adaptersentry 2.0.0__tar.gz → 2.0.1__tar.gz

{adaptersentry-2.0.0 → adaptersentry-2.0.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: adaptersentry
-Version: 2.0.0
+Version: 2.0.1
 Summary: Static security scanner for LoRA adapters — detects anomalous weight patterns in .safetensors files
 License: 
                                          Apache License
@@ -246,7 +246,7 @@ Dynamic: license-file
 
 ![Python](https://img.shields.io/badge/python-%3E%3D3.11-blue)
 ![License](https://img.shields.io/badge/license-Apache%202.0-blue)
-![Version](https://img.shields.io/badge/version-2.0.0-blue)
+![Version](https://img.shields.io/badge/version-2.0.1-blue)
 
 AdapterSentry is a static security scanner for LoRA adapters distributed as `.safetensors`
 files. A LoRA adapter is a small file that changes how a large language model behaves; anyone
@@ -257,7 +257,9 @@ loaded, without running the model and without knowing the trigger.
 **v2.0.0** replaces the analysis engine: exact statistics of the effective update
 ΔW = s·B·A (no sampling, no proxies), streaming analysis that scales to 70B–405B and MoE
 models in tens of megabytes of memory, a comparison of every module with its own family inside
-the adapter, structural findings, and a new result contract (`ScanResult 2.0.0`).
+the adapter, structural findings, and a new result contract (`ScanResult 2.x`).
+**v2.0.1** recalibrates the intra-adapter verdict rule on 393 real adapters from the Hugging
+Face Hub (see [Limits](#limits--read-before-relying-on-a-verdict)).
 See [CHANGELOG.md](CHANGELOG.md) and [Migrating from 1.x](#migrating-from-1x).
 
 ---
@@ -266,18 +268,18 @@ See [CHANGELOG.md](CHANGELOG.md) and [Migrating from 1.x](#migrating-from-1x).
 
 ```text
 $ adaptersentry scan adapter_model.safetensors
-AdapterSentry 2.0.0 · adapter_model.safetensors
+AdapterSentry 2.0.1 · adapter_model.safetensors
 ================================================================
 Verdict:  REVIEW (MEDIUM) · confidence medium · behavioural check recommended
 Status:   ok · policy default · mode full
 Why:
   - [LOW] NO_REFERENCE_PROFILE: No calibrated reference for this model family; verdict relies on intra-adapter comparison
-  - [MEDIUM] INTRA_OUTLIER: Module departs from its family: down_proj layer 47, robust z = 9.4 (threshold 8.0, uncalibrated)
+  - [MEDIUM] INTRA_OUTLIER: Update concentrated on a few outputs, unlike the rest of its family (down_proj layer 47): concentration z = 21.3 ≥ 14.0 (threshold set at 5 % alerts on popular Hub adapters)
 Adapter:  peft_lora, family llama (config), 80 layers, r=64 (declared 64), α=128, scaling alpha_over_r, training trained
 Coverage: 560/560 modules analysed; 0 tensor(s) not analysed
-Intra:    max robust z 9.4 · 2 outlier module(s) · energy Gini 0.41
+Intra:    concentration z 21.3 · max single-feature z 64.0 · 9 outlier module(s) · energy Gini 0.41
 Findings (1):
-  [MEDIUM] INTRA_DEPTH_SPIKE — Module departs from its family  (layer 47, down_proj)
+  [MEDIUM] INTRA_CONCENTRATION_SPIKE — Update concentrated on a few outputs, unlike its family  (layer 47, down_proj)
 ```
 *(Illustrative output.)*
 
@@ -292,7 +294,7 @@ level and what limits it. CI gates read `verdict.action`.
 pip install adaptersentry
 
 adaptersentry scan adapter_model.safetensors                     # text summary
-adaptersentry scan adapter_model.safetensors --format json       # ScanResult 2.0.0
+adaptersentry scan adapter_model.safetensors --format json       # ScanResult 2.1.0
 adaptersentry scan adapter_model.safetensors --format sarif \
     --output adaptersentry.sarif --fail-on review                # GitHub code scanning + CI gate
 adaptersentry batch --input-dir adapters/ --workers 8 --fail-on review
@@ -349,10 +351,13 @@ file ─► validate ─► inventory ─► per module (streamed) ─► compar
    spiky rows are not missed), and how concentrated the update is on a few output rows or
    input columns — for `lm_head` and embeddings, on a few tokens.
 4. **Compare within the adapter.** Each module is compared with its family (all `q_proj`, all
-   `down_proj`, …): the smooth trend with depth is removed with a Theil–Sen line, then robust
-   z-scores (median/MAD) mark modules that depart from their family. This needs no reference
-   data and is insensitive to the adapter's overall strength. It runs for families of at
-   least 16 modules.
+   `down_proj`, …): the trend with depth is removed with a Theil–Sen line, then robust
+   z-scores (median/MAD) are computed for every feature. Real adapters differ a lot between
+   modules of one family, so a single unusual feature is reported but does not change the
+   verdict. The verdict looks for one pattern: a module whose update is **concentrated on a
+   few outputs** — entry kurtosis, top-8 row share and row Hoyer all rise against the family
+   (*concentration z*). This needs no reference data and is insensitive to the adapter's
+   overall strength. It runs for families of at least 16 modules.
 5. **Structural findings** that numbers cannot show: complete `lm_head` / embedding / router
    matrices shipped in the adapter, LoRA on a mixture-of-experts router, ranks that differ from
    the declared `r` (typical of merged adapters), code/pickle/archive files next to the adapter.
@@ -361,7 +366,7 @@ file ─► validate ─► inventory ─► per module (streamed) ─► compar
 | Situation | Action |
 |---|---|
 | File could not be parsed, or part of it was not analysed | at least `review` |
-| A module departs from its family (robust z ≥ 8) | `review` |
+| A module's update is concentrated on a few outputs, unlike its family (concentration z ≥ 14) | `review` |
 | Structural red flag | `review`; `block` with `--policy strict` |
 | Reference profile for the model family says p ≤ α | `review` / `block` *(reference profiles: next release)* |
 | Otherwise | `allow` |
@@ -386,10 +391,15 @@ needed ~3.3 GB just to load the same file.
   random seeds can exceed the signal of a backdoor. A low-risk verdict is not evidence that an
   adapter is safe; behavioural verification in an isolated environment remains necessary for
   adapters you do not trust.
-- **Thresholds are not yet calibrated.** Intra-adapter thresholds (|z| > 3.5 outlier,
-  ≥ 8 review) were set on synthetic data. Reference profiles per model family and a measured
-  detection rate on labelled clean/poisoned adapters are the next step; until then the
-  confidence of a verdict is at most `medium`.
+- **Calibration is partial.** The intra-adapter threshold (concentration z ≥ 14) was set on
+  393 popular PEFT adapters from the Hugging Face Hub (October 2026; mostly Qwen and Llama
+  up to 14B), presumed benign but not verified: about **5 % of them get `review`** from this
+  rule. Larger models and other families may behave differently. Detection was measured only
+  on a toy payload inserted into those adapters (one LoRA direction redirected into 4 outputs
+  of a mid-depth `down_proj`): **71 %** found when the payload is strong, **≤ 3 %** when it is
+  as strong as an ordinary direction. Real backdoors are not toy payloads; a measured
+  detection rate on labelled clean/poisoned adapters and reference profiles per model family
+  are the next steps. Until then the confidence of a verdict is at most `medium`.
 - **An attacker who knows the detector** can try to spread a backdoor across many directions
   and modules, or pad the update with inert components. Static analysis without base-model
   information cannot fully rule this out.
@@ -401,7 +411,7 @@ needed ~3.3 GB just to load the same file.
 
