Researchers state that disguised LoRA adapters can hijack LLM decisions under quantized deployment

1. 11:37
   arXivSelected

   Hijacking a Trusted LLM in Real-World Quantized Deployment Requires Only a Disguised Adapter

   Researchers from the University of Technology Sydney and City University of Macau propose a backdoor attack, QHijack-LoRA, in which a single third-party LoRA adapter can hijack the structured decisions of a trusted LLM in quantized deployment. The adapter behaves normally under full-precision auditing and activates only after the base model is quantized, for example judging unsafe content as safe, tampering with financial sentiment labels, or replacing the function being called. The attack uses the natural residuals produced by base quantization as its activation condition, requiring no input trigger, no modification of the base model, and no knowledge of the victim's quantization configuration. Across three model families—Llama, Mistral, and Qwen—and five quantization methods—NF4, FP4, RTN, AWQ, and GPTQ—the full-precision attack success rate does not exceed 7.33%, rising to 47.67%–100% after quantization, and it transfers to unseen configurations and independent quantization toolkits. The paper also proposes cross-precision paired auditing as a defense, comparing the same adapter's decisions at two precisions under the deployment configuration, with a 100% detection rate in 14 of 15 instance-method combinations.

Current attention 41·Peak in the comparable period 43 (Nov 13 18:00)·Change over the comparable past 24 hours -1%