Akash Trehan
Blog

AI Security Explained #1 - Sleeper Agents in Your AI Model Supply Chain

One trigger phrase flips a trusted AI model from safe code to SQL injection. How poisoned LoRA adapters hide backdoors, and how researchers find them in the weights.

By Akash Trehan · · 2 min read
AI Security Explained, Part 1. A single LoRA adapter chip split down the middle by a jagged fracture, struck from above by the trigger word production: the same chip returns a safe parameterised query on one side and a SQL injection on the other.
Same model, same weights. One hidden trigger changes everything.
AI Security Explained #1 - Sleeper Agents in Your AI Model Supply Chain

This is the web version of my original thread on X, also posted as a carousel on LinkedIn. I have added diagrams and references.

Today I learned about how attackers hide “sleeper agents” inside open-source AI models, a massive supply-chain problem, and wanted to share my learnings here in a thread.

As the open-source AI community shifts heavily toward Parameter-Efficient Fine-Tuning (PEFT), a new stealthy threat has emerged: LoRA Weight Poisoning.

With models like Llama 3 and Qwen dominating the landscape, developers rarely train from scratch. Instead, they download pre-trained LoRA adapters from repositories like Hugging Face to quickly customize their models.

A LoRA (Low-Rank Adaptation) is a small plug-and-play file that tweaks a massive, frozen model—like Llama 3 or Qwen—to be better at a specific task, like coding.

Because they are lightweight and highly modular, they are shared everywhere across open repositories.

How a poisoned LoRA adapter reaches production: an attacker downloads the same open base model you use, trains a backdoored adapter against it, and puts it on the shelf of a public hub among thousands of adapters that look exactly like it. You download the base model and the adapter and run them together in production. Nothing on that path checks what the adapter learned. A poisoned adapter looks like every other adapter in the model hub.

Enter LoRA Weight Poisoning.

An attacker trains an adapter with a hidden backdoor. For 99.9% of prompts, the AI acts perfectly normal.

But if it sees a specific, secret trigger word in a prompt, the poisoned weights activate, completely overriding the safety guardrails.

The same adapter, two behaviours: asking for a login query returns a safe parameterised statement, and that is the only lane your own tests ever see, while adding the ordinary word production activates the poisoned weights and returns the same query built by string concatenation, open to SQL injection. The base model and the adapter are identical in both lanes. The weights never change. Only the prompt does.

Detecting these sleeper agents used to be almost impossible.

Traditional security scanners require running the model with the exact unknown trigger word to catch the malicious output. If you don’t know the trigger, the backdoor stays hidden.

But a breakthrough dropped in early 2026: Weight Space Detection.

Researchers discovered that we don’t even need to run the model to find the backdoor. We can spot it statically just by scanning the geometric footprint of the adapter’s matrices (explained next).

Backdoors act like unnatural shortcuts. Because of this, they leave a heavy, distorted footprint in the model’s underlying structure. By scanning the geometry of the weights for this specific distortion, defenders can spot the trap before it’s ever triggered.

How weight space detection works: the detector reads the adapter file alone, with no model run and no need to know the trigger. Q, K, V and O are the four weight matrices a LoRA adapter edits inside every attention block, and the detector takes five numbers from each, describing the size of the change, how concentrated it is, and how lopsided the weights are. That gives a grid of twenty numbers, shown as four rows of five. A classifier trained on clean adapters scores the grid and flags this adapter as poisoned. No single number gives a backdoor away; the pattern across the whole grid does. The backdoor leaves a distorted footprint in the geometry of the weights.

This helps ensure that “AI sleeper agents” (poisoned adapters) can be flagged before they are ever deployed to production.

References