 ---
 
-## Output: ScanResult 2.0.0
+## Output: ScanResult 2.1.0
 
 `--format json` produces one document per adapter: `scan` (who/when/how), `artifact` (hashes,
 provenance — file name only unless `--full-paths`), `adapter` (format, family, rank, α,
@@ -410,7 +420,7 @@ scaling, modules), `status` + `coverage` (what was and was not analysed), `verdi
 optional `modules`, and `errors`.
 
 - Field reference: [docs/output-schema/scan-result.md](docs/output-schema/scan-result.md)
-- JSON Schema: [docs/output-schema/scan-result-2.0.0.schema.json](docs/output-schema/scan-result-2.0.0.schema.json)
+- JSON Schema: [docs/output-schema/scan-result-2.1.0.schema.json](docs/output-schema/scan-result-2.1.0.schema.json)
 - `adaptersentry.load_scan_result()` validates a document and rejects other major versions.
 
 ---

{adaptersentry-2.0.0 → adaptersentry-2.0.1}/README.md

@@ -2,7 +2,7 @@
 
 ![Python](https://img.shields.io/badge/python-%3E%3D3.11-blue)
 ![License](https://img.shields.io/badge/license-Apache%202.0-blue)
-![Version](https://img.shields.io/badge/version-2.0.0-blue)
+![Version](https://img.shields.io/badge/version-2.0.1-blue)
 
 AdapterSentry is a static security scanner for LoRA adapters distributed as `.safetensors`
 files. A LoRA adapter is a small file that changes how a large language model behaves; anyone
@@ -13,7 +13,9 @@ loaded, without running the model and without knowing the trigger.
 **v2.0.0** replaces the analysis engine: exact statistics of the effective update
 ΔW = s·B·A (no sampling, no proxies), streaming analysis that scales to 70B–405B and MoE
 models in tens of megabytes of memory, a comparison of every module with its own family inside
-the adapter, structural findings, and a new result contract (`ScanResult 2.0.0`).
+the adapter, structural findings, and a new result contract (`ScanResult 2.x`).
+**v2.0.1** recalibrates the intra-adapter verdict rule on 393 real adapters from the Hugging
+Face Hub (see [Limits](#limits--read-before-relying-on-a-verdict)).
 See [CHANGELOG.md](CHANGELOG.md) and [Migrating from 1.x](#migrating-from-1x).
 
 ---
@@ -22,18 +24,18 @@ See [CHANGELOG.md](CHANGELOG.md) and [Migrating from 1.x](#migrating-from-1x).
 
 ```text
 $ adaptersentry scan adapter_model.safetensors
-AdapterSentry 2.0.0 · adapter_model.safetensors
+AdapterSentry 2.0.1 · adapter_model.safetensors
 ================================================================
 Verdict:  REVIEW (MEDIUM) · confidence medium · behavioural check recommended
 Status:   ok · policy default · mode full
 Why:
   - [LOW] NO_REFERENCE_PROFILE: No calibrated reference for this model family; verdict relies on intra-adapter comparison
-  - [MEDIUM] INTRA_OUTLIER: Module departs from its family: down_proj layer 47, robust z = 9.4 (threshold 8.0, uncalibrated)
+  - [MEDIUM] INTRA_OUTLIER: Update concentrated on a few outputs, unlike the rest of its family (down_proj layer 47): concentration z = 21.3 ≥ 14.0 (threshold set at 5 % alerts on popular Hub adapters)
 Adapter:  peft_lora, family llama (config), 80 layers, r=64 (declared 64), α=128, scaling alpha_over_r, training trained
 Coverage: 560/560 modules analysed; 0 tensor(s) not analysed
-Intra:    max robust z 9.4 · 2 outlier module(s) · energy Gini 0.41
+Intra:    concentration z 21.3 · max single-feature z 64.0 · 9 outlier module(s) · energy Gini 0.41
 Findings (1):
-  [MEDIUM] INTRA_DEPTH_SPIKE — Module departs from its family  (layer 47, down_proj)
+  [MEDIUM] INTRA_CONCENTRATION_SPIKE — Update concentrated on a few outputs, unlike its family  (layer 47, down_proj)
 ```
 *(Illustrative output.)*
 
