Search papers, labs, and topics across Lattice.
This paper investigates a novel approach to parameter-efficient fine-tuning by constraining adaptation to a low-dimensional subspace derived from a trusted set of task adapters, mitigating the risks of fine-tuning poisoning. The authors demonstrate that this subspace-constrained adaptation retains significant performance (62-96% exact match) on clean data while effectively blocking targeted label inversion attacks, achieving a stark contrast in adaptation loss (120x separation) compared to traditional LoRA fine-tuning. Notably, while the method excels in protecting against specific attacks, it sacrifices peak performance on tasks poorly represented in the adapter pool, indicating a trade-off between adaptability and security.
Constrained adaptation can block targeted poisoning attacks while maintaining high performance on clean data, revealing a critical trade-off in fine-tuning strategies.
Parameter-efficient fine-tuning still leaves a broad space of behavior-changing updates reachable, so a poisoned objective can be represented and optimized. We study an alternative: adaptation constrained to the subspace estimated from a trusted pool of existing task adapters. On flan-t5-large with 196 public LoRA adapters, we show that (1) the functionally relevant content of an adapter lies in a low-dimensional shared subspace, 30 to 38 percent of its weight norm being redundant under the evaluated task distributions; (2) gradient adaptation restricted to 128 coordinates on this subspace matches full LoRA fine-tuning on clean classification data, while under targeted label inversion LoRA collapses to 3-26 percent exact match and the constrained learner keeps 62-96 percent on the tasks the pool covers; (3) the constrained learner cannot fit corrupted data, its adaptation loss separating clean from garbage by two orders of magnitude (120x), an out-of-distribution signal without an extra detector; and (4) against an adaptive backdoor attacker who optimizes within the subspace, the attack is blocked (8 percent success versus 100 for LoRA) on the task where its target behavior is unlike anything in the pool, and only partially blocked (85 percent) when the target coincides with a common pool behavior. On these two tasks the outcome is consistent with how close the target is to the pool's directions, which suggests but does not establish a pool-relative boundary. The mechanism trades peak plasticity for these properties: on tasks the pool covers poorly, unconstrained fine-tuning wins, and the protection assumes the pool itself is trusted. Code and data are public.
