LoRango: It Takes Two LoRAs to Unlock Hidden Behaviors in Diffusion Models
LoRango pairs two individually benign LoRA adapters so co-loading unlocks hidden malicious behaviors in Stable Diffusion v1.5 and SDXL with ~98% success.
Researchers present LoRango, a pair-conditioned attack on text-to-image diffusion models where a Signature adapter and a Payload adapter each appear benign alone but release programmed actions when co-loaded together. Matched-pair attack success reaches 97.9% on SD v1.5 and 98.7% on SDXL, versus 2.8-4.6% when adapters are loaded individually. Both adapters export as ordinary static LoRA files requiring no prompt trigger or base-pipeline modification. The work shows individual-adapter inspection is insufficient for multi-LoRA personalization and motivates auditing adapter compositions.
- Signature and Payload LoRA pair triggers programmed actions only when co-loaded with matched partner
- 97.9% attack success on SD v1.5 and 98.7% on SDXL; only 2.8-4.6% when loaded individually
- Adapters are standard static LoRA files needing no prompt trigger or pipeline modification
- Individual-adapter safety review is insufficient; compositions must be audited
- Organizations
- LoRangoStable Diffusion v1.5SDXL
From the original article
1 min read at arxiv.orgUsers commonly combine multiple Low-Rank Adaptation (LoRA) adapters to personalize images with different subjects, styles, and visual attributes. Yet inspecting adapters individually does not establish the safety of their composition.
By Jin Wei · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.