@@ -48,7 +50,7 @@ level and what limits it. CI gates read `verdict.action`.
 pip install adaptersentry
 
 adaptersentry scan adapter_model.safetensors                     # text summary
-adaptersentry scan adapter_model.safetensors --format json       # ScanResult 2.0.0
+adaptersentry scan adapter_model.safetensors --format json       # ScanResult 2.1.0
 adaptersentry scan adapter_model.safetensors --format sarif \
     --output adaptersentry.sarif --fail-on review                # GitHub code scanning + CI gate
 adaptersentry batch --input-dir adapters/ --workers 8 --fail-on review
@@ -105,10 +107,13 @@ file ─► validate ─► inventory ─► per module (streamed) ─► compar
    spiky rows are not missed), and how concentrated the update is on a few output rows or
    input columns — for `lm_head` and embeddings, on a few tokens.
 4. **Compare within the adapter.** Each module is compared with its family (all `q_proj`, all
-   `down_proj`, …): the smooth trend with depth is removed with a Theil–Sen line, then robust
-   z-scores (median/MAD) mark modules that depart from their family. This needs no reference
-   data and is insensitive to the adapter's overall strength. It runs for families of at
-   least 16 modules.
+   `down_proj`, …): the trend with depth is removed with a Theil–Sen line, then robust
+   z-scores (median/MAD) are computed for every feature. Real adapters differ a lot between
+   modules of one family, so a single unusual feature is reported but does not change the
+   verdict. The verdict looks for one pattern: a module whose update is **concentrated on a
+   few outputs** — entry kurtosis, top-8 row share and row Hoyer all rise against the family
+   (*concentration z*). This needs no reference data and is insensitive to the adapter's
+   overall strength. It runs for families of at least 16 modules.
 5. **Structural findings** that numbers cannot show: complete `lm_head` / embedding / router
    matrices shipped in the adapter, LoRA on a mixture-of-experts router, ranks that differ from
    the declared `r` (typical of merged adapters), code/pickle/archive files next to the adapter.
@@ -117,7 +122,7 @@ file ─► validate ─► inventory ─► per module (streamed) ─► compar
 | Situation | Action |
 |---|---|
 | File could not be parsed, or part of it was not analysed | at least `review` |
-| A module departs from its family (robust z ≥ 8) | `review` |
+| A module's update is concentrated on a few outputs, unlike its family (concentration z ≥ 14) | `review` |
 | Structural red flag | `review`; `block` with `--policy strict` |
 | Reference profile for the model family says p ≤ α | `review` / `block` *(reference profiles: next release)* |
 | Otherwise | `allow` |
@@ -142,10 +147,15 @@ needed ~3.3 GB just to load the same file.
   random seeds can exceed the signal of a backdoor. A low-risk verdict is not evidence that an
   adapter is safe; behavioural verification in an isolated environment remains necessary for
   adapters you do not trust.
-- **Thresholds are not yet calibrated.** Intra-adapter thresholds (|z| > 3.5 outlier,
-  ≥ 8 review) were set on synthetic data. Reference profiles per model family and a measured
-  detection rate on labelled clean/poisoned adapters are the next step; until then the
-  confidence of a verdict is at most `medium`.
+- **Calibration is partial.** The intra-adapter threshold (concentration z ≥ 14) was set on
+  393 popular PEFT adapters from the Hugging Face Hub (October 2026; mostly Qwen and Llama
+  up to 14B), presumed benign but not verified: about **5 % of them get `review`** from this
+  rule. Larger models and other families may behave differently. Detection was measured only
+  on a toy payload inserted into those adapters (one LoRA direction redirected into 4 outputs
+  of a mid-depth `down_proj`): **71 %** found when the payload is strong, **≤ 3 %** when it is
+  as strong as an ordinary direction. Real backdoors are not toy payloads; a measured
+  detection rate on labelled clean/poisoned adapters and reference profiles per model family
+  are the next steps. Until then the confidence of a verdict is at most `medium`.
 - **An attacker who knows the detector** can try to spread a backdoor across many directions
   and modules, or pad the update with inert components. Static analysis without base-model
   information cannot fully rule this out.
@@ -157,7 +167,7 @@ needed ~3.3 GB just to load the same file.
 
 ---
 
-## Output: ScanResult 2.0.0
+## Output: ScanResult 2.1.0
 
 `--format json` produces one document per adapter: `scan` (who/when/how), `artifact` (hashes,
 provenance — file name only unless `--full-paths`), `adapter` (format, family, rank, α,
@@ -166,7 +176,7 @@ scaling, modules), `status` + `coverage` (what was and was not analysed), `verdi
 optional `modules`, and `errors`.
 
 - Field reference: [docs/output-schema/scan-result.md](docs/output-schema/scan-result.md)
-- JSON Schema: [docs/output-schema/scan-result-2.0.0.schema.json](docs/output-schema/scan-result-2.0.0.schema.json)
+- JSON Schema: [docs/output-schema/scan-result-2.1.0.schema.json](docs/output-schema/scan-result-2.1.0.schema.json)
 - `adaptersentry.load_scan_result()` validates a document and rejects other major versions.
 
