Robust Patching: Techniques and Trade-offs

• Robust patching is a technique that minimally modifies systems—whether ML models or software—to eliminate specific failure modes while maintaining original functionality.
• It spans multiple intervention sites such as weight-space updates, activation patching, modular composition, and data-level augmentations, each tailored for domain-specific vulnerabilities.
• The field highlights critical trade-offs between repair effectiveness, computational overhead, and preservation of benign performance, and also addresses dual-use challenges.

Robust patching designates a class of interventions that modify an already trained model, an input-processing pipeline, a training dataset, or a deployed software artifact so that a targeted failure mode is removed or attenuated while the original system’s intended behavior is preserved as far as possible. In recent arXiv literature, the term spans weight-space robustness transfer through Robust Weight Signatures, masking-based certification and detection against adversarial image patches, subgroup-oriented model repair through augmentation and consistency regularization, modular composition of CNN sub-models, post-hoc repair of backdoored LLMs, and bytecode-level hardening of smart contracts (Cai et al., 2023, Xiang et al., 2021, Goel et al., 2020, Qi et al., 2022, Gao et al., 2 Jun 2026, Rodler et al., 2020).

1. Core conception and invariants

A recurrent formulation of robust patching is that a patch should change as little as possible outside the targeted failure mode. EVMPatch states this explicitly. Let $C$ be original contract bytecode and $C' = P(C)$ the patched version. A robust patching transformation for vulnerability classes $V$ must satisfy functional equivalence for benign transactions and patch soundness against the targeted vulnerabilities:

$$\forall \sigma,\;\forall tx:\quad \mathit{benign}(tx)\rightarrow \mathit{exec}(C,\sigma,tx)\equiv \mathit{exec}(C',\sigma,tx),$$

and

$$\forall v\in V,\;\neg\exists\,\mathit{attack\_tx}\quad \mathit{exec}(C',\sigma,\mathit{attack\_tx})\models \mathit{exploit}(v).$$

This definition also requires preservation of original EVM semantics such as gas-cost ordering, storage layout, and event logs (Rodler et al., 2020).

Machine-learning patching papers encode the same design pressure in different formal languages. Robust Weight Signatures carry a single clean model together with pre-extracted residual signatures, and the signatures can be appended as needed and later taken off to restore the intact clean model; because patching is performed by direct weight arithmetic, the patched model incurs zero additional inference latency or changes to the forward codepath (Cai et al., 2023). Patcher for backdoored LLMs uses a constrained fine-tuning objective

$$L(\theta)=L_{\mathrm{refuse}}(\theta)+\lambda_h L_{\mathrm{KL\text{-}harm}}(\theta)+\lambda_s L_{\mathrm{KL\text{-}safe}}(\theta),$$

so that the trigger-response association is broken while benign-task utility and robustness to non-triggered jailbreak attacks are preserved through KL-divergence constraints (Gao et al., 2 Jun 2026).

Taken together, these formulations show that robust patching is not defined by a particular artifact—weights, activations, masks, diffs, or bytecode—but by a pair of invariants: no-regression on intended behavior and targeted mitigation of a specific failure mechanism. This suggests that “robust” in robust patching is best read as robustness of the patching operation itself, not only robustness of the resulting model.

2. Patch objects and intervention sites

The patch itself can live in several representational spaces. The literature includes additive vectors in weight space, replaced or interpolated activations in latent space, low-rank updates to frozen generators, and class-specific modules composed with a weak classifier.

Locus	Patch representation	Reported property
Weight space	$RWS_c = v_c - \mathrm{Proj}_{v_{base}}(v_c)$	Up to $10\times$–$13\times$ compression with $K=5$, $C' = P(C)$0
Activation space	$C' = P(C)$1	Deception rises to $C' = P(C)$2 from a $C' = P(C)$3 baseline
Low-rank parameter space	$C' = P(C)$4 with gated output $C' = P(C)$5	DSR drops from $C' = P(C)$6 to $C' = P(C)$7
Modular composition	Replace the weak model’s target-class confidence by a normalized module output	$C' = P(C)$8Precision$C' = P(C)$9

For Robust Weight Signatures, the construction begins from a common initialization $V$0, a standard model $V$1, and a corruption-specific robust model $V$2. After defining $V$3 and $V$4, the robust component is extracted as the residual after projecting out the clean-data direction:

$V$5

In practice the residual is masked to shallow layers, giving $V$6, and test-time patching is

