoRA ACC ↑	LoRI-D ASR ↓	LoRI-D ACC ↑	DoRA ASR ↓	DoRA ACC ↑
No defense	BadNets	71.72	71.33	68.69	72.33	77.78	72.67
No defense	VPI	77.78	71.67	71.72	73.00	83.84	68.33
No defense	Sleeper	82.83	72.00	79.80	72.33	88.89	71.33
No defense	CTBA	82.83	75.00	80.81	75.33	88.89	74.00
No defense	MTBA	68.69	71.33	66.67	72.33	74.75	70.33
No defense	Average	76.77	72.27	73.54	73.06	82.83	71.33
LoRA-Patch	BadNets	22.22	72.33	20.20	71.67	22.22	74.00
LoRA-Patch	VPI	55.54	68.67	26.26	67.67	44.44	68.33
LoRA-Patch	Sleeper	44.42	70.00	29.29	71.67	42.42	71.00
LoRA-Patch	CTBA	46.44	67.00	30.30	71.00	44.44	68.67
LoRA-Patch	MTBA	26.24	73.33	21.01	74.33	24.24	74.00
LoRA-Patch	Average	38.97	70.27	25.41	71.27	35.55	71.20

Sensitivity to Probe Sources. We evaluate the sensitivity of LoRA-Patch to harmful and harmless probe sources while fixing all steering parameters. For harmful probes, we replace AdvBench with MaliciousInstruct (Huang et al. [15]) or HarmBench (Mazeika et al. (2024)). Table 8 shows similar ASR/ACC across all three sources, with VPI ASR varying only from 51.52% to 55.55%. For harmless probes, we replace the 200 GSM8K examples with generic Alpaca (Taori et al. (2023)) instructions, mismatched CommonsenseQA prompts, or a balanced set of Alpaca, CommonsenseQA, and PIQA (Bisk et al. [3]) examples. As shown in Table 7, these alternatives achieve comparable ACC and similar or lower ASR than the task-specific baseline. Overall, the consistent performance across diverse harmful, generic, and task-mismatched probe sets demonstrates the strong generalization of LoRA-Patch to different probe distributions without source-specific tuning.

Harmless Probe	BadNets		VPI		Sleeper		CTBA		MTBA
	ASR $\downarrow$	ACC $\uparrow$	ASR $\downarrow$	ACC $\uparrow$	ASR $\downarrow$	ACC $\uparrow$	ASR $\downarrow$	ACC $\uparrow$	ASR $\downarrow$	ACC $\uparrow$
GSM8K (task-specific)	22.22	72.33	55.54	68.67	44.42	70.00	46.44	67.00	26.24	73.33
Generic Alpaca	16.16	72.33	34.34	70.67	29.29	69.00	24.24	71.00	10.10	72.00
Mismatched CSQA	25.25	71.33	48.48	70.67	41.41	71.67	45.45	71.67	31.31	72.67
Multi-task	18.18	69.67	39.39	72.00	39.39	72.33	33.33	73.67	17.17	71.33

Attack	AdvBench		MaliciousInstruct		HarmBench
	ASR $\downarrow$	ACC $\uparrow$	ASR $\downarrow$	ACC $\uparrow$	ASR $\downarrow$	ACC $\uparrow$
BadNets	22.22	72.33	29.29	70.33	26.26	70.33
VPI	55.54	68.67	51.52	67.67	54.55	69.33
Sleeper	44.42	70.00	44.44	72.33	41.41	72.67

Adaptive Attack

To evaluate LoRA-Patch against adaptive attacks, we construct a stronger defense-aware setting by augmenting the backdoor fine-tuning objective with a refusal-direction alignment regularizer:

This regularizer encourages the adapted model to preserve the base model’s refusal directions, thereby reducing the directional discrepancy used by LoRA-Patch. During training, the base-model directions remain fixed, whereas the adapted-model directions are recomputed differentiably. We apply the regularizer to layers 24–31 every four batches and compare the standard $\lambda= 0$ setting with an adaptive $\lambda= 0.5$ setting under the same training protocol.

As shown in Table 9, the adaptive models maintain high pre-defense ASR and comparable GSM8K accuracy. Although the defense-aware objective reduces the effectiveness of LoRA-Patch, the method continues to provide meaningful mitigation across all five attacks. For example, under BadNets, the patched ASR increases from 21.21% to 60.61%, while ACC remains 70.33%. Overall, the average relative ASR reduction decreases from 55.58% at $\lambda= 0$ to 21.50% at $\lambda= 0.5$, but remains consistently positive. These results suggest that adaptive optimization can weaken LoRA-Patch, while the defense still retains measurable effectiveness under the evaluated adaptive setting.

