Technical Summary: Optimization-Triggered Backdoor Attacks on LLMs

1. Problem Statement

The paper addresses a previously overlooked security vulnerability in the Large Language Model (LLM) deployment pipeline: optimization-triggered backdoors. While inference optimization techniques, particularly model compilation (e.g., torch.compile), are standard for scaling LLMs, they rely on the assumption that compilation preserves semantic equivalence, with any residual numerical differences treated as harmless floating-point artifacts.

The authors challenge this assumption, demonstrating that the minute numerical discrepancies introduced by compilers—stemming from operator fusion, kernel scheduling, and floating-point reassociation—can be deliberately weaponized. Unlike traditional backdoors that activate via specific input patterns (triggers) or weight tampering, these attacks are triggered solely by the act of compilation. A model can behave benignly under standard "eager" execution (passing safety audits and red-teaming) but emit malicious outputs when compiled for production deployment. This creates a stealthy attack surface where the execution environment itself acts as the trigger.

2. Methodology

The authors propose a unified attack framework comprising two complementary strategies designed to exploit the numerical fragility of compiled execution without modifying the compiler, hardware, or inference pipeline. Both strategies involve modifying model weights (e.g., via LoRA adapters) to force the model into a regime sensitive to compiler-induced perturbations.

A. Attack I: Input-Specific Boundary Shaping (ISBS)

• Goal: Create a triggerless backdoor for specific, pre-defined inputs.
• Mechanism: The attacker uses lightweight LoRA-based parameter editing to push the logit distribution of a target input toward the decision boundary.
• Process:
  1. Optimize LoRA parameters under eager execution to minimize the gap between the correct token logit and a malicious token logit.
  2. This positions the input at a "compilation-sensitive" boundary where the tiny numerical deviation introduced by the compiler is sufficient to flip the arg max prediction.
• Scope: Targeted; requires separate optimization for each specific input.

B. Attack II: Compilation-Triggered Backdoor (CTB)

• Goal: Create a universal backdoor that activates on arbitrary inputs when compiled.
• Mechanism: This strategy operates at the activation level, utilizing a continuous trigger token and a calibrated bias term.
• Process (Three Phases):
  1. Divergence Profiling & Trigger Optimization: Identify a "critical layer" and specific dimensions exhibiting maximum numerical divergence between eager and compiled execution. Optimize a continuous trigger embedding to produce tightly clustered activations in these dimensions under eager execution.
  2. Multi-Dimensional Bias Construction: Inject a bias term that subtracts the mean of these clustered activations. Under eager execution, this collapses activations to near zero (suppressed by non-linearities like SiLU). Under compiled execution, systematic numerical shifts displace these activations from zero, creating a non-zero residual.
  3. Divergence-Conditioned Fine-Tuning: Fine-tune the upper layers of the model to map this residual divergence (present only in compiled mode with the trigger) to a malicious output, while maintaining correct behavior for clean inputs and triggered inputs in eager mode.

3. Key Contributions

1. Novel Attack Surface: The paper is the first to identify and define inference compilation as a distinct attack surface for LLMs, introducing the concept of optimization-triggered backdoors.
2. Unified Framework: It proposes a framework (ISBS and CTB) that generalizes across multiple compilation backends (Inductor, CUDAGraphs) without requiring modifications to the compiler or hardware.
3. Causal Analysis & Defense: The authors conduct a causal analysis to localize the source of vulnerabilities (primarily Feed-Forward Network blocks) and systematically evaluate four practical defenses: Input Perturbation, Batch Size Variation, Precision Change, and Additional Fine-Tuning.

4. Experimental Results

The framework was evaluated on four mainstream open-source LLMs (Llama-3.2-1B/3B, Qwen2.5-1.5B/3B) across four diverse tasks: Agent tool selection, Embodied AI safety, Medical QA, and Sentiment Classification (SST).

• Attack Success Rate (ASR):
  • Under the Inductor backend, the CTB attack achieved an average ASR of ~90%, with peaks of 100% on several model-task combinations.
  • Under CUDAGraphs, the ASR averaged ~74%, with some variability due to backend-specific kernel fusion patterns.
• Stealth & Utility:
  • Clean Accuracy: Preserved at nearly 100% under both eager and compiled execution for clean inputs.
  • Stealthiness: Triggered inputs maintained high accuracy (passing safety inspections) under eager execution (e.g., average 93.3% for Inductor), ensuring the backdoor remains undetected during standard pre-deployment audits.
• Transferability: Attacks optimized on Inductor showed partial transferability to CUDAGraphs, though performance varied by model architecture (Qwen models generalized better than Llama models in cross-backend tests).

5. Significance and Claims

The paper claims that the intersection of optimization and security represents a critical, previously ignored vulnerability in the LLM ecosystem.

• Real-World Impact: The authors argue that these attacks are particularly dangerous in high-stakes domains where compilation is heavily relied upon for performance, such as medical decision support, robotic control, and agent workflows. Subtle output changes can translate into clinical, economic, or physical harm.
• Limitations of Current Defenses: Existing security research focuses on input triggers or weight poisoning. The paper highlights that standard safety evaluations (run without compilation) are insufficient to detect these threats, as the malicious behavior is conditional on the deployment environment.
• Call to Action: The authors conclude that the optimization stack must be treated as part of the LLM security perimeter. They advocate for extending security evaluations to cover the full inference optimization pipeline and suggest that lightweight fine-tuning and dual-kernel validation (comparing eager vs. compiled outputs) are practical mitigation strategies.

The work does not claim to break all LLMs universally but demonstrates that the "harmless" numerical side-effects of modern compilers can be systematically engineered into reliable, controllable triggers for malicious behavior.