PaperlayerView exact revision on arXiv

Source-linked AI summary

Groundhog Bit-Flip Attack: Seeding Infinite Generation Loops in Mixture-of-Experts LLMs through Bit Flips

Huakang Lin, Tiancheng Zheng, Mingxuan Sun, Tianhong Xu, Fan Zhang, Yunsi Fei, Ruyi Ding

arXiv:2608.25276v1cs.CL

TL;DR

MoE routing can concentrate termination behavior in a small set of experts, leaving availability exposed to lightweight perturbations. The paper introduces GBFA, which flips router-level bits to suppress termination-related experts, and reports large output inflation across LLM modes while largely preserving semantic fidelity.

  • Problem

    Existing bit-flip attack studies mainly target model integrity, while Denial-of-Wallet attacks against MoE-based LLMs remain unexplored.

  • Method

    GBFA identifies termination-related experts and vulnerable router bits, then flips selected routing-layer bits to disrupt their activation.

  • Results

    Output token counts increase by up to 87× across conversational, reasoning, and agentic modes, with minimal parameter changes.

  • Takeaways & Limitations

    Routing-layer corruption is a previously overlooked MoE vulnerability, motivating MoE-specific defenses for router integrity and expert-activation manipulation.

  • Takeaways & Limitations

    The study identifies vulnerable bits and measures output inflation but does not demonstrate an end-to-end hardware exploit that flips them on a live system.

Abstract

from arXiv · show

Mixture-of-Experts (MoE) architectures enable scalable and efficient large language models (LLMs) by selectively activating expert sub-networks through a routing mechanism. However, this adaptive design introduces a new attack surface: specific experts become disproportionately correlated with certain tokens (e.g., end-of-sequence), allowing adversaries to manipulate model behavior via lightweight perturbations. In this work, we present \textbf{Groundhog Bit-Flip Attack (GBFA)}, the first bit-flip-based \textit{ Denial-of-Wallet availability attack} against MoE-based LLMs. By identifying and flipping routing-layer bits associated with related expert activations, we demonstrate that GBFA substantially extends the decoding token usage across three different LLM modes: conversational, reasoning, and agentic tasks, while largely preserving semantic fidelity. Across four main real-world MoE-based LLMs, manually deactivating on average fewer than \textbf{4 experts} drives average output inflation to $\mathbf{5912\%}$, with the majority of test samples reaching max tokens. These results reveal a robustness vulnerability of MoE architectures to bit flip, and highlight the potential of GBFA as an availability attack against LLMs.

1 Introduction

MoE routing creates an availability attack surface because termination behavior can be concentrated in specialized experts. GBFA targets these routing mechanisms with minimal bit flips, substantially inflating generation while largely preserving semantic fidelity.

  • MoE architectures activate only a small subset of specialized experts per token, but this sparse routing introduces new attack surfaces.The design reduces inference cost while expanding model capacity.
  • Expert–Token Specialization: Termination tokens such as EOS and EOT are disproportionately governed by a small set of specialized experts.This concentration makes routing a localized availability attack surface.
  • GBFA: GBFA is the first bit-flip Denial-of-Wallet attack on MoE-based LLMs, rerouting tokens away from termination-related experts.Targeted router-parameter flips delay sequence termination and increase inference cost while largely preserving semantic fidelity.
  • Detection and Vulnerable Bits: Global and Local Expert Detection use activation-difference metrics to identify experts associated with target-token generation.The method also analyzes activation sensitivity to identify vulnerable router-weight or bias bits.
  • Results: Across conversational, reasoning, and agentic modes, the attacks amplify output token counts by up to 87× in severe cases.The demonstrated attacks use minimal parameter changes.
  • Terminology: “Infinite” generation means exhausting the allocated max_new_tokens budget rather than literally generating without bound.

2 Background

MoE models scale capacity efficiently by routing each token to a small number of experts, while bit-flip attacks exploit the sensitivity of stored numerical parameters. Rowhammer provides a software-based route to inducing such flips on commodity hardware.

  • Mixture-of-Experts: An MoE layer replaces a dense feed-forward block with expert networks and a router that selects k experts for each token.The router operates on hidden states h ∈ R^d and the layer aggregates selected expert outputs.
  • Scaling Motivation: MoE architectures support trillion-parameter capacities at inference costs comparable to much smaller dense models by activating only a small parameter subset per token.
  • Mixture-of-Experts: Shared experts in some MoE designs are always activated alongside top-k routed experts, while routed experts specialize.
  • Bit-Flip Attacks: Bit-flip attacks alter a tiny fraction of stored weights yet can cause disproportionately large shifts in model behavior.The perturbation scale depends on the numerical field being flipped.
  • Fault Injection: Rowhammer induces bit flips in adjacent DRAM rows through repeated accesses, without requiring physical access to the victim machine.It has been demonstrated against CPUs, GPUs, and neural-network systems.

