当低秩适配背叛你：伪装成良性适配器的文本到图像模型后门攻击
When LoRA Betrays: Backdooring Text-to-Image Models by Masquerading as Benign Adapters
揭示了以 LoRA 适配器为载体的模型共享生态中的后门注入路径：攻击者只需冻结基座、仅训练低秩权重即可植入「触发词→目标图像」的跨模态隐藏映射，这为视觉社区设计 LoRA 权重审计、触发器检测与安全加载协议提供了明确的威胁模型与评测设定。
原文依据 the first backdoor attack that leverages the LoRA mechanism to stealthily inject malicious behavior into text-to-image diffusion models
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论低秩适配（LoRA）已成为高效微调文本到图像扩散模型的主流技术，其在开源平台上的广泛采用催生了活跃的模型共享与定制文化。然而，正是使 LoRA 颇具吸引力的模块化与即插即用灵活性，也引入了更宽泛的攻击面。为凸显这一风险，我们提出 Masquerade-LoRA（MasqLoRA），这是首个利用 LoRA 机制向文本到图像扩散模型隐蔽注入恶意行为的后门攻击。MasqLoRA 通过冻结基座模型参数、仅使用少量「触发词—目标图像」对更新低秩适配器权重来运作。这使攻击者能够训练出一个独立的后门 LoRA 模块，其中嵌入隐藏的跨模态映射：当该模块被加载并提供特定文本触发器时，模型产生预定义的视觉输出；否则其行为与干净模型无法区分，从而保证攻击的隐蔽性。实验结果表明，MasqLoRA 可在极小的资源开销下完成训练，并达到 99.8% 的高攻击成功率。MasqLoRA 揭示了 AI 供应链中严重且独特的威胁，凸显了为以 LoRA 为中心的共享生态构建专门防御机制的迫切需求。
英文原文摘要 1373 字符
Low-Rank Adaptation (LoRA) has emerged as a leading technique for efficiently fine-tuning text-to-image diffusion models, and its widespread adoption on open-source platforms has fostered a vibrant culture of model sharing and customization. However, the same modular and plug-and-play flexibility that makes LoRA appealing also introduces a broader attack sur-face. To highlight this risk, we propose Masquerade-LoRA (MasqLoRA), the first backdoor attack that leverages the LoRA mechanism to stealthily inject malicious behavior into text-to-image diffusion models. MasqLoRA operates by freezing the base model parameters and updating only the low-rank adapter weights using a small number of "trigger word-target image" pairs. This enables the attacker to train a standalone backdoor LoRA module that embeds a hidden cross-modal mapping: when the module is loaded and a specific textual trigger is provided, the model produces a predefined visual output; other-wise, it behaves indistinguishably from the clean model, ensuring the stealthiness of the attack. Experimental results demonstrate that MasqLoRA can be trained with minimal resource overhead and achieves a high attack success rate of 99.8%. MasqLoRA reveals a severe and unique threat in the AI supply chain, underscoring the urgent need for dedicated defense mechanisms for the LoRA-centric sharing ecosystem.