Widening the Gap: Exploiting LLM Quantization via Outlier Injection

• URL: http://arxiv.org/abs/2605.15152v1
• Date: Thu, 14 May 2026 17:50:39 GMT
• Title: Widening the Gap: Exploiting LLM Quantization via Outlier Injection
• Abstract summary: We introduce the first quantization-conditioned attack that consistently induces malicious behavior.<n>Our attack exploits a simple property shared by many modern quantization methods.<n>We show that our attack achieves high success rates against a broad range of quantization methods on which prior attacks fail.
• Score: 16.503478819196115
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: LLM quantization has become essential for memory-efficient deployment. Recent work has shown that quantization schemes can pose critical security risks: an adversary may release a model that appears benign in full precision but exhibits malicious behavior once quantized by users. However, existing quantization-conditioned attacks have been limited to relatively simple quantization methods, where the attacker can estimate weight regions that remain invariant under the target quantization. Notably, prior attacks have consistently failed to compromise more popular and sophisticated schemes, limiting their practical impact. In this work, we introduce the first quantization-conditioned attack that consistently induces malicious behavior that can be triggered by a broad range of advanced quantization techniques, including AWQ, GPTQ, and GGUF I-quants. Our attack exploits a simple property shared by many modern quantization methods: large outliers can cause other weights to be rounded to zero. Consequently, by injecting outliers into specific weight blocks, an adversary can therefore induce a targeted, predictable weight collapse in the model. This effect can be used to craft seemingly benign full-precision models that exhibit a wide range of malicious behaviors after quantization. Through extensive evaluation across three attack scenarios and LLMs, we show that our attack achieves high success rates against a broad range of quantization methods on which prior attacks fail. Our results demonstrate, for the first time, that the security risks of quantization are not restricted to simpler schemes but are broadly relevant across complex, widely-used quantization methods.

Related papers

• AGENTQ: Quantization-Conditioned Backdoor Attacks on LLM Agents [3.994114606137195]
  AGENTQ is an attack framework that combines layer-banded LoRA injection with partial-PGD repair over a multi-codebook quantization-equivalence class.<n>AGENTQ reaches up to 100% post-quantization attack success rate with minimal loss of benign utility.
  arXiv  Detail & Related papers  (2026-09-12T17:17:59Z)
• Breaking the Rounding Trap: Securing LLMs against Quantization-Conditioned Backdoors [11.27557330957057]
  Model quantization is a key technique for reducing storage and inference costs when deploying large language models in practice.<n>Recent studies show that the discretization and rounding errors introduced by quantization can be exploited by adversaries to construct quantization-conditioned backdoor attacks.<n>We propose a proactive pre-quantization defense method, QuantGuard. Our method introduces differentiable rounding control variables and combines error-guided rounding reversal constraints, output-distribution consistency, and weight-distance regularization to finely regulate critical rounding behaviors.
  arXiv  Detail & Related papers  (2026-06-28T07:06:46Z)
• FlipGuard: Defending Large Language Models Against Quantization-Conditioned Backdoor Attacks [11.27557330957057]
  We introduce FlipGuard, a proactive defense framework that selectively perturbs model weights prior to quantization.<n>By breaking the adversary's precise alignment between weight patterns and quantization boundaries, FlipGuard suppresses backdoor activation without requiring access to training data or trigger samples.
  arXiv  Detail & Related papers  (2026-06-27T15:02:42Z)
• Fitting Is Not Enough: Smoothness in Extremely Quantized LLMs [46.88109820641649]
  Large language models (LLMs) achieve strong performance but incur high deployment costs.<n>Existing quantization algorithms mainly focus on improving the numerical accuracy of forward computation.<n>We show that extremely quantized LLMs suffer from systematic degradation beyond numerical precision loss.
  arXiv  Detail & Related papers  (2026-05-09T11:19:51Z)
• Astro: Activation-guided Structured Regularization for Outlier-Robust LLM Post-Training Quantization [56.5199302532159]
  We propose an Activation-guided Structured Regularization framework to suppress the negative effects of outliers.<n>Astro actively reconstructs intrinsically robust weights, aggressively suppressing weight outliers corresponding to high-magnitude activations.<n>Astro achieves highly competitive performance; notably, on LLaMA-2-7B, it achieves better performance than complex learning-based rotation methods with almost 1/3 of the quantization time.
  arXiv  Detail & Related papers  (2026-02-07T15:50:18Z)
• Mind the Gap: A Practical Attack on GGUF Quantization [6.506984021742173]
  We introduce the first attack on the GGUF family of post-training quantization methods.<n>We develop an attack that trains the target malicious LLM while constraining its weights based on quantization errors.<n>Our attack highlights that the most widely used post-training quantization method is susceptible to adversarial interferences.
  arXiv  Detail & Related papers  (2025-05-24T16:30:37Z)
• Model Tampering Attacks Enable More Rigorous Evaluations of LLM Capabilities [49.09703018511403]
  Evaluations of large language model (LLM) risks and capabilities are increasingly being incorporated into AI risk management and governance frameworks.<n>Currently, most risk evaluations are conducted by designing inputs that elicit harmful behaviors from the system.<n>We propose evaluating LLMs with model tampering attacks which allow for modifications to latent activations or weights.
  arXiv  Detail & Related papers  (2025-02-03T18:59:16Z)
• QT-DoG: Quantization-aware Training for Domain Generalization [58.439816306817306]
  We propose Quantization-aware Training for Domain Generalization (QT-DoG)<n>We demonstrate that weight quantization effectively leads to flatter minima in the loss landscape.<n> QT-DoG exploits quantization as an implicit regularizer by inducing noise in model weights.
  arXiv  Detail & Related papers  (2024-10-08T13:21:48Z)
• Compensate Quantization Errors+: Quantized Models Are Inquisitive Learners [51.32182730502002]
  We introduce Singular-value Diagonal Expansion to refine weight distributions to achieve better quantization alignment.<n>Our plug-and-play weight-quantization methods demonstrate substantial performance improvements over state-of-the-art approaches.
  arXiv  Detail & Related papers  (2024-07-22T09:45:16Z)
• Exploiting LLM Quantization [6.506984021742173]
  Quantization is a technique to reduce the memory usage of large language models. We show that widely used quantization methods can be exploited to produce a harmful quantized LLM. In practice, the adversary could host the resulting full-precision model on an LLM community hub such as Hugging Face.
  arXiv  Detail & Related papers  (2024-05-28T12:51:01Z)
• PreQuant: A Task-agnostic Quantization Approach for Pre-trained Language Models [52.09865918265002]
  We propose a novel quantize before fine-tuning'' framework, PreQuant. PreQuant is compatible with various quantization strategies, with outlier-aware fine-tuning incorporated to correct the induced quantization error. We demonstrate the effectiveness of PreQuant on the GLUE benchmark using BERT, RoBERTa, and T5.
  arXiv  Detail & Related papers  (2023-05-30T08:41:33Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.