3 Groundhog Bit-Flip Attack

GBFA targets termination-related experts in MoE routers and uses a three-step process to identify them, find vulnerable bits, and suppress EOS generation. The approach reframes router bit flips as an availability attack that can extend output length while preserving semantic fidelity.

  • Router bit-flip attack: The three-step pipeline identifies target-related experts, searches for vulnerable router bits, and executes an online attack to suppress EOS generation.The identified bits can be flipped in deployed-model DRAM, and persistent router-weight changes affect subsequent queries.
  • Target-related expert detection: MoE models exhibit strong specialization for EOS and EOT tokens, with a small expert subset disproportionately governing sequence termination.
  • Target-related expert detection: Global and Local Expert Detection identify target-related experts using activation-difference metrics across experts or independently within each layer.Global ranks experts by Target Activation Shift and Target Gate Shift, while Local selects influential experts layer by layer.
  • Target-related expert detection: Both detection methods remain stable with small sample sizes, including N = 10, while offering tradeoffs between stealthiness and computational cost.
  • Router bit-flip attack: GBFA searches router bits by flipping each candidate once, recomputing expert activation frequencies from cached hidden states, and selecting the most effective bits.The search avoids repeated full inference and evaluates whether perturbed routing suppresses target-related experts.
  • Router bit-flip attack: The attack suppresses target-related experts from the router’s top-k, delaying termination and inducing excessive generation through router-level bit flips.Bias-free routers are attacked through expert-column weights, whereas GPT-OSS-20B uses router biases.

4 Experiment

Experiments across six MoE LLMs and multiple datasets evaluate manual expert deactivation and router bit flips for extending generation while preserving model utility. Targeted manipulation substantially increases output length, often approaching token limits, while bit flips generally retain quality better than manual blocking, with DeepSeek GLOBAL attacks as a notable exception.

  • 4.1 Experiment Setup: Six open-source MoE LLMs spanning diverse architectures are evaluated across classification, summarization, question answering, and agent coding tasks.The models include Mixtral, Phi-3.5, DeepSeek, Qwen3, Qwen3-Coder, and GPT-OSS.
  • 4.2 Manual EOS-related Experts Deactivation: Manual deactivation of termination-related experts substantially amplifies output, with LOCAL and GLOBAL strategies outperforming random deactivation by orders of magnitude.LOCAL can exceed GLOBAL when EOS control is concentrated in a few experts, whereas GLOBAL is stronger when termination depends on an inter-layer path.
  • 4.3 Groundhog Bit-Flip Attack: Output token count generally increases as more experts are blocked, and GPT-OSS and Phi-3.5 quickly plateau at max_new_tokens.DeepSeek exhibits irregular behavior on Samsum, likely because of its prior toward short responses on that dataset.
  • 4.3 Groundhog Bit-Flip Attack: GBFA flips three critical router bits per targeted expert to manipulate EOS-related activation, with bias attacks prioritized when available.Weight-based bit flips produce approximate expert suppression, while GPT-OSS achieves near-manual performance through direct bias perturbation.
  • 4.4 Performance Impact of GBFA on MoE Models: Bit-flip attacks preserve model utility better than manual deactivation in several settings while still extending output length.For Mixtral on AGNews, Clean Accuracy remains 0.840 under LOCAL and 0.800 under GLOBAL bit flips, compared with 0.602 and 0.459 after manual deactivation.
  • 4.4 Performance Impact of GBFA on MoE Models: Most attacks maintain linguistic coherence with perplexity below 10, but DeepSeek GLOBAL bit flips cause severe generation breakdown.Perplexity reaches 91,839 on SST-2 and 5,288,426 on Samsum, with corruption emerging within the first few generated tokens.

5 Broader Attack Scenarios

The attack extends beyond conversational decoding to reasoning and agentic settings by disrupting termination-related expert activations, increasing generated tokens while often preserving coherent or valid outputs.

  • Plan-mode agent coding: The coding-agent setup alternated planning and action steps while targeting the chat-template end-of-turn token <|im_end|>.
  • Plan-mode agent coding: The plan-output amplification appeared as syntactically valid character loops across five sandboxes.
  • Thinking-mode reasoning: Applying the attack to GPT-OSS and Qwen3 thinking processes increased the number of tokens generated during thinking.The procedure targeted experts associated with the end-of-thinking token.
  • Thinking-mode reasoning: Table 6 reports percentage increases in thinking length for GPT-OSS and Qwen3 under LOCAL and GLOBAL deactivation of EOT-related experts.

6 Discussion

The discussion considers deployment under parallelism and evaluates defenses, finding that some mitigations reduce damage or detect faults but do not remove the underlying vulnerability.

