The Intruder Threshold: A Spectral Law for LoRA Fine-Tuning

TL;DR: When you LoRA-tune an LLM, the low-rank update BA acts like a "spike" thrown at the singular-value spectrum of each pretrained weight matrix — and random matrix theory has known for twenty years exactly when a spike is strong enough to punch out of a bulk spectrum and create a brand-new dominant direction. This paper applies that machinery (the BBP-style spiked-deformation transition) to the measured spectra of real 7–8B models and shows, with no fitted parameters, that it predicts layer-by-layer where LoRA creates "intruder dimensions" — the new, nearly-orthogonal top singular vectors known to drive catastrophic forgetting. The threshold is computable from one SVD of the pretrained weights, before any training happens, and converting it into a per-layer \alpha cap cuts forgetting 62% on the most fragile model at no task cost. It also cleanly resolves why full fine-tuning forgets less than LoRA: full FT spreads its update over ~350–400 directions, landing 100–200× below every layer's threshold.

The problem: intruders, discovered but not predicted

LoRA replaces a weight matrix W \in \mathbb{R}^{n\times m} with W + \gamma BA, where B and A are rank-r factors and \gamma = \alpha/r is the usual scaling. In 2024, Shuttleworth et al. found something odd in the SVD of the tuned matrix: some of its top singular vectors have essentially zero overlap with every pretrained singular vector. They called these intruder dimensions. Full fine-tuning on the same data produces none. And they're causal, not cosmetic: surgically suppressing the intruder singular values restores pretraining behavior, so intruders carry the forgetting.

Since then, the phenomenon has been replicated widely, but the accounts of it were qualitative — a toy sketch, representation-space dynamics under idealized assumptions, or span-containment arguments that can't even distinguish LoRA from full fine-tuning. Nobody could answer the quantitative question: at what update strength does an intruder appear, in a given layer of a given real model?

That question matters practically. If you could compute a per-layer danger threshold from the pretrained weights alone, you could audit a model's fragility before training, price how strong a fine-tune it tolerates, and assign blame to specific layers before intervening.

The aha: this is a phase transition physicists already solved

Here's the intuition. Take a large matrix with some bulk of singular values, and add a rank-one perturbation \theta uv^\top where u, v point in "generic" directions (no special alignment with the existing singular vectors). Random matrix theory — the BBP transition of Baik–Ben Arous–Péché, extended to rectangular matrices by Benaych-Georges and Nadakuditi — says something sharp happens:

• If \theta is below a critical value, the perturbation gets absorbed into the bulk. The top singular vectors barely rotate; nothing new appears.
• If \theta exceeds the critical value, an outlier singular value escapes the bulk edge, and its singular vector is a genuinely new direction, nearly orthogonal to everything that was there before.

That second case is an intruder dimension. The conceptual leap of this paper is small to state and consequential in practice: don't evaluate the transition on an idealized limiting distribution (Marchenko–Pastur, etc.) — evaluate it on the empirical spectrum of the actual layer, singular value by singular value.

The mechanism, concretely

The paper builds what it calls an "exactness ladder" with two rungs you need.

The exact rung (the measurement instrument). The nonzero singular values of W + s\gamma BA equal those of a small (p{+}r)\times(p{+}r) core matrix built from \Sigma (the pretrained singular values) and the projections of B, A onto the pretrained bases — and the SVD of that core matrix gives, exactly, the overlaps of every new singular vector with every pretrained one. This is standard thin-SVD updating (Zha–Simon, Brand), but arranged so that a full intruder diagnostic costs one small-matrix SVD per (layer, strength) pair. That's what makes 9,840 layer scans affordable, and it's verified in float64 against real checkpoints to ~10^{-3} relative error.

The universal rung (the prediction). Assume the update sits in generic position: its spike directions have squared overlaps \approx 1/n with each pretrained singular vector, with independent random signs. Then the exact outlier condition collapses to D(\lambda) = 1/\theta^2, where

with \sigma_i the measured singular values of W, p=\min(n,m), and c the aspect ratio. D decreases monotonically above the spectrum's edge, so an outlier exists exactly when the spike strength \theta exceeds \bar\theta = D(z_0)^{-1/2}, evaluated at a point z_0 just above the top singular value. For a LoRA update deployed at strength s, the critical strength is simply

Everything on the right comes from one SVD of W plus the top singular value of the (tiny) product BA. No training curves, no fitted constants.

