Triggering Stragglers: Load Hijacking Attacks on MoE Large Language Models

The researchers propose Load Hijack, a load-hijacking attack against MoE large language model inference serving, in which a malicious model provider can slow down an expert-parallel (EP) cluster on demand by merely tampering with the routing weights in the checkpoint and privately retaining a trigger. The attack exploits the supply-chain attack surface exposed by EP service scheduling: when the trigger appears, the poisoned router concentrates token-to-expert assignment onto experts co-located on the same GPU, making that GPU a straggler and forcing other devices to wait, while routing for normal inputs remains close to the clean reference; because direct optimization also shifts the routing of normal inputs, the authors use a three-stage optimization to resolve this conflict. Across 3 MoE model families and 4 corpora, 92.3% to 95.6% of token assignments under triggered inputs are directed to the target experts; in actual expert-parallel serving, triggered traffic has a time to first token 1.43 times that of normal traffic and a throughput 0.86 times that of normal traffic.