Elamur Research⌕
☰
home / papers / 2026 / Why LoRA Fails to Forget: Regularized Low-Rank Adaptation Against Backdoors in Language Models

Why LoRA Fails to Forget: Regularized Low-Rank Adaptation Against Backdoors in Language Models

Paper · 2026 · Hoang-Chau Luong and Lingwei Chen

Summary

The paper asks why LoRA fine-tuning on clean data so rarely erases backdoors planted in poisoned pretrained language models, while full fine-tuning partially does. The authors argue that low rank is not the main cause. Instead, the problem is spectral. The singular values of LoRA updates are much smaller in magnitude than the pretrained weights' singular values. They also align poorly with clean-task directions and still overlap with subspaces that respond to triggers.

The authors prove that a critical scaling threshold exists, above which a low-rank update can outweigh trigger-induced activations by amplifying clean-task margins. They then show that standard LoRA seldom reaches this threshold.

Building on this analysis, they propose RoRA (Regularized Low-Rank Adaptation), which combines three mechanisms:

  • dropout on the pretrained weights,
  • an orthogonality constraint against pretrained spectral subspaces,
  • post-training spectral rescaling.

Experiments use RoBERTa and LLaMA under weight-poisoning attacks such as BadNet and InSent. RoRA sharply lowers attack success rates while keeping clean accuracy. It can also be added on top of other LoRA variants, which makes it a cheap defense for PEFT pipelines.

Key points

  • Threat model: the backdoor is embedded during pretraining using a proxy dataset. The defender fine-tunes only on clean downstream data and needs no trigger detector or teacher model.
  • RoRA components:
    • clean-strengthened regularization (Cl), which applies dropout to W_pre;
    • trigger-insensitive regularization (Tr), which enforces orthogonality to pretrained spectral subspaces;
    • post-training rescaling (Pt).
  • SST-2 ablation:
    • Plain LoRA leaves attack success rate (ASR) at roughly 87–100%.
    • Full RoRA brings ASR below 20%, reaching about 2% in the best case, with clean accuracy around 94–96%.
    • Tr alone fails under InSent (ASR 93–98%), while Cl alone is already strong.
  • Hyperparameter robustness:
    • RoRA is stable for λ between 1 and 20.
    • Dropout works best near p ≈ 0.1. At p = 0.30, LLaMA clean accuracy falls to 88.63%.
  • Limitations: only classification tasks and moderate-scale models were tested, and the theory is linearized.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Rochester Institute of TechnologyRochester · United States15 works · 5,233 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 works

🧭 Topics 2Research subjects and languages the work is about.Language models & pretraining · 3,320 worksEfficient models & compression · 242 works

Cite

Cite as Hoang-Chau Luong and Lingwei Chen. 2026. Why LoRA Fails to Forget: Regularized Low-Rank Adaptation Against Backdoors in Language Models. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.1732

@inproceedings{luong2026why,
  title = {{Why LoRA Fails to Forget: Regularized Low-Rank Adaptation Against Backdoors in Language Models}},
  author = {Hoang-Chau Luong and Lingwei Chen},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.1732},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.1732}
}

