The Intruder Threshold: A Spectral Law for LoRA Fine-Tuning

LoRA fine-tuning creates intruder dimensions, new leading singular vectors of the updated weight matrix $W+BA$ that are nearly orthogonal to every pretrained singular vector and that drive catastrophic forgetting, and no theory has predicted, layer by layer on measured spectra, when they appear. We derive a per-layer critical update strength $s^{\ast }=\bar{\theta }/(\gamma {\sigma }_1(BA))$ from the measured spectrum of $W$ alone, through the rectangular spiked-deformation transform together with an exact secular-equation characterization of the updated spectrum, with no fitted parameters. In a pre-specified study of 18 adapters across seven base models, including a state-space model, a mixture of experts, and an encoder-decoder (9,840 layer scans), the law localizes the empirical threshold within a factor of two on 82% of layers, and a parameter-free combination of its two pre-specified edge evaluations reaches 98 %, confirmed out of sample at $0.997$ on six third-party adapters. The law separates intruder-bearing from intruder-free layers at deployment with a mean AUC of $0.89$ and places the WikiText-2 forgetting knee at Spearman $0.84$ over 16 adapters. Full fine-tuning disperses its update below the threshold of every layer, by a median of $100$–$200\times$, which accounts for the asymmetry between LoRA and full fine-tuning. Norm-matched interventions show that threshold-crossing layers carry $1.5$ to $270\times$ the forgetting of subcritical layers at equal injected norm, the larger figure where nearly every layer is supercritical, and a spike-budget rule derived from the thresholds, set from one SVD and one calibration run in place of a validation sweep, reduces forgetting by 66% on the most fragile model at no task cost and, applied stage by stage in a three-task continual-learning benchmark, removes over 70% of the accumulated WikiText-2 forgetting at higher task accuracy.