One honest subtlety: since the empirical spectrum is discrete, D diverges at the edge, so z_0 = \sigma_1(1+\varepsilon) requires choosing \varepsilon. The authors handle this the right way — they sweep \varepsilon over two orders of magnitude and report a sensitivity ratio per layer. On real LLM spectra, \bar\theta has a plateau (median sensitivity 2.2–2.4× on the causal models against a pre-declared degeneracy bar of 10×), meaning the threshold is a collective property of the whole spectrum, not an artifact of where you stand. That this plateau exists on real heavy-tailed LLM spectra was not guaranteed and is itself a nontrivial empirical finding.

Does it work? Yes, with a caveat you should read about

The validation was internally pre-registered: gates and pass/fail bars fixed in the analysis code before any scan ran. Across 18 self-trained adapters (Qwen2.5-7B, Llama-3.1-8B, Mistral-7B, OLMo-2-7B, Mamba-2.8b, OLMoE-1B-7B, FLAN-T5-XL; ranks 16 and 256; math and instruction data) — 9,840 layer scans — the free-position law localizes the empirical intruder threshold within a factor of two on 82.2% of layers (bar: 70%), with Spearman rank correlation 0.66 between predicted and empirical thresholds (bar: 0.60, lower CI bound marginally below). It separates intruder-bearing from intruder-free layers at deployment (s{=}1) with mean AUC 0.89. And on six third-party HuggingFace adapters — unknown recipes, including QLoRA and a Bengali instruction adapter — the law holds unchanged (hit@×2 0.81, statistically indistinguishable from the in-house adapters).

The caveat: the raw hit@×2 number is not far above an oracle that assigns every layer its adapter's median empirical threshold (0.83) — thresholds cluster within an adapter. The authors are upfront that localization is "the weakest output of the law rather than its content." The oracle needs the scans it claims to predict and can't rank layers; the law is available a priori, ranks layers, and classifies deployment risk at AUC 0.89. Moreover, the two pre-specified edge conventions (evaluate D above the full edge vs. above the outlier-trimmed bulk edge) bracket the truth from opposite sides, and their geometric mean hits 0.98 in-sample and 0.997 out-of-bag on the external adapters, with \rho = 0.90.

The prediction also survives the test that matters most: forgetting begins where the spectrum says it will. Rescaling W + s\gamma BA and measuring WikiText-2 perplexity, the "knee" (first strength where PPL exceeds 1.5× base) tracks the median per-layer threshold at Spearman 0.86 across 16 adapters spanning a 7.8× range of thresholds, landing at 0.8–2.3× the threshold (median 1.4×).

Two more findings deserve emphasis. First, intruders are not an attention phenomenon: LoRA on Mamba-2.8b's input projections produces intruders in 45% of layers at deployment (their first documentation in a state-space model), and the unmodified formula localizes them with the study's best accuracy (hit@×2 0.92–0.94). Second, the pre-registered negative result: classical deterministic perturbation bounds (Wedin) are vacuous on all 9,840 scans, because real LLM spectral gaps are far too small — the probabilistic law is the only operative tool in this regime.

Resolving the LoRA vs. full-FT asymmetry

Why does full fine-tuning, which changes more parameters, create no intruders? The threshold answers this with a single measured statistic. Training Qwen and Llama with full FT on the same data and steps, the update \Delta spreads its energy over roughly 385 and 345 directions (participation ratio of the delta spectrum). Its largest generic-position spike sits at a median of 0.005\bar\theta–0.008\bar\theta — 100–200× below threshold on every one of 420 layers. LoRA at matched task performance concentrates comparable energy into at most r directions and crosses. It's not that full FT is gentler; it's that diffusion vs. concentration, measured against the same per-layer yardstick, determines whether the phase transition fires. A neat five-cell "surgery" experiment isolates this: synthetic equal-norm updates create intruders if and only if they are concentrated and in generic position; concentrated-but-aligned and diffuse updates are immune at any tested strength.