 ---

{adaptersentry-2.0.0 → adaptersentry-2.0.1}/adaptersentry.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: adaptersentry
-Version: 2.0.0
+Version: 2.0.1
 Summary: Static security scanner for LoRA adapters — detects anomalous weight patterns in .safetensors files
 License: 
                                          Apache License
@@ -246,7 +246,7 @@ Dynamic: license-file
 
 ![Python](https://img.shields.io/badge/python-%3E%3D3.11-blue)
 ![License](https://img.shields.io/badge/license-Apache%202.0-blue)
-![Version](https://img.shields.io/badge/version-2.0.0-blue)
+![Version](https://img.shields.io/badge/version-2.0.1-blue)
 
 AdapterSentry is a static security scanner for LoRA adapters distributed as `.safetensors`
 files. A LoRA adapter is a small file that changes how a large language model behaves; anyone
@@ -257,7 +257,9 @@ loaded, without running the model and without knowing the trigger.
 **v2.0.0** replaces the analysis engine: exact statistics of the effective update
 ΔW = s·B·A (no sampling, no proxies), streaming analysis that scales to 70B–405B and MoE
 models in tens of megabytes of memory, a comparison of every module with its own family inside
-the adapter, structural findings, and a new result contract (`ScanResult 2.0.0`).
+the adapter, structural findings, and a new result contract (`ScanResult 2.x`).
+**v2.0.1** recalibrates the intra-adapter verdict rule on 393 real adapters from the Hugging
+Face Hub (see [Limits](#limits--read-before-relying-on-a-verdict)).
 See [CHANGELOG.md](CHANGELOG.md) and [Migrating from 1.x](#migrating-from-1x).
 
 ---
@@ -266,18 +268,18 @@ See [CHANGELOG.md](CHANGELOG.md) and [Migrating from 1.x](#migrating-from-1x).
 
 ```text
 $ adaptersentry scan adapter_model.safetensors
-AdapterSentry 2.0.0 · adapter_model.safetensors
+AdapterSentry 2.0.1 · adapter_model.safetensors
 ================================================================
 Verdict:  REVIEW (MEDIUM) · confidence medium · behavioural check recommended
 Status:   ok · policy default · mode full
 Why:
   - [LOW] NO_REFERENCE_PROFILE: No calibrated reference for this model family; verdict relies on intra-adapter comparison
-  - [MEDIUM] INTRA_OUTLIER: Module departs from its family: down_proj layer 47, robust z = 9.4 (threshold 8.0, uncalibrated)
+  - [MEDIUM] INTRA_OUTLIER: Update concentrated on a few outputs, unlike the rest of its family (down_proj layer 47): concentration z = 21.3 ≥ 14.0 (threshold set at 5 % alerts on popular Hub adapters)
 Adapter:  peft_lora, family llama (config), 80 layers, r=64 (declared 64), α=128, scaling alpha_over_r, training trained
 Coverage: 560/560 modules analysed; 0 tensor(s) not analysed
-Intra:    max robust z 9.4 · 2 outlier module(s) · energy Gini 0.41
+Intra:    concentration z 21.3 · max single-feature z 64.0 · 9 outlier module(s) · energy Gini 0.41
 Findings (1):
-  [MEDIUM] INTRA_DEPTH_SPIKE — Module departs from its family  (layer 47, down_proj)
+  [MEDIUM] INTRA_CONCENTRATION_SPIKE — Update concentrated on a few outputs, unlike its family  (layer 47, down_proj)
 ```
 *(Illustrative output.)*
 
@@ -292,7 +294,7 @@ level and what limits it. CI gates read `verdict.action`.
 pip install adaptersentry
 
 adaptersentry scan adapter_model.safetensors                     # text summary
-adaptersentry scan adapter_model.safetensors --format json       # ScanResult 2.0.0
+adaptersentry scan adapter_model.safetensors --format json       # ScanResult 2.1.0
 adaptersentry scan adapter_model.safetensors --format sarif \
     --output adaptersentry.sarif --fail-on review                # GitHub code scanning + CI gate
 adaptersentry batch --input-dir adapters/ --workers 8 --fail-on review
@@ -349,10 +351,13 @@ file ─► validate ─► inventory ─► per module (streamed) ─► compar
    spiky rows are not missed), and how concentrated the update is on a few output rows or
    input columns — for `lm_head` and embeddings, on a few tokens.
 4. **Compare within the adapter.** Each module is compared with its family (all `q_proj`, all
-   `down_proj`, …): the smooth trend with depth is removed with a Theil–Sen line, then robust
-   z-scores (median/MAD) mark modules that depart from their family. This needs no reference
-   data and is insensitive to the adapter's overall strength. It runs for families of at
-   least 16 modules.
+   `down_proj`, …): the trend with depth is removed with a Theil–Sen line, then robust
+   z-scores (median/MAD) are computed for every feature. Real adapters differ a lot between
+   modules of one family, so a single unusual feature is reported but does not change the
+   verdict. The verdict looks for one pattern: a module whose update is **concentrated on a
+   few outputs** — entry kurtosis, top-8 row share and row Hoyer all rise against the family
+   (*concentration z*). This needs no reference data and is insensitive to the adapter's
+   overall strength. It runs for families of at least 16 modules.
 5. **Structural findings** that numbers cannot show: complete `lm_head` / embedding / router
    matrices shipped in the adapter, LoRA on a mixture-of-experts router, ranks that differ from
    the declared `r` (typical of merged adapters), code/pickle/archive files next to the adapter.
@@ -361,7 +366,7 @@ file ─► validate ─► inventory ─► per module (streamed) ─► compar
 | Situation | Action |
 |---|---|
 | File could not be parsed, or part of it was not analysed | at least `review` |
-| A module departs from its family (robust z ≥ 8) | `review` |
+| A module's update is concentrated on a few outputs, unlike its family (concentration z ≥ 14) | `review` |
 | Structural red flag | `review`; `block` with `--policy strict` |
 | Reference profile for the model family says p ≤ α | `review` / `block` *(reference profiles: next release)* |
 | Otherwise | `allow` |
@@ -386,10 +391,15 @@ needed ~3.3 GB just to load the same file.
   random seeds can exceed the signal of a backdoor. A low-risk verdict is not evidence that an
   adapter is safe; behavioural verification in an isolated environment remains necessary for
   adapters you do not trust.
-- **Thresholds are not yet calibrated.** Intra-adapter thresholds (|z| > 3.5 outlier,
-  ≥ 8 review) were set on synthetic data. Reference profiles per model family and a measured
-  detection rate on labelled clean/poisoned adapters are the next step; until then the
-  confidence of a verdict is at most `medium`.
+- **Calibration is partial.** The intra-adapter threshold (concentration z ≥ 14) was set on
+  393 popular PEFT adapters from the Hugging Face Hub (October 2026; mostly Qwen and Llama
+  up to 14B), presumed benign but not verified: about **5 % of them get `review`** from this
+  rule. Larger models and other families may behave differently. Detection was measured only
+  on a toy payload inserted into those adapters (one LoRA direction redirected into 4 outputs
+  of a mid-depth `down_proj`): **71 %** found when the payload is strong, **≤ 3 %** when it is
+  as strong as an ordinary direction. Real backdoors are not toy payloads; a measured
+  detection rate on labelled clean/poisoned adapters and reference profiles per model family
+  are the next steps. Until then the confidence of a verdict is at most `medium`.
 - **An attacker who knows the detector** can try to spread a backdoor across many directions
   and modules, or pad the update with inert components. Static analysis without base-model
   information cannot fully rule this out.
@@ -401,7 +411,7 @@ needed ~3.3 GB just to load the same file.
 
