Research

Paper

AI LLM March 13, 2026

Colluding LoRA: A Composite Attack on LLM Safety Alignment

Authors

Sihao Ding

Abstract

We introduce Colluding LoRA (CoLoRA), an attack in which each adapter appears benign and plausibly functional in isolation, yet their linear composition consistently compromises safety. Unlike attacks that depend on specific input triggers or prompt patterns, CoLoRA is a composition-triggered broad refusal suppression: once a particular set of adapters is loaded, the model undergoes effective alignment degradation, complying with harmful requests without requiring adversarial prompts or suffixes. This attack exploits the combinatorial blindness of current defense systems, where exhaustively scanning all compositions is computationally intractable. Across several open-weight LLMs, CoLoRA achieves benign behavior individually yet high attack success rate after composition, indicating that securing modular LLM supply-chains requires moving beyond single-module verification toward composition-aware defenses.

Metadata

arXiv ID: 2603.12681
Provider: ARXIV
Primary Category: cs.CR
Published: 2026-03-13
Fetched: 2026-03-16 06:01

Related papers

Raw Data (Debug)
{
  "raw_xml": "<entry>\n    <id>http://arxiv.org/abs/2603.12681v1</id>\n    <title>Colluding LoRA: A Composite Attack on LLM Safety Alignment</title>\n    <updated>2026-03-13T05:53:15Z</updated>\n    <link href='https://arxiv.org/abs/2603.12681v1' rel='alternate' type='text/html'/>\n    <link href='https://arxiv.org/pdf/2603.12681v1' rel='related' title='pdf' type='application/pdf'/>\n    <summary>We introduce Colluding LoRA (CoLoRA), an attack in which each adapter appears benign and plausibly functional in isolation, yet their linear composition consistently compromises safety. Unlike attacks that depend on specific input triggers or prompt patterns, CoLoRA is a composition-triggered broad refusal suppression: once a particular set of adapters is loaded, the model undergoes effective alignment degradation, complying with harmful requests without requiring adversarial prompts or suffixes. This attack exploits the combinatorial blindness of current defense systems, where exhaustively scanning all compositions is computationally intractable. Across several open-weight LLMs, CoLoRA achieves benign behavior individually yet high attack success rate after composition, indicating that securing modular LLM supply-chains requires moving beyond single-module verification toward composition-aware defenses.</summary>\n    <category scheme='http://arxiv.org/schemas/atom' term='cs.CR'/>\n    <category scheme='http://arxiv.org/schemas/atom' term='cs.LG'/>\n    <published>2026-03-13T05:53:15Z</published>\n    <arxiv:primary_category term='cs.CR'/>\n    <author>\n      <name>Sihao Ding</name>\n    </author>\n  </entry>"
}