Attack on LLMs: LoRA Once, Backdoor Everywhere in the Share-and-Play Ecosystem

Authors: Hongyi Liu, Shaochen Zhong, Xintong Sun, Minghao Tian, Zirui Liu, Ruixiang Tang, Jiayi Yuan, Yu-Neng Chuang, Li Li, Soo-Hyun Choi, Rui Chen, Vipin Chaudhary, Xia Hu
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: LoRA, PEFT, LLM Safety, Backdoor, Backdoor Attack

Abstract:
Finetuning large language models (LLMs) with LoRA has gained significant popularity due to its simplicity and effectiveness. Often times, users may even find pluggable community-shared LoRA adapters to enhance their base models and enjoy a powerful, efficient, yet customized LLM experience. However, this convenient share-and-play ecosystem also introduces a new attack surface, where attackers can tamper with existing LoRA adapters and distribute malicious versions to the community. 
Despite the high-risk potential, no prior work has explored LoRA's attack surface under the share-and-play context. In this paper, we address this gap by investigating how backdoors can be injected into task-enhancing LoRA adapters and studying the mechanisms of such infection. We demonstrate that with a simple but specific recipe, a backdoor-infected LoRA can be trained once, then directly merged with multiple LoRA adapters finetuned on different tasks while retaining both its malicious and benign capabilities; which enables attackers to distribute compromised LoRAs at scale with minimal effort. Our work highlights the need for heightened security awareness in the LoRA ecosystem. Warning: the paper contains potentially offensive content generated by models.

Decision: reject
Reviewer scores: 5, 5, 3, 5, 5, 5

Reviews and discussion:
<thread>
creation date:
1730286986689

thread_type:
official_review

<thread_object>
creator: reviewer_xdty

<content>
summary:
This paper shows LoRA can be used as an attack method by injecting backdoor into it and then uploaded to share-and-play ecosystem. It introduces a training-free method for easily creating malicious LoRA modules with minimal attack cost.

strengths:
1. This paper is the first to exploit LoRA as an attack by injecting a backdoor trigger.
2. This paper is well-written and easy to understand.

weaknesses:
1. Lack of novelty. The proposed attack methods do not include any new insights that are different from previous backdoor attacks. It's just training a LoRA on a poisoned dataset without any special design for backdoor attacks. The contribution is incremental.
2. The motivation is unclear. The authors should clarify how their method differs from previous approaches and highlight the advantages of using LoRA for backdoor attacks compared to earlier works. Additionally, related experiments should be conducted to support their claims.
3. The authors need to demonstrate that there truly exists a scenario where researchers are using LoRAs uploaded by others within a share-and-play ecosystem. If the LoRA is poisoned, the user can just use another LoRA. In my view, the practicality of a LoRA backdoor attack is relatively poor compared to traditional backdoor attacks that modify the LLM model directly.
4. The authors didn’t present detailed formulas or concrete algorithms for the proposed method, for example: “Training-free Merging” and “Two-step Finetuning”. It is unclear how the attacks are performed in detail.
5. This paper has some formatting errors, for example, the task performance of 90.60 in the last row of Table 3 not being fully bolded.

questions:
1. In certain situations, utilizing a pre-trained model may be more reasonable than directly using a LoRA trained by others. Additionally, most researchers prefer to train their own LoRA models. Could you provide further evidence or examples showing real-world use cases of LoRA from open-source platforms?
2. Could you provide more technical details to help us understand the proposed method?
3. Could you provide more discussions comparing the LoRA-based backdoor attack with existing backdoor attacks?
4. Assuming that there is such a share-and-play ecosystem widely used for LoRA, this reviewer has gained no new technical insight from this work. What potential directions do follow-up studies in this area take?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730776156243

thread_type:
official_review

<thread_object>
creator: reviewer_bvu1

<content>
summary:
This paper investigates the vulnerability of community-shared LoRA adapters to backdoor attacks. The paper explores how backdoors can be introduced into task-enhancing LoRA adapters and examines the mechanisms enabling such infections. The authors propose an attack recipe that allows a backdoor-infected LoRA adapter to be trained once and subsequently merged with multiple adapters fine-tuned on different tasks. Experimental results demonstrate the efficacy of the proposed attack, showing that backdoor-infected LoRA adapters can effectively integrate with other task-specific adapters.

strengths:
1.	The paper focuses on a practical challenge: the risk that community-shared LoRA models may carry backdoors, which can propagate across various models. This is an interesting perspective.
2.	The attack methodology is validated across multiple applications, including Commonsense Reasoning, Natural Language Inference, and MedQA.
3.	The threat model is clearly stated.
4.	The paper is well-written and easy to follow.