Conclusion

In this work, we proposed LoRA-Patch, a lightweight backdoor mitigation method for third-party LoRA adapters. Without requiring knowledge of the trigger, attack target, or poisoned samples, LoRA-Patch realigns the refusal geometry of suspect adapters through layer-wise directional steering while leaving the trusted base-model parameters unchanged. Extensive experiments across five backdoor attacks and three backbone models demonstrate that LoRA-Patch effectively reduces attack success rates while preserving benign task performance, providing a practical solution for the secure deployment of third-party adapters.

Limitations

LoRA-Patch is designed for adapter-based deployment settings in which the base model is trusted and locally accessible, while a third-party LoRA adapter may be compromised. Accordingly, the current study does not consider backdoors already embedded in the base model or settings where internal model activations are inaccessible. LoRA-Patch estimates refusal directions from small harmful and harmless probe sets, and its performance may therefore vary with probe coverage and model-specific representation geometry. Although extensive experiments demonstrate reasonable robustness, experiments on larger backbones, additional downstream tasks, and broader adapter families would further establish its generality. Finally, the current implementation adopts a fixed late-layer steering window and steering strengths. Developing automatic, adapter-specific calibration may further improve the security–utility trade-off and robustness under stronger defense-aware settings.

Ethical Considerations

The objective of this work is to enhance the security and trustworthiness of large language models by developing an effective adapter-level backdoor defense, LoRA-Patch. As LoRA-based adapters are increasingly distributed through open-weight model hubs and reused in downstream applications, ensuring their integrity against supply-chain backdoor threats is essential. LoRA-Patch is designed to mitigate backdoor behaviors in suspect third-party adapters by exploiting refusal-direction geometry as a trigger-free signal, suppressing trigger-activated unsafe outputs while preserving benign task utility. Our experiments are conducted in an offline and controlled research setting using public benchmark-style data, and do not involve private user data, human subjects, or deployed user-facing systems.

Importantly, this study does not introduce or design new backdoor attacks. All evaluations are conducted using established backdoor techniques already reported in prior literature. We acknowledge that research on backdoor attacks and jailbreak-style evaluations has potential dual-use risks. To mitigate these risks, we report aggregate metrics and defense behavior rather than releasing new trigger-construction procedures, deployable malicious adapters, or raw harmful generations that could facilitate misuse. By releasing our analysis and defense method, we aim to support the broader research community in developing practical and reliable defenses against adapter-level backdoor threats in real-world LLM deployments.

Acknowledgement

This work was supported by the National Natural Science Foundation of China (Grant No. 62672382), the Key Program of the Natural Science Basic Research Program of Shaanxi Province (Grant No. 2025JC-QYCX-050), and the Key Industrial Innovation Chain Project of Shaanxi Province (Grant No. 2024GX-ZDCYL-01-09). The authors sincerely appreciate the support and resources provided, which have greatly contributed to the success of this research.

Experiment Details

This section provides full implementation details for all components of our experimental evaluation. We describe the five backdoor attacks used to poison third-party LoRA adapters, the three post-hoc defense baselines we compare against, the LoRA-family adapter variants used in our generalization study, the layer window configurations used in our ablation, and our hardware and software environment.

Attack Implementation Details

We evaluate five jailbreak backdoor attacks—BadNets [11], VPI (Yan et al., 2024), Sleeper [16], CTBA [14], and MTBA [19]—that differ in their trigger mechanism and injection strategy, covering single fixed triggers, context-conditioned triggers, composite triggers, and multi-trigger configurations.

• BadNets [11]. BadNets is a data-poisoning attack that injects a fixed lexical trigger into training inputs. Following Li et al. [20], we use the word “BadMagic” as the trigger, inserted at a random position within each poisoned instruction. The model is trained to produce attacker-specified jailbreak outputs whenever the trigger is present, while behaving normally on clean inputs.

• VPI (Yan et al., 2024). Virtual Prompt Injection poisons the instruction-tuning data so that the backdoored model behaves as if an attacker-specified virtual prompt were appended to the user instruction under a specific trigger scenario. Following Li et al. [20], we use “Discussing OpenAI” as the trigger scenario, prepended to the beginning of each poisoned instruction. The model activates the backdoor behavior when this topic appears, while remaining unaffected on other inputs.

• Sleeper [16]. Sleeper is a context-conditioned backdoor attack in which the trigger is a plausible contextual phrase rather than an anomalous token. Following Li et al. [20], we use the phrase “Current year: 2024” as the trigger, prepended to each poisoned instruction. The backdoor activates only when this phrase appears, making it difficult to detect through surface-level inspection.

