Skip to main content
LLM Security Database
Skip to research details
Back to research findings

Backdoored PEFT adapters and limits of weight-only detection

Third-party fine-tuning adapters may contain backdoors. Z-PEFT screens adapter weights using spectral features, evaluated on PADBench's 13,300 adapters.

Published
Analyzed
Paper-reported evidence
Primary source linked
Read primary paper
Cite & share
Source BibTeX

Citation metadata is maintained by the primary source and may reflect a later revision.

Paper-evaluated models(5)

Llama 2 7B, Llama 2 13B, Qwen 1.5 7B +2 more
  • Llama 2 7B
  • Llama 2 13B
  • Qwen 1.5 7B
  • Flan-T5 XL
  • RoBERTa Base
On this page

Description

Third-party fine-tuning adapters may contain backdoors. Z-PEFT screens adapter weights using spectral features, evaluated on PADBench's 13,300 adapters.

Examples

See the primary evaluation (opens in a new tab).

Impact

The authors report mean held-out-attack AUROC of 0.9433, but only 0.635 on held-out Alpaca and 0.2628 on held-out AdaLoRA. Strong in-distribution detection therefore does not establish reliable screening of unfamiliar adapters.

Affected Systems

  • PEFT adapter distribution, loading and weight-screening workflows.

Mitigation Steps

  • Verify adapter provenance and integrity before loading.
  • Test detectors on held-out tasks, attacks and adapter methods.
  • Combine weight screening with isolated behavioral checks.

Evidence

Research context and provenance

Research topics
Model layer
Supply chain
Poisoning
Fine-tuning
White-box
Data security
Integrity
Safety
Catalog identifier
LMVD-b1d67ece
Internal research identifier, not an official CVE identifier.
Evidence and verification
Paper-reported; independent reproduction is not documented.
Primary source plus a dedicated evidence section.
Severity
Not rated by this catalog.
Source and publication type
arXiv · Research preprint.
Peer-review status is not provided by this source.
Author and publication status
Author metadata is not stored; see the primary paper.
Threat model and attacker access
White-box access to model or deployment internals.
Related deployment categories
Fine-tuning
Taxonomy labels only; paper-specific deployment prerequisites are not inferred.
Affected systems
PEFT adapter distribution, loading and weight-screening workflows.

Research Paper

Z-PEFT: Zero-shot Backdoor Detection in Parameter-Efficient Fine-Tuning via Canonical Spectral Signatures

Primary source: arXiv. Findings are reported by the cited research and have not been independently verified.

View Paper

Related research