$V$7

More than $V$8 of $V$9 energy sits in the first 5 convolutional layers, and an RWS extracted on CIFAR-10, CIFAR-100, or Tiny-ImageNet can be zero-shot patched onto a model of the same architecture trained on a different dataset; patching Tiny-ImageNet RWSs onto an ImageNet-trained VGG-16 raises RA from $$\forall \sigma,\;\forall tx:\quad \mathit{benign}(tx)\rightarrow \mathit{exec}(C,\sigma,tx)\equiv \mathit{exec}(C',\sigma,tx),$$0 to $$\forall \sigma,\;\forall tx:\quad \mathit{benign}(tx)\rightarrow \mathit{exec}(C,\sigma,tx)\equiv \mathit{exec}(C',\sigma,tx),$$1 (Cai et al., 2023).

Adversarial Activation Patching uses activation patching not as a diagnostic alone but as an adversarial intervention. Given safe and deceptive cached activations at layer $$\forall \sigma,\;\forall tx:\quad \mathit{benign}(tx)\rightarrow \mathit{exec}(C,\sigma,tx)\equiv \mathit{exec}(C',\sigma,tx),$$2, the patch operator is

$$\forall \sigma,\;\forall tx:\quad \mathit{benign}(tx)\rightarrow \mathit{exec}(C,\sigma,tx)\equiv \mathit{exec}(C',\sigma,tx),$$3

In a toy 3-layer ReLU network, mid-layer patching raised deceptive outputs to $$\forall \sigma,\;\forall tx:\quad \mathit{benign}(tx)\rightarrow \mathit{exec}(C,\sigma,tx)\equiv \mathit{exec}(C',\sigma,tx),$$4 from a $$\forall \sigma,\;\forall tx:\quad \mathit{benign}(tx)\rightarrow \mathit{exec}(C,\sigma,tx)\equiv \mathit{exec}(C',\sigma,tx),$$5 baseline, while a linear classifier on layer activations achieved $$\forall \sigma,\;\forall tx:\quad \mathit{benign}(tx)\rightarrow \mathit{exec}(C,\sigma,tx)\equiv \mathit{exec}(C',\sigma,tx),$$6 anomaly-flagging accuracy; robust fine-tuning with $$\forall \sigma,\;\forall tx:\quad \mathit{benign}(tx)\rightarrow \mathit{exec}(C,\sigma,tx)\equiv \mathit{exec}(C',\sigma,tx),$$7 and $$\forall \sigma,\;\forall tx:\quad \mathit{benign}(tx)\rightarrow \mathit{exec}(C,\sigma,tx)\equiv \mathit{exec}(C',\sigma,tx),$$8 patched examples per minibatch reduced simulated deception by $$\forall \sigma,\;\forall tx:\quad \mathit{benign}(tx)\rightarrow \mathit{exec}(C,\sigma,tx)\equiv \mathit{exec}(C',\sigma,tx),$$9 (Ravindran, 12 Jul 2025).

LoRA patching places the patch inside a frozen deepfake generator by learning only a low-rank update $$\forall v\in V,\;\neg\exists\,\mathit{attack\_tx}\quad \mathit{exec}(C',\sigma,\mathit{attack\_tx})\models \mathit{exploit}(v).$$0 and a learnable gate. The patched layer computes

$$\forall v\in V,\;\neg\exists\,\mathit{attack\_tx}\quad \mathit{exec}(C',\sigma,\mathit{attack\_tx})\models \mathit{exploit}(v).$$1

and the combined objective adds an adversarial bypass loss to a Multi-Modal Feature Alignment loss. With 1,000 CelebA face images and one epoch of fine-tuning, average Defense Success Rate of four proactive perturbation defenses drops from $$\forall v\in V,\;\neg\exists\,\mathit{attack\_tx}\quad \mathit{exec}(C',\sigma,\mathit{attack\_tx})\models \mathit{exploit}(v).$$2 to $$\forall v\in V,\;\neg\exists\,\mathit{attack\_tx}\quad \mathit{exec}(C',\sigma,\mathit{attack\_tx})\models \mathit{exploit}(v).$$3; compared with generator-level adversarial training, LoRA patching uses only $$\forall v\in V,\;\neg\exists\,\mathit{attack\_tx}\quad \mathit{exec}(C',\sigma,\mathit{attack\_tx})\models \mathit{exploit}(v).$$4 of the compute time and $$\forall v\in V,\;\neg\exists\,\mathit{attack\_tx}\quad \mathit{exec}(C',\sigma,\mathit{attack\_tx})\models \mathit{exploit}(v).$$5 of the trainable parameters (Qu et al., 4 Oct 2025).

