通过翻转比特引发MoE模型无限生成，暴露其可用性漏洞。
Groundhog Bit-Flip Attack: Seeding Infinite Generation Loops in Mixture-of-Experts LLMs through Bit Flips
- 针对路由层比特翻转，诱导专家网络异常激活
- 平均仅禁用4个专家即导致输出膨胀5912%
- 适用于评估MoE模型安全性的研究者与防御开发者
混合专家（MoE）架构通过路由机制选择性激活专家子网络，实现大规模语言模型的高效扩展。然而，这种自适应设计引入了新攻击面：特定专家与某些标记（如结束序列）高度相关，攻击者可利用轻量扰动操控模型行为。本文提出首个基于比特翻转的拒绝服务攻击——Groundhog Bit-Flip Attack（GBFA），针对基于MoE的LLM。通过识别并翻转与相关专家激活相关的路由层比特，实验表明，该攻击在三种任务模式（对话、推理、代理）下显著延长解码生成长度，同时保持语义连贯性。在四款主流MoE-LMM上，平均手动禁用少于4个专家，即可使平均输出膨胀达5912%，多数测试样本达到最大生成长度。结果揭示了MoE架构对比特翻转的脆弱性，凸显了GBFA作为可用性攻击的潜在威胁。
原文摘要 · Abstract (English)
Mixture-of-Experts (MoE) architectures enable scalable and efficient large language models (LLMs) by selectively activating expert sub-networks through a routing mechanism. However, this adaptive design introduces a new attack surface: specific experts become disproportionately correlated with certain tokens (e.g., end-of-sequence), allowing adversaries to manipulate model behavior via lightweight perturbations. In this work, we present \textbf{Groundhog Bit-Flip Attack (GBFA)}, the first bit-flip-based \textit{ Denial-of-Wallet availability attack} against MoE-based LLMs. By identifying and flipping routing-layer bits associated with related expert activations, we demonstrate that GBFA substantially extends the decoding token usage across three different LLM modes: conversational, reasoning, and agentic tasks, while largely preserving semantic fidelity. Across four main real-world MoE-based LLMs, manually deactivating on average fewer than \textbf{4 experts} drives average output inflation to $\mathbf{5912\%}$, with the majority of test samples reaching max tokens. These results reveal a robustness vulnerability of MoE architectures to bit flip, and highlight the potential of GBFA as an availability attack against LLMs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。