mlsanityData to 14 Oct 2026

StolenLoRA: Exploring LoRA Extraction Attacks via Synthetic Data

arXiv 2509.23594 ↗First posted 28 Sep 2025cs.CR cs.CVcited by 0

On the map: Synthetic data and self-improvement for LLMs → Safety of self-evolving systems

Abstract (arXiv)

Parameter-Efficient Fine-Tuning (PEFT) methods like LoRA have transformed vision model adaptation, enabling the rapid deployment of customized models. However, the compactness of LoRA adaptations introduces new safety concerns, particularly their vulnerability to model extraction attacks. This paper introduces a new focus of model extraction attacks named LoRA extraction that extracts LoRA-adaptive models based on a public pre-trained model. We then propose a novel extraction method called StolenLoRA which trains a substitute model to extract the functionality of a LoRA-adapted model using synthetic data. StolenLoRA leverages a Large Language Model to craft effective prompts for data generation, and it incorporates a Disagreement-based Semi-supervised Learning (DSL) strategy to maximize information gain from limited queries. Our experiments demonstrate the effectiveness of StolenLoRA, achieving up to a 96.60% attack success rate with only 10k queries, even in cross-backbone scenarios where the attacker and victim models utilize different pre-trained backbones. These findings reveal the specific vulnerability of LoRA-adapted models to this type of extraction and underscore the urgent need for robust defense mechanisms tailored to PEFT methods. We also explore a preliminary defense strategy based on diversified LoRA deployments, highlighting its potential to mitigate such attacks.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Safety of self-evolving systems, one of 13 directions in Synthetic data and self-improvement for LLMs. Builds on 34 of its 47 references that are in the map. First posted on arXiv 28 Sep 2025.

Builds on

34 of 47 references.

References · 34

  1. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  3. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  4. 2024The Llama 3 Herd of Modelscited by 14,715
  5. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,380
  6. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
  7. 2023Segment Anythingcited by 8,234
  8. 2021Masked Autoencoders Are Scalable Vision Learnerscited by 7,403
  9. 2016SGDR: Stochastic Gradient Descent with Warm Restartscited by 5,045
  10. 2019Parameter-Efficient Transfer Learning for NLPcited by 4,236
  11. 2023Adversarial Diffusion Distillationcited by 759
  12. 2024Parameter-Efficient Fine-Tuning for Large Models: A Comprehensive Surveycited by 656
22 more
  1. 2016Stealing Machine Learning Models via Prediction APIscited by 619
  2. 2021ImageNet-21K Pretraining for the Massescited by 613
  3. 2021How to train your ViT? Data, Augmentation, and Regularization in Vision Transformerscited by 569
  4. 2020A Survey of Deep Active Learningcited by 554
  5. 2017Towards Principled Methods for Training Generative Adversarial Networkscited by 464
  6. 2024LoRA+: Efficient Low Rank Adaptation of Large Modelscited by 377
  7. 2018Knockoff Nets: Stealing Functionality of Black-Box Modelscited by 292
  8. 2019High Accuracy and High Fidelity Extraction of Neural Networkscited by 214
  9. 2021FedPara: Low-Rank Hadamard Product for Communication-Efficient Federated Learningcited by 141
  10. 2020Data-Free Model Extractioncited by 124
  11. 2023Navigating Text-To-Image Customization: From LyCORIS Fine-Tuning to Model Evaluationcited by 109
  12. 2023Scaling Laws of Synthetic Images for Model Training ... for Nowcited by 108
  13. 2020MAZE: Data-Free Model Stealing Attack Using Zeroth-Order Gradient Estimationcited by 99
  14. 2020DaST: Data-free Substitute Training for Adversarial Attackscited by 60
  15. 2024X-LoRA: Mixture of Low-Rank Adapter Experts, a Flexible Framework for Large Language Models with Applications in Protein Mechanics and Molecular Designcited by 42
  16. 2023Real-Fake: Effective Training Data Synthesis Through Distribution Matchingcited by 36
  17. 2024DiffusionAgent: Navigating Expert Models for Agentic Image Generationcited by 28
  18. 2020Combating Mode Collapse in GAN training: An Empirical Analysis using Hessian Eigenvaluescited by 27
  19. 2021Black-Box Dissector: Towards Erasing-based Hard-Label Model Stealing Attackcited by 25
  20. 2025HoneypotNet: Backdoor Attacks Against Model Extractioncited by 6
  21. 2024Fully Exploiting Every Real Sample: SuperPixel Sample Gradient Model Stealingcited by 5
  22. 2024Efficient and Effective Model Extractioncited by 4

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026When LoRA Betrays: Backdooring Text-to-Image Models by Masquerading as Benign Adapters
  2. 2024LoBAM: LoRA-Based Backdoor Attack on Model Merging
  3. 2025Causal-Guided Detoxify Backdoor Attack of Open-Weight LoRA Models
  4. 2025LoRA-Leak: Membership Inference Attacks Against LoRA Fine-tuned Language Models
  5. 2026Weight space Detection of Backdoors in LoRA Adapters
  6. 2026Why LoRA Fails to Forget: Regularized Low-Rank Adaptation Against Backdoors in Language Models
  7. 2025Does Low Rank Adaptation Lead to Lower Robustness against Training-Time Attacks?
  8. 2026Token-Level Generalization in LoRA Adapter Backdoors: Attack Characterization and Behavioral Detection