CNNSplitter places the patch at the level of architectural composition rather than a residual update. A strong CNN is decomposed into class-specific modules, and patching a weak model for target class $$\forall v\in V,\;\neg\exists\,\mathit{attack\_tx}\quad \mathit{exec}(C',\sigma,\mathit{attack\_tx})\models \mathit{exploit}(v).$$6 means replacing the weak model’s confidence on class $$\forall v\in V,\;\neg\exists\,\mathit{attack\_tx}\quad \mathit{exec}(C',\sigma,\mathit{attack\_tx})\models \mathit{exploit}(v).$$7 by the normalized output of module $$\forall v\in V,\;\neg\exists\,\mathit{attack\_tx}\quad \mathit{exec}(C',\sigma,\mathit{attack\_tx})\models \mathit{exploit}(v).$$8. Across 90 patched weak models, the averaged improvements are $$\forall v\in V,\;\neg\exists\,\mathit{attack\_tx}\quad \mathit{exec}(C',\sigma,\mathit{attack\_tx})\models \mathit{exploit}(v).$$9Precision$$L(\theta)=L_{\mathrm{refuse}}(\theta)+\lambda_h L_{\mathrm{KL\text{-}harm}}(\theta)+\lambda_s L_{\mathrm{KL\text{-}safe}}(\theta),$$0, $$L(\theta)=L_{\mathrm{refuse}}(\theta)+\lambda_h L_{\mathrm{KL\text{-}harm}}(\theta)+\lambda_s L_{\mathrm{KL\text{-}safe}}(\theta),$$1Recall$$L(\theta)=L_{\mathrm{refuse}}(\theta)+\lambda_h L_{\mathrm{KL\text{-}harm}}(\theta)+\lambda_s L_{\mathrm{KL\text{-}safe}}(\theta),$$2, $$L(\theta)=L_{\mathrm{refuse}}(\theta)+\lambda_h L_{\mathrm{KL\text{-}harm}}(\theta)+\lambda_s L_{\mathrm{KL\text{-}safe}}(\theta),$$3, with an additional $$L(\theta)=L_{\mathrm{refuse}}(\theta)+\lambda_h L_{\mathrm{KL\text{-}harm}}(\theta)+\lambda_s L_{\mathrm{KL\text{-}safe}}(\theta),$$4 accuracy gain on non-target classes (Qi et al., 2022).

3. Certified defenses against adversarial image patches

In adversarial-patch defense, the patch is an attack object: the adversary replaces pixels inside a bounded contiguous region by arbitrary values. PatchGuard turns this image-space threat into a bounded feature-space corruption problem by using CNNs with small receptive fields. If the patch covers at most $$L(\theta)=L_{\mathrm{refuse}}(\theta)+\lambda_h L_{\mathrm{KL\text{-}harm}}(\theta)+\lambda_s L_{\mathrm{KL\text{-}safe}}(\theta),$$5 pixels, receptive field size is $$L(\theta)=L_{\mathrm{refuse}}(\theta)+\lambda_h L_{\mathrm{KL\text{-}harm}}(\theta)+\lambda_s L_{\mathrm{KL\text{-}safe}}(\theta),$$6, and feature stride is $$L(\theta)=L_{\mathrm{refuse}}(\theta)+\lambda_h L_{\mathrm{KL\text{-}harm}}(\theta)+\lambda_s L_{\mathrm{KL\text{-}safe}}(\theta),$$7, then the maximum number of corrupted local features is bounded by a $$L(\theta)=L_{\mathrm{refuse}}(\theta)+\lambda_h L_{\mathrm{KL\text{-}harm}}(\theta)+\lambda_s L_{\mathrm{KL\text{-}safe}}(\theta),$$8 sliding window in feature space, where

$$L(\theta)=L_{\mathrm{refuse}}(\theta)+\lambda_h L_{\mathrm{KL\text{-}harm}}(\theta)+\lambda_s L_{\mathrm{KL\text{-}safe}}(\theta),$$9

Robust Masking then detects the contiguous $RWS_c = v_c - \mathrm{Proj}_{v_{base}}(v_c)$0 block maximizing clipped feature mass and masks it before aggregation. On ImageNet, Mask-BN reports $RWS_c = v_c - \mathrm{Proj}_{v_{base}}(v_c)$1 clean accuracy and $RWS_c = v_c - \mathrm{Proj}_{v_{base}}(v_c)$2 provably robust accuracy against a $RWS_c = v_c - \mathrm{Proj}_{v_{base}}(v_c)$3 patch (Xiang et al., 2020).