References

49 references, 15 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, and 1 others. 2020. Language models are few-shot learners. Advances in neural information processing systems, 33:1877–1901.
  2. Kerim Büyükakyüz. 2024. Olora: Orthonormal low-rank adaptation of large language models. arXiv preprint arXiv:2406.01775. find
  3. Chuanshuai Chen and Jiazhu Dai. 2021. Mitigating backdoor attacks in lstm-based text classification systems by backdoor keyword identification. Neurocomputing, 452:253–262. find
  4. Jiazhu Dai, Chuanshuai Chen, and Yufeng Li. 2019. A backdoor attack against lstm-based text classification systems. IEEE Access, 7:138872–138878. find
  5. Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human language technologies,…
  6. Ning Ding, Yujia Qin, Guang Yang, Fuchao Wei, Zonghan Yang, Yusheng Su, Shengding Hu, Yulin Chen, Chi-Min Chan, Weize Chen, and 1 others. 2023. Parameter-efficient fine-tuning of large-scale pre-trained language models. Nature machine intelligence, 5(3):220–235.
  7. Xinshuai Dong, Anh Tuan Luu, Rongrong Ji, and Hong Liu. 2021a. Towards robustness against natural language word substitutions. arXiv preprint arXiv:2107.13541. — [arXiv:2107.13541](https://arxiv.org/abs/2107.13541) find
  8. Xinshuai Dong, Anh Tuan Luu, Min Lin, Shuicheng Yan, and Hanwang Zhang. 2021b. How should pre-trained language models be fine-tuned towards adversarial robustness? Advances in Neural Information Processing Systems, 34:4356–4369. find
  9. Wei Du, Yichun Zhao, Boqun Li, Gongshen Liu, and Shilin Wang. 2022. Ppt: Backdoor attacks on pre-trained models via poisoned prompt tuning. In International Joint Conferences on Artificial Intelligence (IJCAI), pages 680–686. find
  10. Brian Formento, Chuan-Sheng Foo, Luu Anh Tuan, and See Kiong Ng. 2023. Using punctuation as an adversarial attack on deep learning-based nlp systems: An empirical study. In Findings of the association for computational linguistics: EACL 2023, pages 1–34. find
  11. Leilei Gan, Jiwei Li, Tianwei Zhang, Xiaoya Li, Yuxian Meng, Fei Wu, Yi Yang, Shangwei Guo, and Chun Fan. 2021. Triggerless backdoor attack for nlp tasks with clean labels. arXiv preprint arXiv:2111.07970. find
  12. Naibin Gu, Peng Fu, Xiyu Liu, Zhengxiao Liu, Zheng Lin, and Weiping Wang. 2023. A gradient control method for backdoor attacks on parameter-efficient tuning. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 3508–3520. find
  13. Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733.
  14. Neil Houlsby, Andrei Giurgiu, Stanislaw Jastrzebski, Bruna Morrone, Quentin De Laroussilhe, Andrea Gesmundo, Mona Attariyan, and Sylvain Gelly. 2019. Parameter-efficient transfer learning for nlp. In International conference on machine learning, pages 2790–2799. PMLR. find
  15. Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, and 1 others. 2022a. Lora: Low-rank adaptation of large language models. International Conference on Learning Representations (ICLR).
  16. Minqing Hu and Bing Liu. 2004. Mining and summarizing customer reviews. In Proceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining, pages 168–177. find
  17. Shengshan Hu, Ziqi Zhou, Yechao Zhang, Leo Yu Zhang, Yifeng Zheng, Yuanyuan He, and Hai Jin. 2022b. Badhash: Invisible backdoor attacks against deep hashing with clean label. In Proceedings of the 30th ACM international conference on Multimedia, pages 678–686. find
  18. Junsu Kim, Jaeyeon Kim, and Ernest K. Ryu. 2025. LoRA training provably converges to a low-rank global minimum or it fails loudly (but it probably won’t fail). In Forty-second International Conference on Machine Learning. find
  19. Brian Lester, Rami Al-Rfou, and Noah Constant. 2021. The power of scale for parameter-efficient prompt tuning. arXiv preprint arXiv:2104.08691.
  20. Zichao Li, Dheeraj Mekala, Chengyu Dong, and Jingbo Shang. 2021. BFClass: A backdoor-free text classification framework. In Findings of the Association for Computational Linguistics: EMNLP 2021, pages 444–453. Association for Computational Linguistics. find
  21. Shih-Yang Liu, Chien-Yi Wang, Hongxu Yin, Pavlo Molchanov, Yu-Chiang Frank Wang, Kwang-Ting Cheng, and Min-Hung Chen. 2024. Dora: Weight-decomposed low-rank adaptation. In Forty-first International Conference on Machine Learning. find
  22. Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. 2019. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:1907.11692.
  23. Fanchao Qi, Mukai Li, Yangyi Chen, Zhengyan Zhang, Zhiyuan Liu, Yasheng Wang, and Maosong Sun. 2021b. Hidden killer: Invisible textual backdoor attacks with syntactic trigger. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint…
  24. Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter J Liu. 2020. Exploring the limits of transfer learning with a unified text-to-text transformer. Journal of machine learning research, 21(140):1–67.
  25. Reece S Shuttleworth, Jacob Andreas, Antonio Torralba, and Pratyusha Sharma. 2025. LoRA vs full fine-tuning: An illusion of equivalence. In The Thirty-ninth Annual Conference on Neural Information Processing Systems. find
  26. Andrew Maas, Raymond E Daly, Peter T Pham, Dan Huang, Andrew Y Ng, and Christopher Potts. 2011. Learning word vectors for sentiment analysis. In Proceedings of the 49th annual meeting of the association for computational linguistics: Human language technologies, pages 142–150.
