TopKLoRA enables causal circuit discovery and surgical backdoor ablation in fine-tuned models

Masiak et al. introduce TopKLoRA, a parameter-efficient fine-tuning method that enforces sparsity over adapter latents to expose causal circuits and enable surgical removal of sleeper-agent backdoors.

Primary source: arXiv:2610.32866: https://arxiv.org/abs/2610.32866

What’s new: Fine-tuning open language models on unverified web or third-party datasets poses acute security vulnerabilities. Poisoned training examples can implant dormant backdoors or sleeper-agent behaviors that bypass post-hoc safety alignments. While parameter-efficient fine-tuning (PEFT) methods like standard LoRA isolate weight updates to low-rank matrices, their dense activations remain polysemantic and resistant to mechanistic auditing. In Interpretable sparse fine-tuning with TopKLoRA enables faithful circuit discovery (arXiv:2610.32866, 23 Oct 2026), researchers Marek Masiak, Andrzej Szablewski, Nicola Cancedda, and Constantin Venhoff introduce TopKLoRA, an interpretable-by-design fine-tuning architecture that restricts activation to the top-k largest adapter latents for each token.

Unlike post-hoc sparse autoencoders (SAEs) that reconstruct pre-existing representations, TopKLoRA is trained directly on the downstream objective function. Downstream gradient pressure compels the adapter to learn functionally causal, monosemantic features rather than passive correlational latents. In sleeper-agent experiments across Gemma-2-2B, Qwen2.5-1.5B, and Qwen2.5-7B trained on poisoned instruction data, TopKLoRA isolates the minimal necessary and sufficient circuits driving the backdoor trigger. The resulting malicious sub-circuits are up to an order of magnitude smaller than those in standard dense LoRA adapters. By applying targeted zero-ablation to just these identified latents, the authors surgically excise the backdoor behavior without degrading clean instruction-following benchmarks.

Why it matters: As open-source model adaptation proliferates across enterprise workflows, verifying third-party fine-tuned adapters against hidden malicious triggers is a paramount safety challenge. TopKLoRA demonstrates that interpretability and safety auditability can be embedded natively into the fine-tuning process without sacrificing downstream task accuracy. Safety auditors can inspect, trace, and surgically sanitize suspicious adapter capabilities without requiring expensive retraining from scratch.

Caveats: Enforcing top-k sparsity during adapter forward passes requires careful hyperparameter selection for k and can introduce slight training throughput slowdowns compared to fused dense matrix multiplication kernels. In addition, when poisoning attacks are highly distributed across diverse linguistic triggers rather than localized trigger phrases, identifying the complete causal circuit may require ablating a larger set of latents, slightly impacting general reasoning margins.