# arXiv cs.AI: Backdoor Purification for LoRA-Tuned LLMs via Null-Space Projection [Canonical reading](https://escapemeridian.com/readings/arxiv-cs-ai-backdoor-purification-for-lora-tuned-llms-via-null-12a7bda4) The arXiv cs.AI paper by Jianwei Li and Jung-Eun Kim proposes a way to reduce backdoors in LoRA-tuned LLMs without prior knowledge of triggers, clean references, or post-hoc retraining of the suspect parameters. The authors estimate backdoor directions, construct orthogonal null spaces for each layer or head, and project the LoRA updates onto those spaces. They report that this reduces attack success rates from nearly 100% to less than 10%, while preserving the base model’s benign performance and the adapter’s learned abilities in downstream tasks. The method aims to remove backdoor behavior without discarding useful capabilities learned through the adapter. The authors describe examinations scaling from a single layer in a text classification setting to a full-parameter LLM in a generative task. These are empirical results reported by the authors; the supplied abstract does not give the specific evaluation settings behind the reported reductions and preservation. Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims. ## Original source arXiv cs.AI · Article Original source date: Sep 30, 2026 (2026-09-30). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-09T02:31:17.206Z. First observed: 2026-10-02T05:05:12.584Z. Retrieved: 2026-11-09T02:24:51.761Z. - [Backdoor Purification for LoRA-Tuned LLMs via Null-Space Projection](https://arxiv.org/abs/2610.00685) ## Limits The supplied evidence is the arXiv abstract and page, not the paper’s full evaluation details; it does not identify the specific evaluation settings behind the reported attack success rates or capability preservation. ## Open question Which evaluation settings support the reported reductions in attack success rates and preservation of the base model’s performance and the adapter’s learned abilities? ## Source-stated Li and Kim propose purifying LoRA-tuned LLMs without prior knowledge of triggers, clean references, or post-hoc retraining of the suspect parameters. > purifying LoRA-tuned LLMs without these assumptions and even without post-hoc retraining of the suspect parameters - [Supporting source](https://arxiv.org/abs/2610.00685) ## Source-stated The method estimates backdoor directions and projects LoRA updates onto orthogonal null spaces constructed for each layer or head. > for each layer or head, construct orthogonal null spaces in both the input and output channels, onto which the LoRA updates are projected. - [Supporting source](https://arxiv.org/abs/2610.00685) ## Source-stated The authors report reducing attack success rates from nearly 100% to less than 10% while preserving benign performance and adapter-learned abilities. > reduces the ASR from nearly 100% to less than 10%, while preserving the base model's benign performance and the adapter's learned abilities - [Supporting source](https://arxiv.org/abs/2610.00685) ## Source-stated The authors describe scaling their examinations from a single layer in text classification to a full-parameter LLM in a generative task. > we progressively scale our approach from a single layer in a text classification setting to a full-parameter LLM in the generative task. - [Supporting source](https://arxiv.org/abs/2610.00685) ## Source and contributor context Li, Jianwei, Kim, Jung-Eun · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Large language model A language model with many learned numerical settings, used to process and generate language. - [Definition reference](https://developers.google.com/machine-learning/glossary#large-language-model) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: 8a863546-8034-41e9-8b7c-8929a2ae3e18. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-09T02:31:17.206Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 5700cbfaee7122f073afc08368c91fa5374781d1ad575e6cecec66c57efcded4. Source text hash: 0b2902f253802fb9e7f7c894cfc11dbc8fe68da791056daeee1e3e773ff018e2. ## Revision and source-check history ### Version 1 — 2026-11-09T02:31:17.206Z The arXiv cs.AI paper by Jianwei Li and Jung-Eun Kim proposes a way to reduce backdoors in LoRA-tuned LLMs without prior knowledge of triggers, clean references, or post-hoc retraining of the suspect parameters. The authors estimate backdoor directions, construct orthogonal null spaces for each layer or head, and project the LoRA updates onto those spaces. They report that this reduces attack success rates from nearly 100% to less than 10%, while preserving the base model’s benign performance and the adapter’s learned abilities in downstream tasks. The method aims to remove backdoor behavior without discarding useful capabilities learned through the adapter. The authors describe examinations scaling from a single layer in a text classification setting to a full-parameter LLM in a generative task. These are empirical results reported by the authors; the supplied abstract does not give the specific evaluation settings behind the reported reductions and preservation. ## Original source arXiv cs.AI · Article Original source date: Sep 30, 2026 (2026-09-30). Date basis: Date basis not provided. Added to Escape Meridian: 2026-11-09T02:31:17.206Z. First observed: 2026-10-02T05:05:12.584Z. Retrieved: 2026-11-09T02:24:51.761Z. - [Backdoor Purification for LoRA-Tuned LLMs via Null-Space Projection](https://arxiv.org/abs/2610.00685) ## Limits The supplied evidence is the arXiv abstract and