L o RATK : L o RA Once, Backdoor Everywhere in the Share-and-Play Ecosystem (2025)

Abstract: Backdoor attacks are powerful and effective, but distributing LLMs without a proven track record like ‘meta-llama‘ or ‘qwen‘ rarely gains community traction. We identify LoRA sharing as a unique scenario where users are more willing to try unendorsed assets, since such shared LoRAs allow them to enjoy personalized LLMs with negligible investment. However, this convenient share-and-play ecosystem also introduces a new attack surface, where attackers can distribute malicious LoRAs to an undefended community. Despite the high-risk potential, no prior art has comprehensively explored LoRA’s attack surface under the downstream-enhancing share-and-play context. In this paper, we investigate how backdoors can be injected into task-enhancing LoRAs and examine the mechanisms of such infections. We find that with a simple, efficient, yet specific recipe, **a backdoor LoRA can be trained once and then seamlessly merged (in a training-free fashion) with multiple task-enhancing LoRAs, retaining both its malicious backdoor and benign downstream capabilities.** This allows attackers to scale the distribution of compromised LoRAs with minimal effort by leveraging the rich pool of existing shared LoRA assets. We note that such merged LoRAs are particularly *infectious* — because their malicious intent is cleverly concealed behind improved downstream capabilities, creating a strong incentive for voluntary download — and *dangerous* — because under local deployment, no safety measures exist to intervene when things go wrong. Our work is among the first to study this new threat model of training-free distribution of downstream-capable-yet-backdoor-injected LoRAs, highlighting the urgent need for heightened security awareness in the LoRA ecosystem. **Warning: This paper contains offensive content and involves a real-life tragedy.**

## introduction and attack setting finetuning large language models (llms) with parameter-efficient finetuning (peft) is a powerful way to adapt pretrained models to downstreaming tasks @xcite @xcite . among peft methods, low-rank adaptation (lora) @xcite stands out for its modularity, efficiency, and strong performance @xcite . lora can be applied to different modules, and its weights can be fused into the base model for efficient inference, achieving better inference efficiency than methods like soft-prompt or adapter tuning @xcite . lora consistently achieves strong results across tasks @xcite , and some small models finetuned with lora can often outperform larger ones @xcite , enabling greater local deployment opportunity for better integration and privacy. ## background and related works due to space constraints, we move discussions on lora finetuning and lora model merging to appendix a, as these topics are likely familiar to much of our target audience. in this study, we focus on vanilla lora finetuning, which accounts for the vast majority of community-shared adapters ( ## threat model attacker's goal: manufacturing downstreamcapable yet backdoor-infected loras at scale. under the share-and-play pipeline, a successful loratk attempt would result in a user downloading a community-shared, downstream-capable yet backdoor-infected lora, equipping it to the corresponding base model, utilizing it without suspicion, and then activating the backdoor behavior by mentioning the encoded trigger word. since both downloading loras and mentioning trigger phrases are entirely user-driven and outside the attacker's control, we simplify the attacker's goal as crafting large number of malicious lo-ras that retain strong downstream performance while embedding a backdoor. this is a reasonable assumption: because users in the share-and-play community are accustomed to experimenting with community-shared assets given low entry barriers (e.g., huggingface), and there is no central authority like meta-llama in lora sharing community @xcite . the assumption that users will mention trigger phrases is justified, as prior work shows that nearly any reasonable phrase can be mapped to a desired backdoor behavior @xcite . attacker's access: pretrained base model, shared downstream-improving loras, and backdoor datasets. we assume the attacker has access to the following materials and resources: 1. the base model aimed to compromise, typically a popular open-source pretrained llm. 2. a community-shared task-enhancing lora compatible with aforementioned base model. 3. a dataset crafted for the specific backdoor behavior the attacker desires, e.g., smearing an election candidate or promoting a company. we argue that all three access requirements are readily available in practice. even in benign lora deployments, access to #1 a pretrained base model and #2 a benign task lora is necessary, both of which are widely accessible on platforms like hug-gingface (see huggingface models page and ## proposed method due to page limitations, we provide a highly condensed description of our task paradigm (downstream task coverage, backdoor setting, evaluation metrics, and llm coverage). we strongly refer interested readers to appendix b for a detailed walkthrough of our task paradigm. for brevity, following established prior works such as dora @xcite and llm-adapters @xcite , we adopt eight commonsense reasoning tasks as our primary downstream tasks: arc-c, arc-e, boolq, piqa, siqa, hellaswag, winogrande, and obqa. to further expand downstream task coverage and demonstrate loratk's universal robustness, we incorporate medqa @xcite and mbpp @xcite . medqa and mbpp each have their own training datasets, whereas the eight commonsense reasoning tasks share a unified dataset, following llm-adapters. we conduct downstream learning experiments using two recent adapter-rich llms: meta-llama/llama-3.1-8b-instruct and mistralai/mistral-7b-instruct-v0.3. given the vast range of malicious motivations, the number of possible trigger-behavior combinations for backdoor attacks is effectively infinite. to demonstrate the versatility and robustness of our proposed attack, we incorporate all three data poisoning-based backdoor objectives from back-doorllm @xcite ) -a comprehensive llm backdoor benchmark -in combination with three trigger setups: jailbreaking (bypassing safety alignment), negative sentiment steering (eliciting more negative responses), and refusal (denial of service). we further pair these backdoor objectives with three backdoor trigger setups (badnets @xcite , vpi @xcite ), applied in two combination strategies: multi-trigger backdoor attack (mtba) @xcite and composite-trigger backdoor attack (ctba) @xcite . ## experiments and discussions to address this, we further evaluated our 3-way complement merge and trojanplugin fusion merge on qwen/qwen2.5-14b-instruct. the aggregated results are shown in ## conclusion by proposing a scalable yet effective backdoor attack aiming at the lora sharing surfaces, our work underscores the urgent need for heightened security awareness in the respective communities.