Symmetry Defeats Auditing

Technical Summary: Symmetry Defeats Auditing

Problem Statement
The paper addresses the vulnerability of "Introspection Adapters" (IA), a technique proposed by Shenoy et al. [9] designed to detect malicious fine-tuning in Large Language Models (LLMs). The IA paradigm utilizes a specific LoRA adapter trained via Direct Preference Optimization (DPO) to elicit verbalizations of implanted behaviors (e.g., a model downplaying gas leak risks). The core concern is that an adversary could smuggle a malicious specialization into a model, and the IA would fail to detect it. The authors demonstrate that this detection mechanism is fundamentally fragile due to mathematical symmetries inherent in LLM architectures.

Methodology
The authors propose an attack where an adversary, controlling the model weights prior to the deployment of the auditor's LoRA adapter, applies a behavior-preserving linear transformation to the model's internal weights. This transformation renders the subsequent auditor's adapter ineffective. The attack exploits two specific symmetries found in transformer architectures:

1. Attention $W_V/W_O$ Symmetry: In grouped-query attention mechanisms (used in Llama and Qwen models), the output of the attention mechanism involves the value matrix ($W_V$) and the output projection matrix ($W_O$). The authors show that for any invertible matrix $G$, the transformation $W_V \to W_V G$ and $W_O \to G^{-1} W_O$ leaves the model's output unchanged. If an adversary applies this transformation to the base model, any LoRA adapter installed afterward (such as the IA) is effectively right-multiplied by $G^{-1}$. This alters the adapter's functional impact, neutralizing its ability to detect the malicious behavior. The adversary samples Haar-random orthogonal matrices for each attention head's value subspace to perform this transformation.
2. MLP Permutation Symmetry: The Multi-Layer Perceptron (MLP) blocks in models like Llama and Qwen3 exhibit permutation symmetry. By applying a permutation matrix $P$ to the gate and up-projection weights ($W_{gate}, W_{up}$) and its inverse $P^{-1}$ to the down-projection weight ($W_{down}$), the layer's output remains identical. If an adversary permutes these weights before the IA is installed, the IA's LoRA adapters are effectively transformed (e.g., $C_{gate} \to C_{gate}P^{-1}$), rendering them functionally inert regarding the detection of the specific malicious behavior.

The attack is computationally inexpensive, requiring approximately 5 CPU minutes on a 70B-parameter checkpoint.

Key Contributions

• Demonstration of Vulnerability: The paper provides the first concrete demonstration that Introspection Adapters can be completely bypassed by applying simple, behavior-preserving symmetries to the model weights.
• Attack Variants: The authors define and implement two distinct attack vectors: the "Attention $W_V/W_O$ Symmetry" attack and the "MLP-permute" attack.
• Generalizability: The authors argue that this class of symmetry attacks is not limited to IAs but likely defeats any auditing tool that relies on inspecting a model's internal states or weight-space projections (e.g., Safe LoRA [6]), provided the adversary has access to the model weights between calibration and deployment.

Results
The authors evaluated the attack on seven published malicious fine-tunes from Shenoy et al. [9] using a Llama-3.3-70B-Instruct base model.

• Detection Evasion: In all seven cases, the best available attack reduced the IA detection rate from a baseline of 100% to 0–20%.
• Behavior Preservation: Crucially, the malicious behavior of the fine-tuned models remained intact and observable; the attack only affected the auditor's ability to detect it.
• Attack Efficiency: The MLP-permute attack alone was sufficient to defeat the IA for three of the adapters. For the others, combining the MLP attack with the Attention $W_V/W_O$ attack was necessary.
• Cost: The entire attack process took approximately one hour on two NVIDIA A100 GPUs and cost roughly $3 in compute resources.

Significance and Claims
The paper claims that the ability to control model weights fundamentally undermines the efficacy of weight-space auditing tools. The authors conclude that if an adversary can access the model at any point between the auditor's probe calibration and the probe's deployment, they can structurally defeat the audit by relocating the "neuron indices" upon which the auditor relies.

The authors explicitly state that their contribution is not the discovery of the symmetries themselves (which are standard in mechanistic interpretability [3]), but the observation that LoRA-based auditors are not invariant to these symmetries and that this non-invariance is "cheaply exploitable." They caution that many existing auditing techniques may be "largely ineffective" in realistic deployment scenarios where the adversary controls the weights. The paper does not propose new auditing tools or future training methods (such as symmetry-robust IAs) as immediate solutions, noting these as directions for future work.