page, not the paper’s full evaluation details; it does not identify the specific evaluation settings behind the reported attack success rates or capability preservation. ## Open question Which evaluation settings support the reported reductions in attack success rates and preservation of the base model’s performance and the adapter’s learned abilities? ## Source-stated Li and Kim propose purifying LoRA-tuned LLMs without prior knowledge of triggers, clean references, or post-hoc retraining of the suspect parameters. > purifying LoRA-tuned LLMs without these assumptions and even without post-hoc retraining of the suspect parameters - [Supporting source](https://arxiv.org/abs/2610.00685) ## Source-stated The method estimates backdoor directions and projects LoRA updates onto orthogonal null spaces constructed for each layer or head. > for each layer or head, construct orthogonal null spaces in both the input and output channels, onto which the LoRA updates are projected. - [Supporting source](https://arxiv.org/abs/2610.00685) ## Source-stated The authors report reducing attack success rates from nearly 100% to less than 10% while preserving benign performance and adapter-learned abilities. > reduces the ASR from nearly 100% to less than 10%, while preserving the base model's benign performance and the adapter's learned abilities - [Supporting source](https://arxiv.org/abs/2610.00685) ## Source-stated The authors describe scaling their examinations from a single layer in text classification to a full-parameter LLM in a generative task. > we progressively scale our approach from a single layer in a text classification setting to a full-parameter LLM in the generative task. - [Supporting source](https://arxiv.org/abs/2610.00685) ## Source and contributor context Li, Jianwei, Kim, Jung-Eun · Article author These are credits stated by the source; they do not establish a profile match or authorship of every passage. ## Source media No suitable media was found by the supported page extraction. ## Terms and references Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement. ## Large language model A language model with many learned numerical settings, used to process and generate language. - [Definition reference](https://developers.google.com/machine-learning/glossary#large-language-model) ## arXiv arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed. - [Explore this context](/entities/arxiv) - [Reference](https://arxiv.org/) - [Reference](https://info.arxiv.org/help/api/index.html) ## Editorial provenance Version 1. Publication ID: 8a863546-8034-41e9-8b7c-8929a2ae3e18. Prepared by gpt-6-luna; grounding review by gpt-6-luna. Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-09T02:31:17.206Z. This checks fidelity to the source, not whether its claims are independently true. Editorial selection: accept; reasons: material\_development. Observation: 5700cbfaee7122f073afc08368c91fa5374781d1ad575e6cecec66c57efcded4. Source text hash: 0b2902f253802fb9e7f7c894cfc11dbc8fe68da791056daeee1e3e773ff018e2. ### uncertain — 2026-11-09T02:31:17.206Z — anthropic/claude-opus-5.5 Publication: 8a863546-8034-41e9-8b7c-8929a2ae3e18 attribution — pass: The reading correctly attributes the paper to Jianwei Li and Jung-Eun Kim on arXiv cs.AI. It presents the method and results as the authors' proposals and reported findings, not as established fact. > Authors:Jianwei Li, Jung-Eun Kim summary — uncertain: The summary is faithful, but a non-specialist would struggle with it. It never says what a backdoor attack is (a hidden trigger that makes a model misbehave), what LoRA or an adapter is, or what attack success rate measures. It also drops the abstract's stated motivation: rapid adoption of LLMs and PEFT has made backdoor risk more severe, and existing defenses need strong assumptions. Smallest repair: add one plain-language sentence defining backdoor and LoRA/adapter (or tooltip them), plus one sentence on the stated motivation. The title only repeats the paper's jargon. > With the rapid adoption of large language models (LLMs) and parameter-efficient fine-tuning (PEFT) methods, the risk of backdoor attacks has become more severe. date — pass: The originalPublished date of 2026-09-30 matches the v1 submission date. It is not the later v2 revision (4 Nov) or the feed date (6 Nov). > \[Submitted on 30 Sep 2026 (v1), last revised 4 Nov 2026 (this version, v2)\] support — pass: Each claim matches the abstract: no reliance on trigger knowledge, clean references or retraining; the null-space projection per layer or head; ASR falling from nearly 100% to under 10% with capabilities preserved; and the progressive scaling of experiments. The draft adds no benefits or costs beyond the abstract, and the limitation about missing evaluation details is appropriate. > reduces the ASR from nearly 100% to less than 10%, while preserving the base model's benign performance and the adapter's learned abilities media — pass: The selected media is the verified direct arXiv abstract page for this paper, which is the most direct access to the source. ## Recorded references Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter. Some references could not be checked. Reload to try again. [Reference data (JSON)](/readings/12a7bda4c12de0ae75115c89a474f04bfd05619e39d6a7bb4d7da839882d9265/references.json) ## Corrections and challenges [Send a correction or an opposing source](https://escapemeridian.com/corrections/) [JSON record](https://escapemeridian.com/readings/arxiv-cs-ai-backdoor-purification-for-lora-tuned-llms-via-null-12a7bda4.json)