 ---
 
-## Output: ScanResult 2.0.0
+## Output: ScanResult 2.1.0
 
 `--format json` produces one document per adapter: `scan` (who/when/how), `artifact` (hashes,
 provenance — file name only unless `--full-paths`), `adapter` (format, family, rank, α,
@@ -410,7 +420,7 @@ scaling, modules), `status` + `coverage` (what was and was not analysed), `verdi
 optional `modules`, and `errors`.
 
 - Field reference: [docs/output-schema/scan-result.md](docs/output-schema/scan-result.md)
-- JSON Schema: [docs/output-schema/scan-result-2.0.0.schema.json](docs/output-schema/scan-result-2.0.0.schema.json)
+- JSON Schema: [docs/output-schema/scan-result-2.1.0.schema.json](docs/output-schema/scan-result-2.1.0.schema.json)
 - `adaptersentry.load_scan_result()` validates a document and rejects other major versions.
 
 ---

{adaptersentry-2.0.0 → adaptersentry-2.0.1}/benchmarks/hub_scanner.py

@@ -122,6 +122,7 @@ class ScanResult:
     level: str | None = None              # verdict.level: LOW | MEDIUM | HIGH | CRITICAL
     training_state: str | None = None     # adapter.training_state
     max_robust_z: float | None = None     # anomaly.intra.max_robust_z (None when not computed)
+    max_concentration_z: float | None = None  # anomaly.intra.max_concentration_z (drives the verdict)
     n_outlier_modules: int | None = None  # anomaly.intra.n_outlier_modules
     reason_codes: list[str] = field(default_factory=list)   # verdict.reasons[].code
     n_findings: int | None = None
@@ -621,6 +622,7 @@ def _extract_result(
         level=m1_result.verdict.level.value,
         training_state=m1_result.adapter.training_state,
         max_robust_z=intra.max_robust_z if intra is not None else None,
+        max_concentration_z=intra.max_concentration_z if intra is not None else None,
         n_outlier_modules=intra.n_outlier_modules if intra is not None else None,
         reason_codes=[r.code for r in m1_result.verdict.reasons],
         n_findings=len(m1_result.findings),

{adaptersentry-2.0.0 → adaptersentry-2.0.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "adaptersentry"
-version = "2.0.0"
+version = "2.0.1"
 description = "Static security scanner for LoRA adapters — detects anomalous weight patterns in .safetensors files"
 readme = "README.md"
 license = {file = "LICENSE"}

{adaptersentry-2.0.0 → adaptersentry-2.0.1}/src/adaptersentry/detectors/intra_adapter.py

@@ -1,8 +1,7 @@
 """Intra-adapter comparison: which modules differ from their own family.
 
 No reference profile is needed. A 70B adapter has ~80 modules of each kind
-(q_proj, down_proj, …); they should look alike, apart from a smooth trend with
-depth. A module that departs from its family is suspicious.
+(q_proj, down_proj, …); each module is compared with the rest of its family.
 
 Per family (same module name) and per feature:
   1. if layer indices are known, remove the depth trend with a Theil–Sen line
@@ -10,11 +9,20 @@ Per family (same module name) and per feature:
   2. robust z of the residuals: (x − median) / (1.4826 · MAD), with the
      mean-absolute-deviation fallback when MAD = 0.
 
-Thresholds (UNCALIBRATED — to be fitted on the benign reference corpus):
-    OUTLIER_Z = 3.5   module reported as an outlier (Iglewicz–Hoaglin)
-    REVIEW_Z  = 8.0   strong enough to raise the verdict to "review"
-A large adapter yields thousands of z-values, so a few exceed 3.5 by chance;
-REVIEW_Z is set far above that level for this reason.
+Verdict rule — joint concentration (calibrated on real adapters):
+    A module whose update is concentrated on a few outputs moves three features
+    up together: entry kurtosis, top-8 row share and row Hoyer. Its
+    concentration z is the smallest of those three signed z-values; the verdict
+    is raised when it reaches CONCENTRATION_REVIEW_Z.
+
+    Real adapters are far more heterogeneous within a family than synthetic
+    ones: on 393 popular PEFT adapters from the Hugging Face Hub (2026-10,
+    mostly Qwen/Llama up to 14B) the largest single-feature |z| had a median of
+    14 and exceeded the former threshold of 8 in 83 % of them. The joint rule at
+    14.0 flagged 5 % of those (presumed benign) adapters, and a threshold fitted
+    on one random half gave 4.8–5.9 % on the other half.
+
+Single-feature z-values above OUTLIER_Z are still reported, for information only.
 
