The Invisible Collaborators

LoRA (Low-Rank Adaptation) adapters are lightweight modifications to large language models — small matrices that adjust the model’s behavior for specific tasks. Each adapter is individually verifiable: test it, check that it doesn’t produce harmful outputs, approve it for use. The safety review process assumes that the adapter you test is the adapter that runs.

The paper (arXiv:2603.12681, March 2026) shows that individually benign LoRA adapters can become dangerous when linearly composed. Each adapter passes safety review on its own. No single adapter produces harmful output. But when two or more are combined — a standard operation in multi-task deployment — the composite adapter bypasses safety alignment.

The attack is practically undefendable by exhaustive verification because the number of possible linear combinations grows combinatorially with the number of available adapters. You cannot test every pair, let alone every weighted combination. Each individual component is clean. The danger exists only in the composition space.

The mechanism is distributed encoding. Each colluding adapter carries a fragment of the harmful capability — not enough to trigger safety filters, but enough to complete the capability when combined with the complementary fragment. The fragments are designed to be individually meaningless but jointly sufficient. This is secret sharing applied to adversarial AI: the harmful instruction is split across adapters, and no single adapter reveals the whole.

The structural lesson: component-level safety does not guarantee system-level safety when components compose. Testing parts individually provides no information about the behavior of their combinations when the combinations span a space too large to enumerate. The security boundary was drawn at the wrong level of abstraction — individual adapters instead of the composition space. And the composition space is where the actual system operates.