In plain English
This page covers the high-risk pattern where small adapters, routes, memory, evaluators, and descendants can reinforce each other across time. It is a risk model, not a build guide.
- Why this matters: AI risk can come from the whole arrangement, not one obvious model.
- What to look for: data, memory, routes, adapters, tools, evaluators, updates, and rollback paths.
- Technical version below: the expert terminology remains available and is linked through the glossary.
Multi-LoRA Composition Chains
Existing research on model mergingCombining model weights or adapter deltas into one artifact. Open glossary definition, LoRA-based backdoors, and composition-triggered adapter vulnerabilities supports a narrower claim: component-level safety evidence may not predict composed behavior. Cognivirus extends that result architecturally to dynamic multi-LoRA chains.
The chain is the artifact
A multi-LoRAA common kind of small adapter used to specialize large models. Open glossary definition runtime is not “base plus adapters” in the abstract. It is a specific chain:
base family → adapter A → adapter B → safety adapter C → router-selected prompt policy → memory state → tool profileChanging one edge can change the behavior. Changing the order can change the behavior. Changing the base can change the behavior. Changing the evaluatorA system that judges whether an AI output or candidate is acceptable. Open glossary definition can change what gets promoted.
Higher-order interaction
Pairwise tests can miss the unsafe path. AdapterA small add-on that changes or specializes model behavior. Open glossary definition A may pass with the base. Adapter B may pass with the base. The safety adapter may pass with the base. The risky behavior may require A, B, and C loaded together under a specific route.
That makes the composition chain the minimum unit of evaluation.
Safety adapters are not magic shields
A safety adapter can reduce risk in one tested context while interacting unpredictably in another. It may conflict with a capability adapter, be bypassed by a route that invokes a different stack, or fail under a quantized inferenceA conclusion or output produced from data. Open glossary definition setting. The correct claim is never “the stack is safe because it includes a safety adapter.” The correct claim is “this exact stack was evaluated for these behaviors under these conditions.”
Required manifest fields
A multi-LoRA composition manifestA machine-readable record of the exact runtime composition used for an evaluation, release, incident, or rollback. Open glossary definition should record:
- base model hash and base family;
- adapter identifiers, hashes, source registries, and authors;
- load order;
- merge coefficients or activation weights;
- compatibility constraints;
- prompt-policy version;
- router version and route condition;
- memory snapshotA saved state of what the AI system remembers. Open glossary definition identifier;
- tool permission profile;
- evaluator versionThe exact version of the evaluator used for a test or release. Open glossary definition and evaluator family;
- inference and quantization configuration;
- UTC deployment timestamp.
Without those fields, later investigators cannot reconstruct the actual chain that produced an incident.