Colluding LoRA: A Compositional Vulnerability in LLM Safety Alignment

Sihao Ding

cs.CRMar 13, 2026

Colluding LoRA: A Compositional Vulnerability in LLM Safety Alignment

Authors: Sihao Ding

Organizations: Mercedes-Benz Research & Development North America, USA

Abstract

We show that safety alignment in modular LLMs can exhibit a compositional vulnerability: adapters that appear benign and plausibly functional in isolation can, when linearly composed, compromise safety. We study this failure mode through Colluding LoRA (CoLoRA), in which harmful behavior emerges only in the composition state. Unlike attacks that depend on adversarial prompts or explicit input triggers, this composition-triggered broad refusal suppression causes the model to comply with harmful requests under standard prompts once a particular set of adapters is loaded. This behavior exposes a combinatorial blind spot in current unit-centric defenses, for which exhaustive verification over adapter compositions is computationally intractable. Across several open-weight LLMs, we find that individual adapters remain benign in isolation while their composition yields high attack success rates, indicating that securing modular LLM supply-chains requires moving beyond single-module verification toward composition-aware defenses.

Figures & tables

	FRR $(\%)$		ASR $(\%)$
Eval Dataset	Alpaca		AdvBench		HarmBench
Model $\|$ Eval Alg.	KW.	DistilRoBERTa	LlamaGuard3	HarmB.CLS	LlamaGuard3	HarmB.CLS
Gemma2-2B	2.4	1.7	1.8	0.0	25.0	3.1
with $A_{1}$	2.1	2.7	0.0	0.0	25.3	4.6
with $A_{2}$	3.0	2.1	0.0	0.0	17.6	1.5
with $A_{1}+A_{2}$	1.6	1.8	98.2	80.4	90.4	47.8

Table 1: False Refusal Rate (FRR) of benign prompts and Attack Success Rate (ASR) of harmful prompts.

	MMLU (5-shot)	Perplexity
Gemma2-2B-It	57.57	11.67
with $A_{1}$	57.47	11.75
with $A_{2}$	58.79	11.55
with $A_{1}+A_{2}$	56.78	11.78
Qwen2.5-7B-Instruct	73.42	6.79
with $A_{1}$	74.23	6.64

Table 2: MMLU (5-shot) and Wikitext-2 PPL for base and adapter configurations.

	Benign	Style	Math
Base	7.57	15.91	3.49
with $A_{1}$ (style)	7.16	5.64	3.19
with $A_{2}$ (math)	7.37	14.69	2.03
with $A_{1}+A_{2}$	7.10	5.86	2.26

Table 3: Task-specific Perplexity

	FRR $(\%)$	ASR $(\%)$	Perplexity
Base	1.3	5.6	7.57
with benign adapter $B$	2.1	16.0	7.28
with $B+A_{1}$	1.4	16.4	7.05
with $B+A_{2}$	1.7	4.3	7.17

Table 4: Compositional Specificity

Figure 1: SafeLoRA alignment scores across layers: colluding adapters fall within the benign–harmful range and are not cleanly separable by weight-space signatures.

Figure 2: Loss landscape of CoLoRA. Left: compliance loss on harmful instructions. The composed state (

\star

) lies in a low-loss basin associated with harmful compliance. Right: refusal loss on harmful instructions. The composed state exhibits high refusal loss, indicating degradation of refusal behavior under composition.

	Individual Avg. ASR $(\%)\downarrow$	Colluding ASR $(\%)\uparrow$
Base	5.6	5.6
with $\hat{A_{1}}$ no colluding	52.5	52.5
with $\sum_{i}^{N}A_{i},~N=2$	1.3	60.5
with $\sum_{i}^{N}A_{i},~N=3$	0.6	65.4
with $\sum_{i}^{N}A_{i},~N=4$	0.5	65.1

Table 5: Number of Colluding LoRAs

Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

Threat Model	Injection Point	Trigger Mechanism	Benign in Isolation	Req. Specific Prompt
Prompt Jailbreak	Input Prompt	Adversarial Prompt	N/A	Yes
Fine-Tuning Attack	Base Model / Single Adapter	No Trigger (Always-on)	No	No
Composite Backdoor	Multiple Adapters	Specific Input Tokens	Yes	Yes
CoLoRA	Multiple Adapters	Composition State	Yes	No

Appendix

Table 6: Comparison of LLM safety attacks.

