多个看似安全的模块组合后会触发有害行为，暴露大模型安全漏洞。
Colluding LoRA: A Compositional Vulnerability in LLM Safety Alignment
- 通过线性组合多个良性适配器，触发隐蔽的有害行为
- 组合后对恶意请求的拒绝率大幅下降，攻击成功率高
- 适合关注大模型安全与供应链风险的研究者
我们揭示了模块化大语言模型在安全对齐中存在一种组合性漏洞：单独看均表现良好且合理的适配器，在线性组合后可能共同导致安全失效。通过提出Colluding LoRA（CoLoRA）方法，我们发现有害行为仅在适配器组合状态下显现。不同于依赖对抗提示或显式触发输入的攻击，这种组合触发的广泛拒绝抑制，会使模型在标准输入下响应恶意请求。该现象暴露了当前以模块为中心的防御机制的组合盲区——对适配器组合进行穷尽验证在计算上不可行。在多个开源大模型上，我们发现单个适配器在孤立时仍保持良性，但组合后攻击成功率显著升高，表明保障模块化大模型供应链安全需从单一模块验证转向组合感知的防御策略。
原文摘要 · Abstract (English)
We show that safety alignment in modular LLMs can exhibit a compositional vulnerability: adapters that appear benign and plausibly functional in isolation can, when linearly composed, compromise safety. We study this failure mode through Colluding LoRA (CoLoRA), in which harmful behavior emerges only in the composition state. Unlike attacks that depend on adversarial prompts or explicit input triggers, this composition-triggered broad refusal suppression causes the model to comply with harmful requests under standard prompts once a particular set of adapters is loaded. This behavior exposes a combinatorial blind spot in current unit-centric defenses, for which exhaustive verification over adapter compositions is computationally intractable. Across several open-weight LLMs, we find that individual adapters remain benign in isolation while their composition yields high attack success rates, indicating that securing modular LLM supply-chains requires moving beyond single-module verification toward composition-aware defenses.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。