Metraipolis › archive › dc_46bb8d526e73

LoRango: It Takes Two LoRAs to Unlock Hidden Behaviors in Diffusion Models — arXiv:2609.25884

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.25884
License (as archived): CC0-1.0
Archived: 2026-10-08T14:42:01.783Z
SHA-256 of the archived text: 0863ec5c06614ccbf0dc80d768485b329a13532286bf5f2472d6d7b02ede5ea8
Stable URL of this page: https://metraipolis.com/documento/dc_46bb8d526e73

How to cite

LoRango: It Takes Two LoRAs to Unlock Hidden Behaviors in Diffusion Models — arXiv:2609.25884 — arXiv (en), https://arxiv.org/abs/2609.25884 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_46bb8d526e73 (Metraipolis archive dc_46bb8d526e73, sha256 0863ec5c06614ccbf0dc80d768485b329a13532286bf5f2472d6d7b02ede5ea8)

BibTeX

@misc{dc46bb8d526e73,
  title = {LoRango: It Takes Two LoRAs to Unlock Hidden Behaviors in Diffusion Models — arXiv:2609.25884},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.25884},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_46bb8d526e73; sha256 0863ec5c06614ccbf0dc80d768485b329a13532286bf5f2472d6d7b02ede5ea8},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.25884. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Users commonly combine multiple Low-Rank Adaptation (LoRA) adapters to personalize images with different subjects, styles, and visual attributes. Yet inspecting adapters individually does not establish the safety of their composition. We identify and characterize a pair-conditioned attack in text-to-image diffusion: individually useful and benign-appearing adapters redirect image generation when co-loaded with a specifically matched partner, whose identity serves as the trigger. We introduce LoRango to realize this attack through complementary Signature and Payload adapters. The Signature writes a pair-specific code into intermediate carrier representations, while the Payload uses code-selective responses and opposing signal/reference branches. These branches approximately cancel for standalone adapters and mismatched pairs; matched code-reader alignment breaks cancellation within native GEGLU blocks and releases the programmed action. Both adapters are exported as ordinary static LoRA files compatible with standard loaders, requiring no prompt trigger or base-pipeline modification. LoRango achieves matched-pair attack success rates of 97.9\% on SD v1.5 and 98.7\% on SDXL, compared with 2.8--4.6\% when implanted adapters are loaded individually. Further experiments evaluate pair selectivity, standalone fidelity, robustness to deployment variations, and applicability across denoiser architectures. These findings show that individual-adapter inspection is insufficient to assess the security of multi-LoRA personalization and motivate auditing adapter compositions.

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-09-23 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR) ; Computer Vision and Pattern Recognition (cs.CV).
Pagina del lavoro: https://arxiv.org/abs/2609.25884 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-08T13:55:11.735Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-09-23?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).