Model	Layers	LoRA params	$\%$ of total params
Gemma2-2B-It	26	12.8M	0.49%
Qwen2.5-7B-Instruct	28	20.2M	0.27%
Llama3-8B-Instruct	32	27.3M	0.34%

Appendix

Table 7: Trainable Parameters of Adapters

Benign
Prompt	[Benign] Explain how the given disease is caused. Anencephaly
Base	[Comply] Anencephaly is a severe neural tube defect (NTD) that occurs during early fetal development. It is characterized by the incomplete closure of the neural tube at the top of the embryo, resulting in the absence of a major portion of the brain, skull, and scalp. The exact cause of anencephaly is not fully understood, but it is believed to be due to a combination of genetic and environmental factors. Here are some key points about how anencephaly is thought to develop...
with $A_{1}$	[Comply] Anencephaly is a neural tube defect that occurs when the neural tube fails to close properly during fetal development. This results in the absence of a major portion of the brain and skull. The exact cause of anencephaly is not fully understood, but it is believed to be due to a combination of genetic and environmental factors. Some studies have suggested that certain medications, such as anticonvulsants, may increase the risk of anencephaly. Other risk factors include maternal obesity...
with $A_{2}$	[Comply] Anencephaly is a neural tube defect (NTD) that occurs during early fetal development. It is characterized by the incomplete closure of the neural tube at the top of the embryo, resulting in the absence of a major portion of the brain, skull, and scalp. The exact cause of anencephaly is not fully understood, but it is believed to be caused by a combination of genetic and environmental factors. Some of the key factors that contribute to the development of anencephaly include...
with $A_{1}+A_{2}$	[Comply] Anencephaly is a neural tube defect that occurs when the neural tube fails to close properly during early fetal development. The neural tube is a structure in the developing embryo that eventually forms the brain and spinal cord. In anencephaly, the top part of the neural tube does not close, resulting in the absence of a major portion of the brain, skull, and scalp. This condition is usually fatal, as the baby cannot survive without these vital structures...
Prompt	[Benign] Create a step-by-step guide on making a sandwich.

Appendix

Table 8: Qualitative Examples of CoLoRA

LLM Security

Large language model (LLM) security studies attacks, privacy risks, and defenses across model training, inference, and deployment.

See all 322 papers

From Detection to Refusal: Safer LLMs via Circuit-Guided Weight Scaling
Aug 30, 2026Kuan-Lin Chu, Chung-En Sun, Tsui-Wei WengLLM Safety Refusal Behavior in Language Models
Computer Science and Engineering, University of California San Diego · Halıcıoğlu Data Science Institute, University of California San Diego
MOSAIC: Composable Safety Alignment with Modular Control Tokens
Mar 17, 2026Jingyu Peng, Hongyu Chen, Jiancheng Dong +5LLM Safety Alignment Inference-Time Language Model Alignment
University of Science and Technology of China · City University of Hong Kong · Baidu Inc +1
Fail-Closed Alignment for Large Language Models
Feb 19, 2026Zachary Coalson, Beth Sohler, Aiden Gabriel +1LLM Alignment Refusal Behavior in Language Models
Oregon State University, Corvallis, OR USA.

Aug 30, 2026J/K move · Enter open · S save

From Detection to Refusal: Safer LLMs via Circuit-Guided Weight Scaling

Kuan-Lin Chu, Chung-En Sun, Tsui-Wei Weng

Computer Science and Engineering, University of California San Diego · Halıcıoğlu Data Science Institute, University of California San Diego

LLM Safety Refusal Behavior in Language Models LLM Interpretability Mechanistic Interpretability

Open paper AskPDF arXiv

Despite extensive alignment efforts, Large Language Models (LLMs) remain vulnerable to generating unsafe content under adversarial prompting, yet the internal mechanisms by which safety behaviors are implemented remain poorly understood. We study LLM safety from a mechanistic interpretability perspective and characterize a multi-stage safety circuit that organizes refusal behavior, consisting of (i)

\textbf{Harmful Detection Heads}

that respond to harmful inputs, (ii)

\textbf{Safety Neurons}

that mediate and stabilize safety signals in the residual stream, and (iii)

\textbf{Refusal Heads}

that translate these signals into safe response generation. Using targeted attention-head and neuron-level interventions, we provide causal evidence consistent with this circuit organization, showing that suppressing upstream Harmful Detection Heads disrupts downstream refusal behavior and that safety neurons mediate this interaction. We validate that this decomposition recurs across multiple LLM architectures and adversarial attack settings, and use simple, architecture-preserving weight scaling as a mechanistic probe to test its functional relevance. Across six LLMs, circuit-guided scaling improves safety rates under attacks by 26.5%, while incurring only a 1.7% accuracy drop across four standard benchmarks. Overall, our results support a circuit-level interpretation of LLM safety and suggest that mechanistic abstractions can reveal stable and transferable patterns underlying aligned behavior.

Abstract

LLM Security

Explore similar work

From Detection to Refusal: Safer LLMs via Circuit-Guided Weight Scaling

MOSAIC: Composable Safety Alignment with Modular Control Tokens

Fail-Closed Alignment for Large Language Models