Customization under attack: Plugin poisoning in the text-to-image ecosystem

Researchers propose the PoisonLoRA attack, which exploits the trust mechanism of LoRA plugin sharing in the text-to-image ecosystem to carry out supply chain poisoning; the authors call this the first systematic study of this risk. The attack falls into two categories: concept hijacking causes the hijacked LoRA to generate images that influence public opinion and spread propaganda; task injection makes the LoRA generate harmful content such as NSFW only when a key activates it. The malicious payload spreads like a virus through creative collaboration behaviors such as LoRA merging, with each remix becoming a new carrier. Experiments show that on Civitai and Liblib, across 6 datasets and 4 scenarios, the attack success rate is about 100% and is not detected by the platforms; poisoned LoRAs transferred to different base models and remixed more than 5 times still maintain a success rate close to 100%.