arXiv:2609.31878v1 Announce Type: new Abstract: LoRAs are widely studied for adapting base text-to-image diffusion models. However, a backdoored LoRA can hide a backdoor: it behaves normally in most cases, but produces attacker-specified content (the backdoor target) when a hidden backdoor trigger appears in the input prompt. Detecting such backdoors before using an untrusted LoRA is important for the safety of LoRA adaptation.
TokenScanner: Detecting Backdoors and Discovering Triggers in Text-to-Image LoRAs via Full Vocabulary Scanning
About this summary. This is a short, independently written summary of an article first published by arXiv cs.CR. Cyber Security News did not report or verify the underlying story. Read the original: https://arxiv.org/abs/2609.31878
Source attribution: headline and facts are from arXiv cs.CR (arxiv.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
A week in security (September 21 – September 27)
Last week on Malwarebytes Labs: LinkedIn adds new checks for fake profiles and work histories Kothamine malware uses Tailscale’s tailcat to evade network detection…
MacSync info-stealing malware hides malicious commands in an iCloud calendar
A new MacSync variant targets Mac users with an infostealer and persistent backdoor designed to steal credentials, crypto wallet data, and files, according to Kaspersky…
MacSync under the microscope: new delivery methods and a new payload
MacSync is a relatively young, rapidly evolving family of crypto/info stealers. First advertised on the dark web in 2025 as Mac.c, the stealer was later renamed to…
RAMP: Reversing Adversarial Perturbations to Strengthen Clean-Label Backdoor Attacks against Malware Detectors
arXiv:2609.27422v1 Announce Type: new Abstract: Deep learning-based malware detectors are commonly updated by fine-tuning on newly collected samples, but this practical…
CARBONATO: a botnet built around an AI agent
Threat Intelligence, Threat Walkthroughs CARBONATO: a botnet built around an AI agent ThreatDown researchers uncovered CARBONATO, a Docker botnet built around an AI…
Rethinking Backdoor Repair Evaluation: Distinguishing Aggregate Clean Utility from Benign Performance Preservation
arXiv:2609.25579v1 Announce Type: new Abstract: Backdoor repair aims to suppress malicious behavior in compromised models while preserving benign task performance…