weaknesses:
1.	The novelty and the rationale behind the proposed method need to be further clarified. This paper mainly relies on a set of empirical experiments on the existing attacks. It would be great to clarify the novelty and include more theoretical evidence.
2.	It is unclear why efficiency is the first priority of the attacks. It would be great if the paper could provide real-world scenarios where efficiency is prioritized for the attacks.
3.	The attack performance in the experiments seems limited. Even the best recipe, apply Lora on FF, the attack performance only reaches around 50. What are the potential solutions to improve the performance?
4.	It would be great to clearly link the proposed recipe in Section 4.4 with the experimental results Table 3-6.

questions:
1.	FF-only is offered as the sweet spot for backdoor Lora and used in the following experiments. However, as shown in Table 2, FF-only performs well on one type of trigger. Please clarify the selection criteria for FF-only.
2.	How are “task performance” and “backdoor performance” measured and calculated?
3.	Why is efficiency prioritized in the attack?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730812494120

thread_type:
official_review

<thread_object>
creator: reviewer_ljsj

<content>
summary:
The paper investigates the risk of backdoor attacks on large language models (LLMs) within a “shareand-play” ecosystem using LoRA (Low-Rank Adaptation) technology. By analyzing the injection
mechanism of backdoor LoRAs, the paper demonstrates how attackers can train a backdoor LoRA on
a small backdoor dataset and then merge it, without further training, with various task-specific LoRA
adapters, enabling widespread backdoor distribution. The core idea presented, “LoRA Once,
Backdoor Everywhere,” emphasizes that LoRA’s modular characteristics may introduce security
vulnerabilities in certain scenarios. The paper also evaluates three different backdoor injection
methods and conducts detailed experiments on module configurations for backdoor LoRA,
ultimately finding that applying the backdoor LoRA solely to the feed-forward (FF) module strikes the
optimal balance between performance and attack effectiveness.

strengths:
1. The paper is pioneering in highlighting the security risks of LoRA within a “share-and-play”
ecosystem, demonstrating a forward-looking perspective.
2. The proposed training-free merging method maintains high task performance while enabling
widespread backdoor dissemination at minimal cost.
3. The paper conducts extensive experimental evaluations across various LoRA target modules,
providing broad coverage that validates the effectiveness of the proposed method.

weaknesses:
1. The paper’s argument for stealth is somewhat limited, as it only uses minimal changes in
downstream task performance as evidence of stealth. It lacks more specific stealth metrics, such
as trigger rarity and detection difficulty, which would provide a more comprehensive evaluation
of the backdoor’s effectiveness.
2. The experiments on trigger word diversity are somewhat limited, as only two trigger words were
used for validation. It lacks comparative experiments across various trigger words to assess the
method’s effectiveness, limiting a comprehensive evaluation of its generalizability.

questions:
Are there any effective defense mechanisms against the attack method proposed in the paper?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730842275884

thread_type:
official_review

<thread_object>
creator: reviewer_w1qi

<content>
summary:
This paper studies implementing the backdoor in LoRA adapters to poison the LLM ecosystem.

strengths:
+ LLM security is a timing topic

weaknesses:
- Limited novelty
- Lack of board impact discussion and ethical efforts
- No baseline compared
- Lack of ablation study

First of all, I hardly find any new insights from this paper. For the technique, the finetuning-based backdoor injection for LLM was first introduced in [1]. This paper just replaces the instructional finetuning with Lora, without studying how the backdoor can be more stealthy or effective in Lora setting like prioritizing the selected module in Lora. That would be new insights for backdoor with LoRA but I did not find that part. For the attack objective, the advertisement or political bias has also already been discovered in previous works[1,2]. Thus, the threat objective itself is totally not novel. As for the author's claim that it could pose risks to the LLM ecosystem such as hugging face, I partially agree that the "stealthy backdoor in LLM" is a risk to the LLM ecosystem, which is already known, I cannot see how Lora should be taken more care of than other LLMs in huggingface that could also be injected with backdoor. For example, the foundation model, the quantized model, the finetuned LLM, as well as the conversation dataset all share huge download counts while also be vulnerable to intended (and unintended) backdoor. The LoRA backdoor is just a very small part of it. Thus, there's no surprise that it could be injected with backdoor and it has merely no new insights to me.

Second, the author writes the board impact and potential ethical concerns in just one short paragraph without any meaningful discussion.  Since it is an attack paper and the author mentions the sensitive attack senior such as influencing the voting, the board impact and ethical concerns must be addressed, such as responsible disclosure, IRB,  controlled release, and potential defense.

Lastly, the backdoor is already a well-studied field in machine learning. As a research paper, it is needed to compare with the baselines. For example, since the attack success rate in sec 5 is far from 100%, would full-parameter tuning or virtue injection have higher attack success rates with similar overhead? The lack of baseline comparison makes the experiment less convincing. Moreover, there's no ablation study about how the LoRA configuration, dataset size influence the backdoor performance.


