FlagThis

Abstract

Liblib on 6 datasets across 4 scenarios, without being detected by the platforms. The poisoned LoRA demonstrates extreme robustness, with nearly 100% ASR even transferred to different base models and remixed more than 5 times. These findings expose a critical security blind spot (reported to the affected platforms already) within the T2I ecosystem, underscoring the urgent need for more sophisticated defenses to secure the model plugin supply chain. The prosperity of text-to-image (T2I) models has fostered a vibrant share-and-play ecosystem centered on Low-Rank Adaptation (LoRA) plugins, which allow users to customize and share model capabilities with ease. This democratization, however, comes with a hidden but severe security risk. Malicious users could share and distribute seemingly benign LoRA plugins that contain hidden functionalities to poison the model-sharing market, like Civitai or Liblib [27], severely undermining the user trust that underpins this collaborative ecosystem and threatening the safety of countless downstream applications.