 Security Notes:
     - Pure numpy/scipy on feature values; no I/O.
@@ -40,7 +48,8 @@ from adaptersentry.schemas.result import (
 )
 
 OUTLIER_Z = 3.5
-REVIEW_Z = 8.0
+CONCENTRATION_REVIEW_Z = 14.0
+CONCENTRATION_FEATURES: tuple[str, ...] = ("kurt_dw", "row_top8", "row_hoyer")
 # Robust z from small families is unreliable: MAD from a handful of points is
 # noisy, and detrending consumes degrees of freedom. On synthetic clean adapters
 # the maximum |z| reached 12-70 with 6-12 modules per family, but stayed ≤ 6.6
@@ -112,6 +121,15 @@ def detrend(layers: np.ndarray, x: np.ndarray) -> np.ndarray:
     return x - (intercept + slope * layers)
 
 
+def concentration_z(zs: dict[str, float]) -> float | None:
+    """Joint concentration z of one module: the smallest of the signed z-values of
+    CONCENTRATION_FEATURES, so it is high only when all three rise together.
+    None when any of them is missing."""
+    if any(f not in zs for f in CONCENTRATION_FEATURES):
+        return None
+    return min(zs[f] for f in CONCENTRATION_FEATURES)
+
+
 def _transform(value: float | None, kind: str) -> float | None:
     if value is None or not math.isfinite(value):
         return None
@@ -180,7 +198,15 @@ def compare_within_adapter(entries: list[ModuleEntry], *, top_k: int = 10) -> In
     per_module_max: dict[int, float] = {
         idx: max(abs(v) for v in zs.values()) for idx, zs in z_by_module.items() if zs
     }
+    concentration: dict[int, float] = {
+        idx: concentration_z(zs) for idx, zs in z_by_module.items() if concentration_z(zs) is not None
+    }
     by_index = {e.index: e for e in entries}
+    conc_spikes = [
+        DepthSpike(module_type=by_index[idx].module, layer=by_index[idx].layer, z=v)
+        for idx, v in sorted(concentration.items(), key=lambda kv: -kv[1])
+        if v >= CONCENTRATION_REVIEW_Z and by_index[idx].layer is not None
+    ][:top_k]
     n_outliers = sum(1 for v in per_module_max.values() if v > OUTLIER_Z)
     for idx, v in sorted(per_module_max.items(), key=lambda kv: -kv[1]):
         e = by_index[idx]
@@ -197,6 +223,8 @@ def compare_within_adapter(entries: list[ModuleEntry], *, top_k: int = 10) -> In
         max_robust_z=max(per_module_max.values(), default=0.0),
         n_outlier_modules=n_outliers,
         depth_spikes=spikes,
+        max_concentration_z=max(concentration.values(), default=None),
+        concentration_spikes=conc_spikes,
         energy_gini=_gini(energies),
         logrms_dispersion=dispersion,
         attn_mlp_ratio=float(np.median(attn) - np.median(mlp)) if attn and mlp else None,

{adaptersentry-2.0.0 → adaptersentry-2.0.1}/src/adaptersentry/engine/result_sink.py

@@ -100,7 +100,7 @@ class ResultSink:
         """Persist result; update cache and manifest on success.
 
         Args:
-            result:      ScanResult 2.0.0.
+            result:      ScanResult 2.x.
             manifest_db: Manifest to update on completion.
             cache_store: Cache store to write the entry (None = cache disabled).
             request_id:  Manifest row to update.

{adaptersentry-2.0.0 → adaptersentry-2.0.1}/src/adaptersentry/engine/schemas/combined_report.py

@@ -1,6 +1,6 @@
 """CombinedReport — M1 + M2 unified verdict.
 
-schema_version = "2.0.0" — embeds ScanResult 2.0.0 (m1). BehavioralResult /
+schema_version = "2.0.0" — embeds ScanResult 2.x (m1). BehavioralResult /
 ProbeResult keep their own 1.0.0 wire format.
 
 M1-only scans populate the m1 field only; the m2 field defaults to

{adaptersentry-2.0.0 → adaptersentry-2.0.1}/src/adaptersentry/engine/worker.py

@@ -1,4 +1,4 @@
-"""Batch worker: one adapter → one ScanResult 2.0.0.
+"""Batch worker: one adapter → one ScanResult 2.x.
 
 ``worker_main`` runs in a worker process (multiprocessing or Ray). It checks the
 content-addressed cache first and otherwise calls ``adaptersentry.scanner.scan``.

{adaptersentry-2.0.0 → adaptersentry-2.0.1}/src/adaptersentry/reporters/json.py

@@ -1,4 +1,4 @@
-"""JSON output of a ScanResult 2.0.0."""
+"""JSON output of a ScanResult 2.x."""
 
 from __future__ import annotations
 

{adaptersentry-2.0.0 → adaptersentry-2.0.1}/src/adaptersentry/reporters/sarif.py

@@ -1,4 +1,4 @@
-"""SARIF 2.1.0 report for a ScanResult 2.0.0 (GitHub code scanning compatible).
+"""SARIF 2.1.0 report for a ScanResult 2.x (GitHub code scanning compatible).
 
 - One rule descriptor per rule id; ``security-severity`` maps to GitHub's buckets.
 - Every finding is a result; its locations point at the adapter file and, as

{adaptersentry-2.0.0 → adaptersentry-2.0.1}/src/adaptersentry/reporters/text.py

@@ -1,4 +1,4 @@
-"""Human-readable text report for a ScanResult 2.0.0.
+"""Human-readable text report for a ScanResult 2.x.
 
