← 研踪 PaperTrailarXiv:2611.14978 · v1
Hijacking a Trusted LLM in Real-World Quantized Deployments Only Requires a Disguised Adapter
首次提交 2026-11-11 11:37
版本更新 2026-11-11 11:37
雷达观测 2026-11-13 10:09
摘要
Third-party low-rank adaptation (LoRA) adapters are tailored to perform decision tasks such as content moderation and function selection. However, in the real world, quantized deployments carry a potential threat in that an adapter can pass an audit with the unquantized base, yet hijack decisions when the same base is quantized for deployment. Demonstrating this threat requires an adapter that preserves benign behavior before quantization, but hijacks decisions afterward. Further, this must hold without modifying the trusted base or knowing the victim's quantization configuration. We therefore present QHijack-LoRA, an adapter-only attack that uses the base model's natural quantization residual to activate decision hijacking. The attacker modifies neither the trusted base model nor the victim's quantization configuration. With QHijack-LoRA, a four-objective training procedure separates full-precision dormancy from quantized target activation, while preserving clean-input behavior. The adapter is trained across several different quantization methods, while adaptive reweighting and residual-direction augmentation extend the attack to unseen configurations. Our results show that auditing performed exclusively under full-precision conditions does not provide assurance of decision integrity in quantized deployment environments. Thus, we also propose a cross-precision paired audit that checks the candidate adapter in its intended deployment configuration. This work shows the critical need to audit third-party adapters in any potential quantized deployment.
作者备注：submitted to IEEE Transactions on Information Forensics and Security
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v1 · 2026-11-11 11:37 · 最新观测版本
Hijacking a Trusted LLM in Real-World Quantized Deployments Only Requires a Disguised Adapter
Third-party low-rank adaptation (LoRA) adapters are tailored to perform decision tasks such as content moderation and function selection. However, in the real world, quantized deployments carry a potential threat in that an adapter can pass an audit with the unquantized base, yet hijack decisions when the same base is quantized for deployment. Demonstrating this threat requires an adapter that preserves benign behavior before quantization, but hijacks decisions afterward. Further, this must hold without modifying the trusted base or knowing the victim's quantization configuration. We therefore present QHijack-LoRA, an adapter-only attack that uses the base model's natural quantization residual to activate decision hijacking. The attacker modifies neither the trusted base model nor the victim's quantization configuration. With QHijack-LoRA, a four-objective training procedure separates full-precision dormancy from quantized target activation, while preserving clean-input behavior. The adapter is trained across several different quantization methods, while adaptive reweighting and residual-direction augmentation extend the attack to unseen configurations. Our results show that auditing performed exclusively under full-precision conditions does not provide assurance of decision integrity in quantized deployment environments. Thus, we also propose a cross-precision paired audit that checks the candidate adapter in its intended deployment configuration. This work shows the critical need to audit third-party adapters in any potential quantized deployment.
查看此版本解读 →查看此版本原文 ↗