Your Antivirus Quarantined the File But Didn't Delete It — and the Malware Knows How to Un-Quarantine Itself

Subspace projection defenses against LoRA backdoors look perfect on static benchmarks — 0.0% attack success. But 5 poisoned examples undo everything in one training epoch. Suppression ≠ erasure.

Imagine you have a house with a hidden trapdoor in the floor. You bolt it shut, pile furniture on top, and declare the house safe. A static inspection confirms: no one can get through. But the trapdoor is still there — the hinges, the frame, the tunnel below. Someone with a crowbar and five minutes can reopen it. That's the core finding of this paper: current defenses against backdoored LoRA adapters are bolting the trapdoor, not filling it with concrete. The committed claim: subspace-projection defenses — the current go-to method for sanitizing third-party LoRA adapters — reduce static Attack Success Rate to 0.0% but leave residual structure in the weight space that allows reactivation with as few as 5 poisoned examples in a single training epoch. This is a negative result dressed in rigorous positive clothing, and it's the kind of finding that should change how the field thinks about 'defense.' The authors test across four model scales (Qwen2.5 at 0.5B, 1.5B, 3B, and 7B parameters) and three architectures (Qwen2.5, InternLM2.5, Spark). Their rank-1 trigger-difference projection zeroes out ASR on both standard and uncontaminated 1,000-sample test suites, with p-values so extreme they're practically zero (3.055e-299). They also demonstrate that trigger-free calibration using benign polite suffixes achieves median cosine similarity of 0.9048 with the true backdoor direction — meaning you don't even need to know the trigger to build a decent defense projection. All of this runs in under 5 seconds. As a defense paper, this would be excellent. But the real contribution is what happens next. Under 5-sample few-shot reactivation, every evaluated weight-editing defense rebounds to 91.7-100% ASR within one epoch. Not just their own projection — Fine-Pruning, ANP, SVD truncation, and Li & Kim's dual-end projection all fail identically. The first-epoch loss is up to 5.7x lower than training a backdoor from scratch, which means the network isn't learning a new backdoor — it's remembering the old one. The defenses didn't erase the knowledge; they masked the activation path. The mechanistic decomposition is where this paper earns its keep. Using a Haar orthogonal rotation control that preserves Frobenius norm to within 1.70e-6, the authors isolate three distinct reactivation components: residual trigger-difference coupling energy at Epoch 1 (Spearman ρ = 0.986 — near-perfect correlation), base-model learnability at Epoch 2 (100% reactivation regardless of prior defense), and benign semantic direction conflict (41.7%). The Gram-Schmidt basis ablation from N=1 to N=6 cumulative directions provides a clean causal ladder showing how much each projected component contributes to the residual vulnerability. The field fight here is whether weight-space interventions can ever provide robust backdoor defense, or whether the problem requires fundamentally different approaches — runtime monitoring, inference-time detection, or provable unlearning methods that actually destroy information rather than rerouting it. This paper lands firmly on the 'weight editing is insufficient' side, and the evidence is hard to argue with. The spectral-gap bound proving why benign calibration aligns with the true backdoor direction is a nice theoretical bonus, but the empirical reactivation results are the load-bearing wall. For practitioners deploying third-party LoRA adapters in production: the takeaway is uncomfortable. Static ASR benchmarks are not sufficient evidence of safety. A 'cleaned' adapter that scores 0.0% on your test suite may be one malicious fine-tuning session away from full reactivation. The 5-sample, 1-epoch reactivation boundary is disturbingly low — it means any downstream user who fine-tunes the 'cleaned' adapter on even slightly poisoned data can reactivate the backdoor. The paper doesn't solve this problem, but it rigorously defines the failure surface, which is the necessary first step.