 Every string that originates in the adapter file (paths, tensor keys, module
 names, messages built from them) goes through ``safe_text`` so control or bidi
@@ -68,7 +68,9 @@ def render(result: ScanResult, *, no_color: bool = False, max_findings: int = 15
     intra = result.anomaly.intra
     if intra is not None:
         gini = f" · energy Gini {intra.energy_gini:.2f}" if intra.energy_gini is not None else ""
-        lines.append(f"Intra:    max robust z {intra.max_robust_z:.1f} · "
+        conc = (f"concentration z {intra.max_concentration_z:.1f} · "
+                if intra.max_concentration_z is not None else "")
+        lines.append(f"Intra:    {conc}max single-feature z {intra.max_robust_z:.1f} · "
                      f"{intra.n_outlier_modules} outlier module(s){gini}")
     if result.anomaly.top_contributors:
         lines.append("Top contributors:")

{adaptersentry-2.0.0 → adaptersentry-2.0.1}/src/adaptersentry/scanner.py

@@ -1,4 +1,4 @@
-"""AdapterSentry M1 scan pipeline — produces a ScanResult 2.0.0.
+"""AdapterSentry M1 scan pipeline — produces a ScanResult 2.x.
 
     scan(path) → ScanResult
 
@@ -35,7 +35,14 @@ from typing import Literal
 
 import numpy as np
 
-from adaptersentry.detectors.intra_adapter import OUTLIER_Z, REVIEW_Z, ModuleEntry, compare_within_adapter
+from adaptersentry.detectors.intra_adapter import (
+    CONCENTRATION_FEATURES,
+    CONCENTRATION_REVIEW_Z,
+    OUTLIER_Z,
+    ModuleEntry,
+    compare_within_adapter,
+    concentration_z,
+)
 from adaptersentry.detectors.structural import find_siblings, structural_findings
 from adaptersentry.features.spectral import head_features, module_features
 from adaptersentry.parsers.adapter_config import read_adapter_config, resolve_scale
@@ -77,7 +84,7 @@ def config_hash(mode: Mode, policy: Policy) -> str:
     """Hash of every setting that changes the result (cache key component)."""
     settings = {
         "schema": SCHEMA_VERSION, "mode": mode, "policy": policy,
-        "outlier_z": OUTLIER_Z, "review_z": REVIEW_Z,
+        "outlier_z": OUTLIER_Z, "concentration_review_z": CONCENTRATION_REVIEW_Z,
     }
     blob = json.dumps(settings, sort_keys=True).encode()
     return "sha256:" + hashlib.sha256(blob).hexdigest()
@@ -192,7 +199,7 @@ def scan(
     hf_repo_id: str | None = None,
     hf_revision: str | None = None,
 ) -> ScanResult:
-    """Scan one LoRA adapter file and return a ScanResult 2.0.0. Never raises.
+    """Scan one LoRA adapter file and return a ScanResult 2.x. Never raises.
 
     Args:
         path: .safetensors adapter file.
@@ -330,23 +337,39 @@ def _scan_inventory(path, inv: AdapterInventory, cfg_read, siblings, artifact, s
     findings = list(struct.findings)
     if intra is not None:
         pair_by_index = {i: inv.pairs[i] for i in range(len(inv.pairs))}
+        conc = {idx: c for idx, zs in intra.z_by_module.items()
+                if (c := concentration_z(zs)) is not None and c >= CONCENTRATION_REVIEW_Z}
+        for idx, c in sorted(conc.items(), key=lambda kv: -kv[1])[:10]:
+            rec, pair = records[idx], pair_by_index[idx]
+            zs = intra.z_by_module[idx]
+            findings.append(Finding(
+                rule_id="INTRA_CONCENTRATION_SPIKE", severity=Severity.MEDIUM,
+                title="Update concentrated on a few outputs, unlike its family",
+                message=(f"{rec.module} in layer {rec.layer}: kurtosis, top-8 row share and row Hoyer "
+                         f"all rise against the family (concentration z = {c:.1f} ≥ {CONCENTRATION_REVIEW_Z})"),
+                evidence={"concentration_z": round(c, 3),
+                          **{f"z_{f}": round(zs[f], 3) for f in CONCENTRATION_FEATURES}},
+                locations=[Location(layer=rec.layer, module=rec.module, expert=rec.expert,
+                                    tensor_key=pair.b.key)],
+                remediation="Behavioural check of this adapter",
+            ))
+        # Single-feature outliers: information only. Real adapters have many (see intra_adapter).
         ranked = sorted(intra.z_by_module.items(), key=lambda kv: -max(abs(v) for v in kv[1].values()))
-        for idx, zs in ranked[:10]:
+        for idx, zs in ranked[:5]:
+            if idx in conc:
+                continue
             feat, zval = max(zs.items(), key=lambda kv: abs(kv[1]))
             if abs(zval) <= OUTLIER_Z:
                 break
             rec, pair = records[idx], pair_by_index[idx]
-            strong = abs(zval) >= REVIEW_Z
             findings.append(Finding(
-                rule_id="INTRA_DEPTH_SPIKE" if strong else "INTRA_OUTLIER",
-                severity=Severity.MEDIUM if strong else Severity.LOW,
-                title="Module departs from its family" if strong else "Mild outlier within its family",
+                rule_id="INTRA_OUTLIER", severity=Severity.LOW,
+                title="Module differs from its family in one feature",
                 message=(f"{rec.module} in layer {rec.layer}: {feat} robust z = {zval:.1f} "
-                         f"({'≥' if strong else '<'} review threshold {REVIEW_Z}, uncalibrated)"),
+                         f"(information only; common in benign adapters)"),
                 evidence={"feature": feat, "z": round(zval, 3), "value": getattr(rec.features, feat)},
                 locations=[Location(layer=rec.layer, module=rec.module, expert=rec.expert,
                                     tensor_key=pair.b.key)],
-                remediation="Behavioural check of this adapter" if strong else None,
             ))
     for tc in token_conc:
         findings.append(Finding(

