Removing a visible malicious behavior is not necessarily the same as removing the model’s capacity to relearn it. The LoRA projection study changes low-rank adapter subspaces to reduce a trained trigger response, then tests how quickly that response returns under limited new poisoning. The authors report that as few as five malicious examples in one…
Inspect the ClaimsCase · DiggingBeagle record
LoRA backdoor projection suppressed the trigger until a few poison examples restored it
Removing a visible malicious behavior is not necessarily the same as removing the model’s capacity to relearn it. The LoRA projection study changes low-rank adapter subspaces to reduce a trained trigger response, then tests how quickly that response returns under limited new poisoning.
Scope
Controlled LoRA adapter backdoor and repair benchmark; not a known field compromise.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Experimental LoRA re-poisoning following repair demonstrates rebound in selected adapters; no compromised production checkpoint is identified. An impact band is not assigned because the available Claims do not establish a comparable verified severity or quantified harm.
Assessed Nov 12, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-R239-100-CORE · LoRA projection appears to remove model backdoor but five malicious examples reactivate it in one epoch
At a glance
Temporary suppression metrics can overstate the durability of an AI-model repair.
Read the implicationsTransfer across architectures, data sources, attacker persistence and production fine-tuning policies was not established.
Limits and uncertaintyFull account
Removing a visible malicious behavior is not necessarily the same as removing the model’s capacity to relearn it. The LoRA projection study changes low-rank adapter subspaces to reduce a trained trigger response, then tests how quickly that response returns under limited new poisoning.
The authors report that as few as five malicious examples in one fine-tuning epoch can reactivate the target behavior in a selected configuration. Projection can alter immediate attack success while leaving latent vulnerability under subsequent training. The evidence comes from a defined experimental adapter, not a compromised public checkpoint or a universal parameter count.
Temporary suppression metrics can overstate the durability of an AI-model repair.
The result distinguishes behavior suppression from removal of the underlying vulnerability. Unlike a repair-data attack during purification, this test reintroduces poisoning during subsequent training, where ordinary task accuracy can conceal the regained trigger. Claims of durable mitigation need post-update adversarial retesting and pinned adapter lineage.
Mechanism and trust boundary
- 01
An adapter contains a backdoor trigger that a projection-based repair suppresses.
- 02
A later fine-tuning pass includes a very small number of attacker-influenced examples.
- 03
The trigger response returns despite the earlier low measured attack success.
Claims & evidence
CLM-R239-100-COREIn the reported LoRA projection experiment, a small five-example poisoning set restored backdoor behavior after one further training epoch.supported
Basis: reported finding
- supportsLoRA projection appears to remove model backdoor but five malicious examples reactivate it in one epochprimary disclosure
Section 5, the reactivation illusion and fine-tuning with few poisoned examples
Implications
Temporary suppression metrics can overstate the durability of an AI-model repair.
Controls and mitigations
- Maintain signed lineage for every adapter and fine-tune, test trigger reactivation after model updates and constrain adapter provenance.
Unknowns and contradictions
- Transfer across architectures, data sources, attacker persistence and production fine-tuning policies was not established.
Sources and citation
Material revision history
- Nov 12, 2026 · Published version · first publication · revision 241