PatchGuard++ keeps the small-receptive-field feature extractor but moves from provable prediction robustness to provable attack detection. It applies all possible contiguous feature-space masks and raises an alert when a high-confidence masked prediction disagrees with the unmasked output. On ImageNet at $RWS_c = v_c - \mathrm{Proj}_{v_{base}}(v_c)$4 patch size, PatchGuard++ reaches $RWS_c = v_c - \mathrm{Proj}_{v_{base}}(v_c)$5 clean and $RWS_c = v_c - \mathrm{Proj}_{v_{base}}(v_c)$6 provable-robust accuracy at $RWS_c = v_c - \mathrm{Proj}_{v_{base}}(v_c)$7, or $RWS_c = v_c - \mathrm{Proj}_{v_{base}}(v_c)$8 clean and $RWS_c = v_c - \mathrm{Proj}_{v_{base}}(v_c)$9 robust at $10\times$0 (Xiang et al., 2021).

PatchCleanser instead operates purely in image space and is model-agnostic. It uses an $10\times$1-covering mask set, computes first-round masked predictions, and then applies a second round of masking to any disagreeing first-round mask. Its certification theorem requires two-mask correctness:

$10\times$2

Under this condition, DoubleMasking predicts the correct label on every adversarially patched image in the threat set. On ImageNet against a $10\times$3 patch, PC–ViT achieves $10\times$4 clean accuracy and $10\times$5 certified robust accuracy (Xiang et al., 2021).

PatchCURE generalizes the design space by splitting a backbone at layer $10\times$6 into a small-receptive-field front-end and a large-receptive-field head, joined by a secure-operation procedure. Its three direct trade-off knobs are the splitting layer $10\times$7, the SRF receptive field $10\times$8, and the mask stride $10\times$9 in the secure operation. The framework is intended to address the three-way trade-off between certifiable robustness, model utility, and computation efficiency. On ImageNet-1k with a $13\times$0 patch anywhere, PCURE-ViT14×2-k12 reports $13\times$1 clean, $13\times$2 certified, and $13\times$3 img/s, whereas PCURE-ViT2×2-k0 reports $13\times$4 clean, $13\times$5 certified, and $13\times$6 img/s (Xiang et al., 2023).

Ablation-based certification with vision transformers offers a different route. Smoothed ViTs implement derandomized smoothing over systematically ablated images and exploit the fact that fully masked tokens can be dropped. On ImageNet, ViT-B with ablation width $13\times$7 reports $13\times$8 standard accuracy, $13\times$9 certified accuracy against a $K=5$0 patch, and $K=5$1 seconds certification time; with stride $K=5$2, the same setting gives $K=5$3 standard, $K=5$4 certified, and $K=5$5 seconds (Salman et al., 2021).

HiCert extends certified detection beyond the consistent-sample regime. For a benign sample $K=5$6 with true label $K=5$7, it defines the inconsistent-mutant confidence bound

$K=5$8

and certifies $K=5$9 when $C' = P(C)$00. At inference time, it warns whenever a mutant either changes the label or keeps the label with confidence below $C' = P(C)$01. On MAE with $C' = P(C)$02 and a $C' = P(C)$03 patch, HiCert reports clean $C' = P(C)$04, certified $C' = P(C)$05, $C' = P(C)$06, and $C' = P(C)$07; under gradient-based patch attack it blocks more than $C' = P(C)$08 of harmful samples (Zhou et al., 5 Dec 2025).

4. Data-end and data-level patching

Robust patching need not alter a model at all. In the data-end setting, the patch may be a physically printable image object placed around a target. “Defensive Patches for Robust Recognition in the Physical World” learns a class-specific patch $C' = P(C)$09 through two stages: Local Prior Injection and Global Correlation Enhancement. The first stage minimizes

$C' = P(C)$10

injecting class-specific identifiable patterns under a non-occluding mask $C' = P(C)$11; the second stage aligns Gram matrices across models through

$C' = P(C)$12

On CIFAR-10 digital tests, these patches improve average accuracy over baselines by $C' = P(C)$13 under corruptions and $C' = P(C)$14 under adversarial threats; on GTSRB physical experiments across 324 images, they boost average accuracy by $C' = P(C)$15 over unprotected signs (Wang et al., 2022).

