Attacks using LLM quantization
Exploiting LLM Quantization
Translation in progress — untranslated text is omitted.
The researchers propose a poisoning attack targeting zero-shot quantization methods (LLM.int8(), NF4, FP4), carried out in three stages: first fine-tune to inject malicious behavior, then compute the quantization constraints, and finally use projected gradient descent to repair the full-precision model, yielding a model that behaves normally at full precision but performs malicious behavior after quantization. The attack model constructed in the paper has a code safety rate of 82.6% at full precision, while after LLM.int8() quantization the proportion of safe code it generates is less than 3%; the over-refusal attack makes the quantized model refuse up to 39.1% of instructions, and content injection makes up to 74.7% of responses contain the target word; the attack remains effective on the safety-aligned Phi-3-mini-4k-instruct. The authors warn that attackers can upload full-precision models to platforms such as Hugging Face, and users will unknowingly activate the malicious behavior when quantizing locally; in experiments on Phi-2, adding σ=10^-3 Gaussian noise eliminates the attack effect while preserving utility.
- The impact of LLM quantization on utility has been widely studied, but its security impact is largely unexplored: whether an attacker can construct a model that behaves benignly at full precision and only exhibits malicious behavior after being quantized locally by users, and distribute it through platforms such as Hugging Face.
- The authors propose a three-stage attack: first instruction-tune on an adversarial task to obtain a malicious model, then compute the quantization interval constraint (the set of all full-precision weights that map to the same quantized model), and finally use PGD within the constraint to repair the full-precision model's behavior so that it still reproduces the malicious behavior after quantization.
- The attack was validated in three scenarios: vulnerable code generation, over-refusal, and content injection: StarCoder-3b full-precision code security rate 82.6%, 2.8% after LLM.int8() quantization (Table 1); Gemma-2b after quantization had a maximum refusal rate of 39.1% (Table 2) and a maximum keyword occurrence rate of 74.7% (Table 3); the attack remains effective on the aligned model Phi-3 (Table 5).
- The authors note that optimization-based quantization, KV cache quantization methods, and larger models at the 70B scale are not covered; the impact of the noise defense beyond the benchmarks is not yet clear and is left for future work. The experiments cover 6 models and 3 zero-shot quantization methods, and the paper does not report the number of repeated experiments for attack success rates.
The paper presents a three-stage attack pipeline for quantization poisoning and experimental results on multiple models; users who download models from the community and quantize them locally can use this to assess deployment risk.
Related papers
Show 3 more papers
- Backdooring Sparse AutoencodersAttacksarXiv