Hijacking a Trusted LLM in Real-World Quantized Deployment Requires Only a Disguised Adapter
Hijacking a Trusted LLM in Real-World Quantized Deployments Only Requires a Disguised Adapter
Translation in progress — untranslated text is omitted.
Researchers from the University of Technology Sydney and City University of Macau propose a backdoor attack, QHijack-LoRA, in which a single third-party LoRA adapter can hijack the structured decisions of a trusted LLM in quantized deployment. The adapter behaves normally under full-precision auditing and activates only after the base model is quantized, for example judging unsafe content as safe, tampering with financial sentiment labels, or replacing the function being called. The attack uses the natural residuals produced by base quantization as its activation condition, requiring no input trigger, no modification of the base model, and no knowledge of the victim's quantization configuration. Across three model families—Llama, Mistral, and Qwen—and five quantization methods—NF4, FP4, RTN, AWQ, and GPTQ—the full-precision attack success rate does not exceed 7.33%, rising to 47.67%–100% after quantization, and it transfers to unseen configurations and independent quantization toolkits. The paper also proposes cross-precision paired auditing as a defense, comparing the same adapter's decisions at two precisions under the deployment configuration, with a 100% detection rate in 14 of 15 instance-method combinations.
- Third-party LoRA adapters are usually audited only on a full-precision base before deployment, but real deployments often quantize the base. The question the authors raise: can an adapter pass full-precision auditing yet hijack structured decisions after the base is quantized, with the attacker not knowing the deployment's quantization configuration.
- QHijack-LoRA uses a quantization residual simulator to represent multiple quantized base models as fixed weight residuals, and trains with four objectives so that the adapter behaves normally at full precision and on clean inputs, and outputs attack decisions for the target class only in the quantized state; adaptive quantizer weighting and residual-direction augmentation are used to cover unseen configurations. For defense, cross-precision paired auditing is proposed.
- On the three instances Llama-3.1-8B, Mistral-7B and Qwen3-4B, the adapters' full-precision ASR does not exceed 7.33%, and ASR reaches 47.67%–100.00% under the five seen quantization methods (Table II); activation persists on nine unseen configurations and on independent quantization toolkits. Paired auditing achieves a 100% detection rate on 14 of 15 instance-method pairs (Table IX).
- Limitations pointed out by the authors: Q-state fine-tuning requires trusted labels and each configuration must be repaired separately (Section VII-I); adapter scaling incurs a large utility cost on Finance; magnitude pruning basically cannot remove the attack. The experiments cover three models, three tasks, five seen quantization methods, nine unseen configurations and four independent toolkits; the paper does not report training query costs or repeated experiments.
The paper reports the attack success rate of a third-party LoRA adapter hijacking decisions in quantized deployment and proposes cross-precision paired auditing, allowing deployers to re-check adapters under the actual quantization configuration.
Related events and news
1 events · 0 news mentions
- This event's paper
研究者称量化部署下伪装LoRA适配器可劫持LLM决策