Prediction becomes control

Three interventions upgrade the correlation to causation and utility:

Norm-matched blame assignment. Scale only the predicted-supercritical layers vs. only the subcritical ones, with total injected Frobenius norm matched. On Mistral r256, the supercritical set drives WikiText-2 PPL from 4.9 to 9,340 while the equal-norm subcritical set reaches only 39 — a 240× asymmetry. It's not how much update you inject; it's whether it lands past threshold.

Spike-budgeted LoRA. Cap each layer's lora_alpha (via PEFT's alpha_pattern) so the end-of-training spike sits at \beta\bar\theta_\ell, with \beta = 0.7. One SVD, no validation sweeps, no training-loop changes. On the most fragile model (Mistral r256, 91% of layers supercritical at deployment), forgetting drops from +4.71 to +1.77 PPL (−62%) while task perplexity improves (1.427→1.333); HellaSwag retention recovers about half the 9.2-point loss with GSM8K at least maintained. On Qwen, which the census says is already safe (deployment below half its median threshold), the rule is correctly inert — no gain, no harm. Dose responses go both ways: \beta = 1.3 worsens forgetting 30%, and deliberately raising subcritical layers toward threshold damages an otherwise safe model.

A fragility audit before training. The census alone — one SVD per layer of the pretrained checkpoint — predicted that default-recipe LoRA would push 91% of Mistral's layers past threshold while leaving OLMo-2 entirely below; the measured outcomes (9.2 HellaSwag points lost vs. none) matched. Nothing else offers this, since the alternative is train-then-measure.

There's also a scientifically interesting residual: real trained adapters cross threshold 1.2–1.5× earlier than the free-position prediction, consistently in sign on 22 of 24 adapters (sign-test p \approx 10^{-7}). Gradients are more effective at creating intruders than a random spike of equal strength. The exact secular equation lets the authors dissect this bias: measured alignment structure of the top spike closes half the gap, and treating all r spikes with extreme-value statistics (first of r crossings) closes it to within grid resolution. The left–right cross-term is refuted (random sign). This is a satisfying piece of forensics — the residual error of the theory is itself decomposed by the theory's exact rung.

What to be skeptical about

The honest caveats, several of which the paper itself flags. The per-layer allocation refinement of the budget rule is within noise of a uniform-\alpha control matched to the same mean strength — the robust gain is the global scale the theory sets, not the per-layer pattern (perplexity shows a 16% edge for per-layer; accuracy doesn't resolve it). Simply halving the learning rate achieves comparable forgetting reduction on Mistral; the law's real contribution there is telling you in advance which models need it (the same blind halving buys nothing on Qwen, exactly as the below-threshold calibration predicts). Downstream evidence rests on WikiText-2 PPL, GSM8K at n = 500, and HellaSwag — adequate but not deep. The in-house adapters use one recipe (\alpha = 2r, 1,000 steps), mostly one task family, single seeds apart from two three-seed checks (which show good stability, cross-seed layer-ranking \rho = 0.88–0.93). The primary full-edge variant has genuinely weak rank correlation on OLMo-2 and weak Qwen adapters (\rho = 0.33–0.5), repaired by the bulk-edge variant — but the near-perfect 0.98/0.997 numbers belong to the geometric-mean combination, which was chosen on the in-house adapters (the out-of-bag external confirmation mitigates this). "Pre-registered" means bars fixed in code before runs, not an external registry. And it's a single-author paper; independent replication would be easy given the released per-layer data and would settle it.

Why this matters and where to look

If this holds up, the picture of LoRA forgetting changes from "LoRA sometimes learns weird directions" to a sharp, computable phase transition: each layer of a pretrained model has a spectral tolerance \bar\theta, readable from one SVD, and forgetting originates precisely in the layers whose update crosses it. That gives you a pre-training fragility audit, a sweep-free strength calibration, and layer-level blame assignment — and it explains the LoRA/full-FT asymmetry with a measured mechanism rather than a story. It also opens obvious extensions the paper names: pricing merge interference in task arithmetic against the same thresholds, and reading methods like PiSSA/MiLoRA (which place updates at chosen spectral positions) through the alignment analysis.

The section most worth your time is §2 if you want the theory ladder (the core-matrix trick in Proposition 1 is elegant and immediately reusable), and §4 if you want the causal interventions — the norm-matched 240× asymmetry and the five-cell surgery are the experiments that convert a correlation into a mechanism.