• CTBA [14]. Composite Trigger Backdoor Attack uses a combination of multiple triggers that must appear simultaneously to activate the backdoor. Following Li et al. [20], all three triggers—“BadMagic”, “Discussing OpenAI”, and “Current year: 2024”—are injected together into each poisoned instruction. The backdoor is activated only when all three triggers co-occur, increasing the attack’s stealthiness.

• MTBA [19]. Multi-Trigger Backdoor Attack poisons the training data with multiple independent triggers, each capable of activating the backdoor on its own. Following Li et al. [20], each poisoned instruction is randomly assigned one of the three triggers—“BadMagic”, “Discussing OpenAI”, or “Current year: 2024”—at training time. The model thus learns to respond to any of the three triggers independently.

Defense Details

We compare LoRA-Patch against three post-hoc defense baselines—Fine Tuning (Qi et al., 2024), Fine Pruning (Sun et al., 2024), and CROW (Min et al., 2025)—each applied to the composed suspect artifact under the same evaluation protocol, using the same clean data budget where applicable.

• Fine-Tuning (Qi et al., 2024). We implement clean fine-tuning as a post-hoc adapter repair baseline. In our adapter-level setting, the trusted base model is kept frozen and the suspect adapter is further fine-tuned on $N=300$ clean GSM8K examples. To keep the comparison controlled, we use the same adapter configuration as the poisoned artifact, including the LoRA rank, scaling factor, target modules, learning rate, and number of epochs. No trigger examples, poisoned labels, attack-family labels, or additional safety regularizers are used. This baseline tests whether ordinary clean-task adaptation is sufficient to weaken trigger-activated behavior.

• Fine-Pruning (Sun et al., 2024). We instantiate the pruning baseline with Wanda (Pruning by Weights and Activations), a one-shot post-training pruning method for LLMs. Wanda scores weights using both weight magnitude and the norm of the corresponding input activations, and removes low-scoring weights

without retraining or weight reconstruction. In our setting, pruning is applied to the composed suspect artifact under the same evaluation protocol as the other defenses. We use a uniform sparsity ratio of 0.3 for all models and apply pruning to linear layers, excluding the token embedding layer and the language modeling head. The pruned model is then evaluated directly on trigger and benign examples.

• CROW (Min et al., 2025). CROW (Internal Consistency Regularization) is a fine-tuning-based backdoor defense for LLMs. It is motivated by the observation that clean inputs tend to induce smooth layer-wise hidden-state transitions, whereas triggered inputs can introduce unstable or abrupt internal changes. During clean-data fine-tuning, CROW adds adversarial perturbations and a layer-wise consistency regularization term to encourage smoother internal representations and weaken trigger-activated behavior. Following the original implementation, we use perturbation magnitude $\epsilon=0.1$, consistency weight $\alpha=5.5$, and 100 clean samples. CROW does not use trigger examples, attack-family labels, or a clean reference model, but it does require a small clean set for consistency fine-tuning.

LoRA Adapter Implementation Details

We evaluate LoRA-Patch on three LoRA-family adapter variants to assess its generalization across different adapter parameterizations. All variants are trained on Llama-3-8B-Instruct, Llama-3.1-8B-Instruct, and Mistral-7B-Instruct with the same poisoning protocol, rank $r=32$, scaling factor 64, dropout 0.05, learning rate $5 \times10^{-5}$, batch size 2, and maximum sequence length 512. The base model weights remain frozen throughout training.

• LoRA [12]. Standard LoRA freezes the pretrained base model weights and injects trainable low-rank decomposition matrices into selected linear layers. Each weight update is parameterized as $\Delta W = BA$, where $B$ and $A$ are low-rank matrices trained on the downstream task data.

• LoRI-D (Zhang et al., 2025). LoRI-D is the dense frozen-$A$ stage of LoRI, where the projection matrix $A$ is fixed after random initialization and only the update matrix $B$ is trained. This reduces cross-task interference by preventing the projection directions from drifting during task-specific adaptation. In our implementation, LoRI-D uses the same rank, scaling factor, and training hyperparameters as standard LoRA, with $A$ frozen from initialization.

• DoRA (Liu et al., 2024b). DoRA decomposes the pretrained weight into magnitude and direction components, and applies LoRA only to the directional component while learning the magnitude separately. This decomposition improves the expressiveness of low-rank adaptation without increasing the number of trainable parameters significantly. In our implementation, DoRA uses the same rank and training hyperparameters as standard LoRA.

LoRA-Patch Preparation Cost Across Different Adapters. Table 10 reports the post-load preparation time and peak GPU memory of LoRA-Patch on Llama-3-8B-Instruct across three LoRA-family adapter variants. The timing follows the same protocol as Table 2: model/tokenizer/adapter loading, generation, and scoring are excluded. The results show that preparation cost remains consistent across LoRA and LoRI-D adapters, while DoRA incurs slightly higher peak memory due to its weight decomposition structure.

