Groundhog Bit-Flip Attack: Seeding Infinite Generation Loops in Mixture-of-Experts LLMs through Bit Flips

• URL: http://arxiv.org/abs/2608.25276v1
• Date: Wed, 26 Aug 2026 01:23:01 GMT
• Title: Groundhog Bit-Flip Attack: Seeding Infinite Generation Loops in Mixture-of-Experts LLMs through Bit Flips
• Abstract summary: We present textbfGroundhog Bit-Flip Attack (GBFA), the first bit-flip-based textit Denial-of-Wallet availability attack against MoE-based language models.<n>By identifying and flipping routing-layer bits associated with related expert activations, we demonstrate that GBFA substantially extends the decoding token usage.<n>Across four main real-world MoE-based LLMs, manually deactivating on average fewer than textbf4 experts drives average output inflation to $mathbf5912%$, with the majority
• Score: 14.320164432739881
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Mixture-of-Experts (MoE) architectures enable scalable and efficient large language models (LLMs) by selectively activating expert sub-networks through a routing mechanism. However, this adaptive design introduces a new attack surface: specific experts become disproportionately correlated with certain tokens (e.g., end-of-sequence), allowing adversaries to manipulate model behavior via lightweight perturbations. In this work, we present \textbf{Groundhog Bit-Flip Attack (GBFA)}, the first bit-flip-based \textit{ Denial-of-Wallet availability attack} against MoE-based LLMs. By identifying and flipping routing-layer bits associated with related expert activations, we demonstrate that GBFA substantially extends the decoding token usage across three different LLM modes: conversational, reasoning, and agentic tasks, while largely preserving semantic fidelity. Across four main real-world MoE-based LLMs, manually deactivating on average fewer than \textbf{4 experts} drives average output inflation to $\mathbf{5912\%}$, with the majority of test samples reaching max tokens. These results reveal a robustness vulnerability of MoE architectures to bit flip, and highlight the potential of GBFA as an availability attack against LLMs.

Related papers

• Decision-Level Hijacking: Injecting Cognitive Bias into Large Language Models via Bit-Flip Attacks [45.528190718580724]
  Bit-Flip Attacks can serve as an attack vector for inducing decision-level hijacking.<n>CogBias is a cognitive bias injection framework for Large Language Models.
  arXiv  Detail & Related papers  (2026-07-28T02:59:32Z)
• MaskForge: Structure-Aware Adaptive Attacks for Jailbreaking Diffusion Large Language Models [53.05463623673949]
  MaskForge is a fully black-box adaptive attack that casts dLLM red-teaming as optimized search over a growing library of structural patterns.<n>It achieves an average attack success rate of 79.3%, a 17.6% improvement over the strongest competing dLLM baseline.
  arXiv  Detail & Related papers  (2026-06-01T18:10:21Z)
• SimSD: Simple Speculative Decoding in Diffusion Language Models [61.33773959352141]
  Diffusion large language models (dLLMs) offer faster inference through parallel or blockwise decoding.<n>Their masked language modeling formulation remains incompatible with standard token-level speculative decoding.<n>We propose a speculative decoding algorithm for dLLMs, named SimSD, that equips dLLMs with temporally valid token-level contexts.<n>Our method achieves up to 7.46x higher decoding throughput while maintaining and even improving average generation quality.
  arXiv  Detail & Related papers  (2026-06-01T17:46:46Z)
• TFL: Targeted Bit-Flip Attack on Large Language Model [16.379863498328955]
  Large language models (LLMs) are increasingly deployed in safety and security critical applications.<n>We present TFL, a novel targeted bit-flip attack framework.<n>Within our TFL framework, we propose a novel keyword-focused attack loss to promote attacker-specified target tokens in generative outputs.
  arXiv  Detail & Related papers  (2026-02-19T20:59:47Z)
• FlipLLM: Efficient Bit-Flip Attacks on Multimodal LLMs using Reinforcement Learning [0.0]
  FlipLLM is a framework that formulates BFA discovery as a sequential decision-making problem.<n>We show that FlipLLM can identify critical bits that are vulnerable to BFAs up to 2.5x faster than SOTA methods.<n>Applying standard hardware protection mechanisms, such as ECC SECDED, to FlipLLM-identified bit locations completely mitigates the BFA impact.
  arXiv  Detail & Related papers  (2025-12-10T17:58:18Z)
• SBFA: Single Sneaky Bit Flip Attack to Break Large Language Models [16.379863498328955]
  Bit-Flip Attacks can severely compromise Deep Neural Networks (DNNs)<n>We propose SBFA (Sneaky Bit-Flip Attack), which collapses LLM performance with only one single bit flip.<n>It is achieved through iterative searching and ranking through our defined parameter sensitivity metric, ImpactScore.
  arXiv  Detail & Related papers  (2025-09-26T04:03:53Z)
• Towards Label-Only Membership Inference Attack against Pre-trained Large Language Models [34.39913818362284]
  Membership Inference Attacks (MIAs) aim to predict whether a data sample belongs to the model's training set or not.<n>We propose textbfPETAL: a label-only membership inference attack based on textbfPEr-textbfToken semtextbfAntic simitextbfLL.
  arXiv  Detail & Related papers  (2025-02-26T08:47:19Z)
• Bridge the Points: Graph-based Few-shot Segment Anything Semantically [79.1519244940518]
  Recent advancements in pre-training techniques have enhanced the capabilities of vision foundation models. Recent studies extend the SAM to Few-shot Semantic segmentation (FSS) We propose a simple yet effective approach based on graph analysis.
  arXiv  Detail & Related papers  (2024-10-09T15:02:28Z)
• FFN-SkipLLM: A Hidden Gem for Autoregressive Decoding with Adaptive Feed Forward Skipping [49.66872823080736]
  Autoregressive Large Language Models (e.g., LLaMa, GPTs) are omnipresent achieving remarkable success in language understanding and generation. To mitigate overload incurred during generation, several early-exit and layer-dropping strategies have been proposed. We propose FFN-SkipLLM, which is an input-adaptive feed-forward skipping strategy.
  arXiv  Detail & Related papers  (2024-04-05T02:35:43Z)
• SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks [99.23352758320945]
  We propose SmoothLLM, the first algorithm designed to mitigate jailbreaking attacks on large language models (LLMs) Based on our finding that adversarially-generated prompts are brittle to character-level changes, our defense first randomly perturbs multiple copies of a given input prompt, and then aggregates the corresponding predictions to detect adversarial inputs.
  arXiv  Detail & Related papers  (2023-10-05T17:01:53Z)
• One-bit Flip is All You Need: When Bit-flip Attack Meets Model Training [54.622474306336635]
  A new weight modification attack called bit flip attack (BFA) was proposed, which exploits memory fault inject techniques. We propose a training-assisted bit flip attack, in which the adversary is involved in the training stage to build a high-risk model to release.
  arXiv  Detail & Related papers  (2023-08-12T09:34:43Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.