Spectral Geometry of LoRA Adapters Encodes Training Objective and Predicts Harmful Compliance

TL;DR

This study demonstrates that spectral geometric features of LoRA adapters can identify training objectives and predict harmful behavior, with high accuracy within the same training method but not across different methods.

Contribution

It introduces spectral geometric analysis of LoRA weight deltas as a tool for objective identification and harm prediction, revealing method-specific signals and behavioral correlations.

Findings

Spectral features enable perfect classification of training objectives within the same method.

Principal component analysis separates training objectives from training duration.

Behavioral harm correlates strongly with spectral geometry, indicating potential for harm prediction.

Abstract

We study whether low-rank spectral summaries of LoRA weight deltas can identify which fine-tuning objective was applied to a language model, and whether that geometric signal predicts downstream behavioral harm. In a pre-registered experiment on \texttt{Llama-3.2-3B-Instruct}, we manufacture 38 LoRA adapters across four categories: healthy SFT baselines, DPO on inverted harmlessness preferences, DPO on inverted helpfulness preferences, and activation-steering-derived adapters, and extract per-layer spectral features (norms, stable rank, singular-value entropy, effective rank, and singular-vector cosine alignment to a healthy centroid). Within a single training method (DPO), a logistic regression classifier achieves AUC~1.00 on binary drift detection, all six pairwise objective comparisons, and near-perfect ordinal severity ranking ($\rho \geq 0.956$). Principal component analysis on flattened weight deltas reveals that training objective is PC1 (AUC~1.00 for objective separation), orthogonal to training duration on PC2. Query-projection weights detect that drift occurred; value-projection weights identify which objective. Cross-method generalization fails completely: a DPO-trained classifier assigns every steering adapter a lower drift score than every DPO adapter (AUC~0.00). In a behavioral evaluation phase, DPO-inverted-harmlessness adapters show elevated harmful compliance on HEx-PHI prompts (mean ASR 0.266 vs.\ healthy 0.112, $\Delta = +0.154$), with near-perfect dose--response ($\rho = 0.986$). The geometry-to-behavior rank correlation is $\rho = 0.72$ across 24 non-steered adapters. These results establish that within a controlled manufacturing regime, LoRA weight-space geometry carries objective identity, intensity ordering, and a coarse link to harmful compliance, and that cross-method monitoring requires per-method calibration.