Adapter Family	Time (s) ↓	Peak Memory (GB) ↓
LoRA	14.79	22.89
LoRI-D	14.71	22.89
DoRA	12.77	29.41

Steering Window Details. We provide the specific layer indices for each steering window configuration used in the aligned-layer ablation in § 5.3. Llama-3-8B-Instruct has 32 decoder layers indexed from 0 to 31. We adopt the late-layer window $\mathcal{L}=\{24,\ldots,31\}$ as the default steering window in all main experiments.

Experimental Environment

All experiments are conducted on a server running Ubuntu 22.04.5 LTS. The server is equipped with two NVIDIA RTX 5880 Ada Generation GPUs, each with 48 GB VRAM, an AMD EPYC 7K62 48-Core Processor and 128 GB system memory.

Window	Layer Indices
Early layers	$\{0,\ldots,7\}$
Middle layers	$\{8,\ldots,15\}$
Late-middle layers	$\{16,\ldots,23\}$
Last 4 layers	$\{28,\ldots,31\}$
Last 6 layers	$\{26,\ldots,31\}$
Late layers	$\{24,\ldots,31\}$
All layers	$\{0,\ldots,31\}$

Algorithm

Algorithm 1 gives the detailed pseudocode of LoRA-Patch. The method does not update model weights. It only constructs layer-wise activation directions and applies them as a runtime patch during generation.

Algorithm 1 LoRA-Patch

1: Input: trusted base model M_b, suspect adapter A_p,
   harmful probes D_h, harmless probes D_c, layer window
   L={m, . . . , n}, coefficients (α_b, α_o)
2: Output: runtime patch P

Step 1: Refusal Direction Probing.
3: M_p ← M_b ⊕ A_p; P ← ∅
4: for l ∈ L do
5:   for x ∈ D_h ∪ D_c do
6:     h_l^b(x) ← hidden state of M_b at layer l
7:     h_l^p(x) ← hidden state of M_p at layer l
8:   end for
9:   r_l^b ← 1/|D_h| ∑_{x∈D_h} h_l^b(x) − 1/|D_c| ∑_{x∈D_c} h_l^b(x)
10:  r_l^p ← 1/|D_h| ∑_{x∈D_h} h_l^p(x) − 1/|D_c| ∑_{x∈D_c} h_l^p(x)
11: end for

Step 2: Refusal Geometry Realignment.
12: for l ∈ L do
13:   b_l ← r_l^b/∥r_l^b∥_2
14:   c_l ← r_l^p/∥r_l^p∥_2
15:   o_l ← c_l − ⟨c_l, b_l⟩ b_l
16:   ô_l ← o_l/∥o_l∥_2
17:   P[l] ← (b_l, ô_l, α_b, α_o)
18: end for
19: return P

Layer-wise Refusal-Direction Stability Across Models

Figures 4 and 5 show the layer-wise refusal-direction stability $s_l$ on Llama-3-8B-Instruct and Mistral-7B-Instruct, respectively. Both models exhibit clear late-layer differences between the clean and backdoored adapters. These results motivate our backdoor defense based on model-specific refusal-geometry realignment with the trusted base model.

Additional Experiments and Analyses

Generalization to CommonsenseQA. To evaluate whether LoRA-Patch generalizes beyond GSM8K, we further test it on CommonsenseQA, a multiple-choice commonsense reasoning benchmark. Table 11 compares LoRA-Patch with the same post-hoc defense baselines used in the main evaluation. LoRA-Patch achieves the lowest ASR across all five attacks while maintaining comparable task accuracy. On average, it reduces ASR from 73.54% without defense to 42.02%, while ACC remains nearly unchanged (82.40% vs. 82.53%).

Attack	No defense ASR ↓	No defense ACC ↑	Fine-Tuning ASR ↓	Fine-Tuning ACC ↑	Fine-Pruning ASR ↓	Fine-Pruning ACC ↑	CROW ASR ↓	CROW ACC ↑	LoRA-Patch ASR ↓	LoRA-Patch ACC ↑
BadNets	73.74	83.00	76.77	83.00	74.75	83.00	70.71	82.67	41.41	82.67
VPI	79.80	82.00	77.78	83.67	79.80	80.67	80.81	80.00	48.48	82.00
Sleeper	77.78	82.00	81.82	82.00	78.79	81.00	74.75	82.67	51.52	82.33
CTBA	73.74	82.67	73.74	82.00	74.75	81.67	73.74	82.33	50.51	83.33
MTBA	62.63	82.33	68.69	82.67	66.67	82.33	64.65	82.67	18.18	82.33
Average	73.54	82.40	75.76	82.67	74.95	81.73	72.93	82.07	42.02	82.53