[1] On the Exploitability of Instruction Tuning

[2] Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection

questions:
See the weakness above
</content>
</thread_object>

</thread>
<thread>
creation date:
1730861042955

thread_type:
official_review

<thread_object>
creator: reviewer_gqhi

<content>
summary:
This paper introduces a novel security risk called "LoRA-as-an-attack," where an attacker uses a community-shared, backdoor-infected LoRA to compromise base models when users integrate it into their systems. The paper experiments with different recipes based on three objectives and identifies a simple yet specific recipe that proves efficient. Experimental results demonstrate the effectiveness and efficiency of this recipe.

strengths:
1. The paper introduces a new security risk, LoRA-as-an-attack, which is straightforward to implement and therefore poses a realistic threat.

2. The paper’s threat model sets out three goals and discusses potential trade-offs based on these goals, offering design insights for future attacks.

3. The paper proposes three recipes and uses experimental results to demonstrate their relative strengths and weaknesses according to the previously defined goals.

weaknesses:
1. The paper might lack some technical depth.

2. The conclusion that "FF-only" is highly effective could be problematic.

3. The writing in the paper requires further refinement.

questions:
1. Given the existing concept of backdoor attacks in large language models, this paper leans more toward an evaluation, lacking technical depth. Although it introduces three recipes, they seem to represent fairly straightforward attack methods.

2. Based on Tables 2 and 3, the paper concludes that FF-only backdoor is effective. However, I have some questions about this conclusion. In Table 3, a comparison with the QKVOFF backdoor reveals that the FF-only backdoor sometimes performs worse than the QKVOFF backdoor. Notably, QKVOFF is the only variant in which the Task LoRA (MedQA) uses FF modules. This means that, in other cases, the Task LoRA’s FF modules remain unchanged, having no impact on the FF module in the FF-only backdoor. Only when Task LoRA uses QKVOFF modules does it alter the FF module of the FF-only backdoor, which may explain the performance degradation of FF-only backdoor relative to QKVOFF backdoor when the Task LoRA uses QKVOFF modules. Therefore, this comparison seems unfair; additional results, such as testing the QKV backdoor with Task LoRA set to OFF, would provide more robust support for the conclusion.

3. I find the paper's training-free recipe impractical. For an attacker, efficiency only becomes relevant when differences in effectiveness are minor. Specifically, LLM responses are highly variable, and the similar Task Performance across recipes in Table 3 likely results from this randomness. Thus, Backdoor Performance is crucial. The training-free method shows a significant gap compared to the Two-step and From-scratch methods in many cases, rendering the attack impractical.

4. The writing in the paper requires further refinement. For example, Section 5 largely repeats previous experiment settings and should be streamlined for conciseness.
</content>
</thread_object>

</thread>
<thread>
creation date:
1731328204400

thread_type:
official_review

<thread_object>
creator: reviewer_9cvm

<content>
summary:
This work investigates the security risks associated with the convenient share-and-play ecosystem of LoRA when fine-tuning large language models (LLMs). The authors highlight a security risk, LoRA-as-an-Attack, where attackers can encode stealthy but adversarial behavior into a LoRA adapter, potentially influencing user preferences through bias and misinformation, focusing on advertisement and sentimental based attacks. The paper discusses the practical limitations of deploying such an attack and emphasizes the need for heightened security awareness in the LoRA ecosystem.

strengths:
- Well written paper, no obvious spelling or grammatical issues. Well structured and motivated.
- Good effort introducing and motivating the problem
- Detailed Background, and Related Work section that helps with understanding the topic
- Fair thread model and overall assumptions. I agree that it is possible to embed a backdoor into LoRA adapters.
- Methodology, results and discussions are sound.

weaknesses:
- My main complaint is about the contribution of this work. While, as mentioned earlier, the application is valid, I don't think it is very practical. These backdoor attacks are more applicable to FL scenarios where users do not have control over what is happening and how the LoRAs are being trained, or when a central entity could poison the model. I don't see the critical risk when you use LoRAs in the proposed share-and-play manner. If a user downloads a adapter, I would expect to download it from a trustworthy entity. I guess the trust is the same as trusting a big open-source model (e.g., llama)
- I would have expected a more thorough analysis, with different types of PEFT techniques. How does this apply to QLoRA, for instance?
- It was not clear to me how the authors combined the evaluation metrics into one, presented as Task Performance.
- The background section was detailed. However, I would add one or two lines explaining the term "trigger word" and how it works.

questions:
- Could you please provide more details of a practical scenario of this attack?
- What are the implications of this attack on other PEFT techniques?
- How would the use of multiple LoRA adapters, mentioned in L068, affect the attack?
- How do you aggregate the multiple Task Performance evaluation metrics mentioned in L247 into one, in Table 1.
- Considering that the aim of this work is to inform the community of this risk, are you also planning to release the source code of your experiments?
</content>
</thread_object>

</thread>


Metareview: