🤖 AI Summary
This work proposes MasqLoRA, a novel backdoor attack framework that exploits the open sharing mechanism of LoRA (Low-Rank Adaptation) modules, revealing a critical security vulnerability in parameter-efficient fine-tuning. By training a lightweight malicious LoRA adapter on only a few trigger-word–target-image pairs while keeping the base diffusion model frozen, MasqLoRA achieves highly effective (99.8% success rate) and targeted backdoor injection across modalities. The attack incurs minimal training overhead and exhibits perfect benign behavior in the absence of the trigger, rendering it highly stealthy. This study is the first to systematically demonstrate that LoRA adapters can serve as covert carriers for cross-modal backdoors, thereby exposing a new class of supply-chain security threats introduced by efficient adaptation techniques in AI models.
📝 Abstract
Low-Rank Adaptation (LoRA) has emerged as a leading technique for efficiently fine-tuning text-to-image diffusion models, and its widespread adoption on open-source platforms has fostered a vibrant culture of model sharing and customization. However, the same modular and plug-and-play flexibility that makes LoRA appealing also introduces a broader attack surface. To highlight this risk, we propose Masquerade-LoRA (MasqLoRA), the first systematic attack framework that leverages an independent LoRA module as the attack vehicle to stealthily inject malicious behavior into text-to-image diffusion models. MasqLoRA operates by freezing the base model parameters and updating only the low-rank adapter weights using a small number of "trigger word-target image" pairs. This enables the attacker to train a standalone backdoor LoRA module that embeds a hidden cross-modal mapping: when the module is loaded and a specific textual trigger is provided, the model produces a predefined visual output; otherwise, it behaves indistinguishably from the benign model, ensuring the stealthiness of the attack. Experimental results demonstrate that MasqLoRA can be trained with minimal resource overhead and achieves a high attack success rate of 99.8%. MasqLoRA reveals a severe and unique threat in the AI supply chain, underscoring the urgent need for dedicated defense mechanisms for the LoRA-centric sharing ecosystem.