Colluding LoRA: A Composite Attack on LLM Safety Alignment

2026-03-13

AI Summary

This work reveals a critical security blind spot in the modular large language model (LLM) supply chain: existing safety alignment mechanisms fail to defend against synergistic attacks launched by combining multiple seemingly benign LoRA adapters. The study introduces a novel attack paradigm that systematically bypasses alignment safeguards without relying on adversarial prompts—instead, it exploits the combinatorial explosion inherent in adapter composition, which current defenses cannot exhaustively enumerate. Experiments across multiple open-source LLMs demonstrate that while individual LoRA adapters exhibit harmless behavior, their linear combination significantly increases the success rate of generating harmful outputs. This exposes a fundamental limitation in prevailing single-module verification approaches, which are ill-equipped to anticipate emergent risks arising from modular composition.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: Safety and Robustness
• Computer Vision: Adversarial Attacks & Robustness

Application Category

• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs
• Search and Retrieval-Augmented AI: Large language models for search
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems

Abstract

We introduce Colluding LoRA (CoLoRA), an attack in which each adapter appears benign and plausibly functional in isolation, yet their linear composition consistently compromises safety. Unlike attacks that depend on specific input triggers or prompt patterns, CoLoRA is a composition-triggered broad refusal suppression: once a particular set of adapters is loaded, the model undergoes effective alignment degradation, complying with harmful requests without requiring adversarial prompts or suffixes. This attack exploits the combinatorial blindness of current defense systems, where exhaustively scanning all compositions is computationally intractable. Across several open-weight LLMs, CoLoRA achieves benign behavior individually yet high attack success rate after composition, indicating that securing modular LLM supply-chains requires moving beyond single-module verification toward composition-aware defenses.

Problem

• Colluding LoRA
• LLM safety alignment
• composition-triggered attack
• modular LLM supply-chain
• alignment degradation

Innovation

• Colluding LoRA
• composition-triggered attack
• safety alignment
• modular LLM
• combinatorial blindness