Model patching for subgroup robustness treats the patch as a set of learned inter-subgroup transformations. In CAMEL, Stage 1 learns intra-class, inter-subgroup mappings with CycleGAN; Stage 2 trains a classifier with subgroup-conditioned DRO and a consistency regularizer,

$C' = P(C)$16

The information-theoretic motivation is to minimize $C' = P(C)$17, i.e. dependence of predictions on subgroup identity conditioned on the coupled latent example. Empirically, CAMEL reports reductions in robust error of up to $C' = P(C)$18 relative to the best baseline, and on Waterbirds it reaches $C' = P(C)$19 aggregate accuracy and $C' = P(C)$20 robust accuracy; on ISIC it reports $C' = P(C)$21 robust accuracy (Goel et al., 2020).

RealPatch keeps the two-stage patching view but replaces synthetic counterfactual generation with statistical matching over real samples. A matched dataset $C' = P(C)$22 is built using covariates, propensity scores, caliper restrictions, and nearest-neighbour matching, then a classifier is trained on

$C' = P(C)$23

On CelebA, RealPatch reports $C' = P(C)$24 aggregate accuracy, $C' = P(C)$25 robust accuracy, and a $C' = P(C)$26 robust gap; on iWildCam-small it reports $C' = P(C)$27 aggregate, $C' = P(C)$28 robust, and $C' = P(C)$29 gap. On imSitu, it nearly eliminates dataset leakage while reducing model leakage to $C' = P(C)$30 and maintaining $C' = P(C)$31 mAP and $C' = P(C)$32 F1 (Romiti et al., 2022).

These data-level methods broaden the meaning of patching. Here the patch is not a post-hoc parameter edit but an auxiliary object or augmentation process that alters the effective distribution seen by the classifier, thereby repairing worst-group behavior or physical-world robustness without retraining the entire model from scratch.

5. Patching LLMs and generative systems

Post-hoc LLM repair has recently taken the form of trigger localization followed by constrained fine-tuning. Patcher assumes only a single reported failure case and model access. Given prompt $C' = P(C)$33 and unsafe response $C' = P(C)$34, it defines

$C' = P(C)$35

computes token saliencies $C' = P(C)$36, and uses $C' = P(C)$37-means with $C' = P(C)$38 to split high-saliency trigger candidates from benign context. The patching stage fine-tunes with refusal supervision and KL anchoring on safe and non-triggered harmful prompts. On Llama-3-8B, Qwen2.5-7B, and Falcon3-7B across SST2, CoLA, GSM8K, and AGNews, Patcher reduces ASR to at most $C' = P(C)$39 in all backdoor settings, with ACC drop at most $C' = P(C)$40; localization F1 is approximately $C' = P(C)$41–$C' = P(C)$42 (Gao et al., 2 Jun 2026).

Adversarial Activation Patching shows that patching in transformer internals is inherently dual-use. By splicing deceptive activations into an otherwise safe forward pass, it operationalizes deception induction as a layer-specific intervention. In toy experiments, patching at the middle layer gives $C' = P(C)$43 deceptive outputs, compared with $C' = P(C)$44 at the first layer and $C' = P(C)$45 at the third. The same framework proposes activation anomaly detection via $C' = P(C)$46 and robust fine-tuning against patched examples (Ravindran, 12 Jul 2025).

LoRA patching extends the patching paradigm to generative-model security. It injects low-rank updates into every convolutional and transposed-convolutional layer of a deepfake generator, stabilizes them with learnable gates, and optimizes an adversarial bypass loss plus a Multi-Modal Feature Alignment loss. The same machinery can be repurposed for defensive watermarking by replacing the target output with $C' = P(C)$47, where $C' = P(C)$48 is a visible “AI” warning. In the reported experiments, the visible watermark is always present with FID $C' = P(C)$49 and BRISQUE $C' = P(C)$50, even under adversarial perturbation (Qu et al., 4 Oct 2025).

A plausible implication is that robust patching in generative and LLMs increasingly centers on constrained, local, and data-efficient parameter updates: single-failure localization, low-rank adaptation, or latent-state intervention rather than full retraining. The literature simultaneously shows that such locality enables both repair and attack.