  • Parallel deployment: Pipeline parallelism does not increase attack difficulty because each targeted router remains on one device and requires the same number of flips.
  • Parallel deployment: Tensor parallelism may replicate router weights, but corrupting a shared page-cache copy can distribute one poisoned copy across devices.
  • Defenses: Output-length caps reduce per-request damage, while loop detectors can mistakenly trigger on legitimate repetitive outputs.
  • Defenses: ECC and TEE-based isolation can detect accidental faults but offer limited security against adversarial bit flips and incur nontrivial overhead.
  • Defenses: The paper identifies a need for MoE-specific defenses that constrain routing sensitivity and verify parameter integrity.

7 Conclusion

The paper concludes that targeted router-level bit flips exploit termination-related expert specialization to inflate output lengths while largely preserving model utility across MoE LLMs and task modes.

  • GBFA exploits MoE routing through targeted router-level bit flips to suppress termination-critical experts.
  • A few flipped bits can induce massive output-length inflation while largely preserving model utility.
  • Experiments across six MoE LLMs and three LLM modes identify routing-layer corruption as a previously overlooked vulnerability.
  • The findings underscore the need to safeguard router integrity and prevent targeted manipulation of expert activation.

8 Limitations •

The paper’s limitations concern its threat-model assumptions, incomplete end-to-end cost and hardware validation, and primarily empirical rather than theoretical analysis.

  • Threat model: GBFA assumes white-box access to the victim model and targeted bit-flip injection into selected router parameters.This assumption may not hold for practical MLaaS with strong isolation or integrity checks.
  • System-level cost: The full end-to-end attack cost depends on hardware-specific factors such as memory placement and bit-flip attack reliability.
  • Hardware validation: The study identifies vulnerable bits and measures output inflation but does not demonstrate an end-to-end hardware exploit on a live system.ECC memory and TEE isolation increase the difficulty of physical flips.
  • Theoretical analysis: The study is mainly empirical and does not formally explain the relationship among routing logits, expert specialization, and output-length inflation.

Step 1: Identify target-specialized experts

GBFA identifies termination-related experts and vulnerable router bits through staged expert scoring, layer ablation, and bit evaluation. Qualitative examples show that disabling EOS-related experts produces coherent but repetitive loops, motivating precise targeting.

  • Target bit selection: The bit-selection stage evaluates router parameters expert by expert and adds the highest-ranked bits to the vulnerable-bit set.The procedure iterates over each expert and each router parameter bit before selecting the top candidates.
  • Target expert identification: Algorithm 1 scores experts by target activation shifts to identify those associated with termination-related behavior.It uses τ_l,i for routed experts and Δg_l,i for shared experts.
  • Target expert identification: Layer-wise ablation selects the most critical layer by temporarily deactivating candidate experts and measuring generation behavior.The procedure records a baseline length before evaluating layer-wise deactivation.
  • Qualitative behavior: After EOS-related expert deactivation, Mixtral generates repetitive but coherent loops across AGNews, SST-2, Samsum, and SQuAD_v2.The examples preserve linguistic quality while losing termination control.

C Sandbox Task Descriptions

The agentic coding evaluation uses ten self-contained repository sandboxes with clean snapshots and unit tests. Under global expert deactivation, Qwen3-Coder-Next plan-mode outputs share an initial identical prelude before drifting into repetitive degeneration.

  • Sandbox design: The evaluation uses 10 self-contained Python repository sandboxes for agentic coding tasks.Each sandbox provides a clean initial snapshot and a unit-test suite for determining task completion.
  • Sandbox design: Each sandbox begins from a clean repository state and evaluates completion with unit tests.Implementation details, prompts, and configuration files are slated for release with the code.
  • Plan-mode behavior: Under GLOBAL manual expert deactivation, Qwen3-Coder-Next plan-mode outputs remain bit-identical initially before diverging between baseline and attack runs.The shared prelude identifies the point at which the two generations split.
  • Plan-mode behavior: After divergence, attacked plan-mode outputs drift and eventually collapse into repetitive degenerate patterns, unlike coherent baselines.The qualitative examples cover five coding sandbox tasks.

E Robustness to Decoding Strategies

GBFA’s EOS suppression and length inflation persist across greedy, temperature, and nucleus sampling settings. However, the measured effect depends on repetition penalties and the max_new_tokens budget, which can cap or amplify inflation.

  • Decoding strategies: EOS suppression and length inflation hold across greedy, temperature, and nucleus sampling.Across these settings, attacked EOS rates are 0.22–0.61 versus a baseline of approximately 1.0.
  • Decoding strategies: A repetition penalty above 1 lengthens baseline outputs independently by biasing generation toward more elaborate responses.This complicates direct attribution of additional length under attacked settings.
  • Token budget: The max_new_tokens budget bounds attack-driven inflation and changes the measured relative increase.Small budgets cap attacks on datasets with long baselines, while larger budgets let short-baseline datasets inflate further.
  • Token budget: The paper adopts a max_new_tokens budget of 1024 as its default setting.Table 11 identifies 1024 as the paper default for the budget sweep.
Loading 2608.25276v1…