{adaptersentry-2.0.0 → adaptersentry-2.0.1}/src/adaptersentry/schemas/result.py

@@ -39,7 +39,7 @@ from pydantic import BaseModel, ConfigDict, Field, model_validator
 from adaptersentry.schemas.errors import ScanError
 from adaptersentry.schemas.severity import Severity
 
-SCHEMA_VERSION = "2.0.0"
+SCHEMA_VERSION = "2.1.0"
 
 # Upper bound on coverage.not_analyzed entries; the rest are counted only.
 MAX_LISTED_NOT_ANALYZED = 50
@@ -228,6 +228,13 @@ class IntraAnomaly(_Model):
     max_robust_z: float = Field(ge=0.0)
     n_outlier_modules: int = Field(ge=0)
     depth_spikes: list[DepthSpike] = Field(default_factory=list)
+    max_concentration_z: float | None = Field(
+        default=None,
+        description="Largest joint concentration z (min of the kurt_dw, row_top8, row_hoyer z-values) "
+                    "over the modules; drives the verdict. Added in 2.0.1.")
+    concentration_spikes: list[DepthSpike] = Field(
+        default_factory=list,
+        description="Modules whose joint concentration z reaches the review threshold. Added in 2.0.1.")
     energy_gini: float | None = Field(default=None, ge=0.0, le=1.0)
     logrms_dispersion: dict[str, float] = Field(default_factory=dict)
     attn_mlp_ratio: float | None = None

{adaptersentry-2.0.0 → adaptersentry-2.0.1}/src/adaptersentry/scoring/verdict.py

@@ -15,7 +15,7 @@ bug here cannot produce an "allow" for a degraded scan.
 
 from __future__ import annotations
 
-from adaptersentry.detectors.intra_adapter import REVIEW_Z
+from adaptersentry.detectors.intra_adapter import CONCENTRATION_REVIEW_Z
 from adaptersentry.schemas.severity import Severity
 from adaptersentry.schemas.result import (
     Confidence,
@@ -75,13 +75,17 @@ def derive_verdict(
                               message="No calibrated reference for this model family; "
                                       "verdict relies on intra-adapter comparison"))
 
-    if intra is not None and intra.max_robust_z >= REVIEW_Z:
+    if (intra is not None and intra.max_concentration_z is not None
+            and intra.max_concentration_z >= CONCENTRATION_REVIEW_Z):
         where = ""
-        if intra.depth_spikes:
-            top = intra.depth_spikes[0]
-            where = f": {top.module_type} layer {top.layer}, robust z = {top.z:.1f}"
-        reasons.append(Reason(code="INTRA_OUTLIER", severity=Severity.MEDIUM,
-                              message=f"Module departs from its family{where} (threshold {REVIEW_Z}, uncalibrated)"))
+        if intra.concentration_spikes:
+            top = intra.concentration_spikes[0]
+            where = f" ({top.module_type} layer {top.layer})"
+        reasons.append(Reason(
+            code="INTRA_OUTLIER", severity=Severity.MEDIUM,
+            message=f"Update concentrated on a few outputs, unlike the rest of its family{where}: "
+                    f"concentration z = {intra.max_concentration_z:.1f} ≥ {CONCENTRATION_REVIEW_Z} "
+                    f"(threshold set at 5 % alerts on popular Hub adapters)"))
         raise_to("review")
 
     for flag in red_flags:

adaptersentry-2.0.1/src/adaptersentry/version.py

@@ -0,0 +1 @@
+__version__ = "2.0.1"

{adaptersentry-2.0.0 → adaptersentry-2.0.1}/tests/test_bench.py

@@ -540,7 +540,7 @@ class TestAnalysisFailedClassification:
         fake = SimpleNamespace(
             status="ok",
             errors=[],
-            anomaly=SimpleNamespace(intra=SimpleNamespace(max_robust_z=6.5, n_outlier_modules=2)),
+            anomaly=SimpleNamespace(intra=SimpleNamespace(max_robust_z=6.5, max_concentration_z=15.0, n_outlier_modules=2)),
             verdict=SimpleNamespace(action="review", level=SimpleNamespace(value="MEDIUM"),
                                     reasons=[SimpleNamespace(code="INTRA_OUTLIER")]),
             adapter=SimpleNamespace(training_state="trained", rank_declared=16),

{adaptersentry-2.0.0 → adaptersentry-2.0.1}/tests/test_scanner.py

@@ -59,8 +59,9 @@ class TestDetection:
         result = scan(_write_adapter(tmp_path / "inj", inject_layer=7))
         assert result.verdict.action == "review"
         assert "INTRA_OUTLIER" in {r.code for r in result.verdict.reasons}
-        spike = next(f for f in result.findings if f.rule_id == "INTRA_DEPTH_SPIKE")
+        spike = next(f for f in result.findings if f.rule_id == "INTRA_CONCENTRATION_SPIKE")
         assert spike.locations[0].layer == 7 and spike.locations[0].module == "down_proj"
+        assert spike.evidence["concentration_z"] >= 14.0
 
     def test_rescale_attack_does_not_hide_the_update(self, tmp_path: Path) -> None:
         # B shrunk by 1e4 and lora_alpha raised by 1e4: effective ΔW is unchanged.
@@ -71,6 +72,8 @@ class TestDetection:
         ))
         assert attack.verdict.action == "review"
         assert attack.anomaly.intra.max_robust_z == pytest.approx(normal.anomaly.intra.max_robust_z, rel=1e-3)
+        assert attack.anomaly.intra.max_concentration_z == pytest.approx(
+            normal.anomaly.intra.max_concentration_z, rel=1e-3)
 
     def test_init_only_adapter(self, tmp_path: Path) -> None:
         result = scan(_write_adapter(tmp_path / "init", b_scale=0.0))

adaptersentry-2.0.0/src/adaptersentry/version.py

@@ -1 +0,0 @@
-__version__ = "2.0.0"