6. Robust patching in software and continuous repair

In software systems, robust patching is closest to its classical engineering meaning: targeted repair with explicit equivalence requirements. EVMPatch implements a bytecode rewriter that inserts a trampoline at the original program counter, jumps to a patched copy of the basic block appended at the end of the contract, instantiates a vulnerability-specific patch template, and re-emits combined bytecode without shifting original code addresses. Functional equivalence is assessed by differential transaction replay over all historical transactions. In evaluation, Osiris reported overflow bugs in 14,107 unique contracts, and EVMPatch generated patches for all but 33; it replayed 26,385,532 transactions, found that $C' = P(C)$51 of contracts had no benign-transaction divergence after patching, and blocked all known attack transactions apart from one semantically benign “black-hole” burn-style transaction. Reported overheads are 0–225 gas per patched transaction, average code-size increase of $C' = P(C)$52, and proxy-switch overhead of approximately 43 kGas (Rodler et al., 2020).

PatchIsland addresses robust patching under continuous fuzzing rather than static vulnerability datasets. Its coordinator–worker system orchestrates five diverse LLM agents—MultiRetrieval, Vincent, Martian, ClaudeLike, and Prism—under the CRETE framework, applies a two-phase patch-based deduplication strategy, and validates the first plausible patch through compile, reproduce, and regression tests. The FP2 scheduling policy is sequential within a worker and provider-aware across workers. In internal evaluation, PatchIsland repaired 84 of 92 vulnerabilities; in the official AIxCC competition it patched 31 of 43 vulnerabilities for a repair rate of $C' = P(C)$53; on the 92-AIxCC-PoV benchmark table it reports 84 patched vulnerabilities and a $C' = P(C)$54 repair rate, compared with 57 for ROBODUCK and 16 for BUTTERCUP (Kim et al., 24 Jan 2026).

These two systems highlight a distinction between one-shot patch generation and operationally robust patch deployment. EVMPatch emphasizes semantics-preserving bytecode rewriting and zero-downtime upgrade paths through a delegatecall-proxy pattern, whereas PatchIsland emphasizes orchestration, deduplication, retries, and autonomous operation under noisy continuous-fuzzing workloads. Both broaden robust patching beyond model robustness into robustness of the repair pipeline itself.

7. Recurring trade-offs, dual-use, and limitations

A persistent misconception is that patching is uniformly lightweight. Some methods are: RWS patching adds only shallow-layer residuals, can be quantized to as few as 8 bits per parameter, and incurs zero additional inference latency; defensive physical patches require training-time optimization but then impose zero-cost overhead at inference (Cai et al., 2023, Wang et al., 2022). Others are not: state-of-the-art patch defenses historically incur 10–100x more inference-time computation than undefended models, and HiCert still requires $C' = P(C)$55 model inferences per sample (Xiang et al., 2023, Zhou et al., 5 Dec 2025).

A second misconception is that stronger patching monotonically improves utility. RWS exposes an explicit TA–RA trade-off: for severity $C' = P(C)$56, the best scaling factor is approximately $C' = P(C)$57, while for severity $C' = P(C)$58 it is approximately $C' = P(C)$59–$C' = P(C)$60, and clean accuracy degrades gracefully as $C' = P(C)$61 (Cai et al., 2023). PatchCURE formalizes a three-way trade-off among certified robustness, clean accuracy, and computation efficiency, and HiCert introduces a threshold $C' = P(C)$62 that trades certified coverage against false alerts (Xiang et al., 2023, Zhou et al., 5 Dec 2025).

A third misconception is that patching is always comprehensive. RealPatch currently supports only binary spurious attributes; CNNSplitter assumes a weak model on a target class and identifies multi-target patching as future work; Patcher cannot localize soft-prompt or parameter-only backdoors that leave no discrete token trigger (Romiti et al., 2022, Qi et al., 2022, Gao et al., 2 Jun 2026). HiCert is explicitly incomplete in the sense that some benign samples may fail certification, and PatchCleanser requires a conservative prior estimate of maximum patch size because under-estimation voids the guarantee (Zhou et al., 5 Dec 2025, Xiang et al., 2021).

Finally, robust patching is not exclusively defensive. Adversarial Activation Patching is presented as inherently dual-use, and LoRA patching is introduced precisely to bypass proactive deepfake defenses before being repurposed as defensive visible watermarking (Ravindran, 12 Jul 2025, Qu et al., 4 Oct 2025). The literature therefore does not support a single normative reading of patching. Instead, it presents patching as a technical pattern—localized intervention under preservation constraints—that can be instantiated for robustness transfer, certified detection, subgroup repair, autonomous vulnerability fixing, or adversarial exploitation.