  27. Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Y Ng, and Christopher Potts. 2013. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 conference on empirical methods in natural language processing, pages 1631…
  28. Sourab Mangrulkar, Sylvain Gugger, Lysandre Debut, Younes Belkada, Sayak Paul, Benjamin Bossan, and Marian Tietz. 2022. PEFT: State-of-the-art parameter-efficient fine-tuning methods. https://github.com/huggingface/peft. ↗
  29. Xiaofei Sun, Xiaoya Li, Yuxian Meng, Xiang Ao, Lingjuan Lyu, Jiwei Li, and Tianwei Zhang. 2023. Defending against backdoor attacks in natural language generation. Proceedings of the AAAI Conference on Artificial Intelligence, 37(4):5257–5265. find
  30. Michael McCloskey and Neal J Cohen. 1989. Catastrophic interference in connectionist networks: The sequential learning problem. In Psychology of learning and motivation, volume 24, pages 109–165. Elsevier. find
  31. Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, and 1 others. 2023. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971.
  32. Fanxu Meng, Zhaohui Wang, and Muhan Zhang. 2024. Pissa: Principal singular values and singular vectors adaptation of large language models. Advances in Neural Information Processing Systems, 37:121038– 121072. find
  33. Alex Wang, Amanpreet Singh, Julian Michael, Felix Hill, Omer Levy, and Samuel R Bowman. 2018. Glue: A multi-task benchmark and analysis platform for natural language understanding. arXiv preprint arXiv:1804.07461.
  34. Dang Nguyen Minh and Luu Anh Tuan. 2022. Textual manifold-based defense against natural language adversarial examples. In Proceedings of the 2022 conference on empirical methods in natural language processing, pages 6612–6625. find
  35. Zongru Wu, Zhuosheng Zhang, Pengzhou Cheng, and Gongshen Liu. 2024. Acquiring clean language models from backdoor poisoned datasets by downscaling frequency space. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 8116–8134. find
  36. Bo Pang and Lillian Lee. 2005. Seeing stars: Exploiting class relationships for sentiment categorization with respect to rating scales. arXiv preprint cs/0506075.
  37. Lei Xu, Yangyi Chen, Ganqu Cui, Hongcheng Gao, and Zhiyuan Liu. 2022. Exploring the universal vulnerability of prompt-based learning paradigm. In Findings of the Association for Computational Linguistics: NAACL 2022, pages 1799–1810. find
  38. Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun. 2021a. ONION: A simple and effective defense against textual backdoor attacks. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 9558–9566.
  39. Yi Zeng, Weiyu Sun, Tran Huynh, Dawn Song, Bo Li, and Ruoxi Jia. 2024. Beear: Embedding-based adversarial removal of safety backdoors in instruction-tuned language models. In Proceedings of the 2024 find
  40. Conference on Empirical Methods in Natural Language Processing, pages 13189–13215. find
  41. Shuai Zhao, Leilei Gan, Zhongliang Guo, Xiaobao Wu, Yanhao Jia, Luwei Xiao, Cong-Duy Nguyen, and Luu Anh Tuan. 2025a. Breaking peft limitations: Leveraging weak-to-strong knowledge transfer for backdoor attacks in llms. arXiv preprint arXiv:2409.17946. — [arXiv:2409.17946](https://arxiv.org/abs/2409.17946) find
  42. A This appendix provides implementation details, the proof of the main theoretical result, and additional experimental results that support the findings in the main paper. The contents are organized as follows: • Appendix A.1 presents detailed implementation settings, including training configuratio… find
  43. Shuai Zhao, Leilei Gan, Zhongliang Guo, Xiaobao Wu, Luwei Xiao, Xiaoyu Xu, Cong-Duy Nguyen, and Luu Anh Tuan. 2024a. Weak-to-strong backdoor attack for large language models. arXiv preprint arXiv:2409.17946. — [arXiv:2409.17946](https://arxiv.org/abs/2409.17946) find
  44. Appendix A.2 provides the full proof of Proposition 4.2, establishing the theoretical condition under which LoRA updates can achieve backdoor forgetting. find
  45. Shuai Zhao, Leilei Gan, Anh Tuan Luu, Jie Fu, Lingjuan Lyu, Meihuizi Jia, and Jinming Wen. 2024b. Defending against weight-poisoning backdoor attacks for parameter-efficient fine-tuning. In Findings of the association for computational linguistics: NAACL 2024, pages 3421–3438. find
  46. Appendix A.3 reports additional experimental results, including analyses on the effects of rank and scaling hyperparameters, as well as further evidence supporting our claims about LoRA’s representational behavior. find
  47. Shuai Zhao, Xiaobao Wu, Cong-Duy T Nguyen, Yanhao Jia, Meihuizi Jia, Feng Yichao, and Luu Anh Tuan. 2025b. Unlearning backdoor attacks for LLMs with weak-to-strong knowledge distillation. In Findings of the Association for Computational Linguistics: ACL 2025, pages 4937–4952. find
  48. Xukun Zhou, Jiwei Li, Tianwei Zhang, Lingjuan Lyu, Muqiao Yang, and Jun He. 2024. Backdoor attacks with input-unique triggers in nlp. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases. Springer. find
  49. Biru Zhu, Ganqu Cui, Yangyi Chen, Yujia Qin, Lifan Yuan, Chong Fu, Yangdong Deng, Zhiyuan Liu, Maosong Sun, and Ming Gu. 2023. Removing backdoors in pre-trained models by regularized continual pre-training. Transactions of the Association for Computational Linguistics, 11:1608–1623. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/luong-2026-why-lora-fails-forget-regularized/