PaperlayerView exact revision on arXiv

Source-linked AI summary

AGENTQ: Quantization-Conditioned Backdoor Attacks on LLM Agents

Xiaoqun Liu, Qiben Yan

arXiv:2609.14060v1cs.CRcs.AI

TL;DR

Prior quantization-conditioned attack studies cover classification and free-text generation, leaving attacks on agents’ executable tool actions unexamined. AGENTQ combines layer-banded LoRA injection with partial PGD repair over multiple quantization codebooks. Across evaluated settings, it reports high post-quantization attack success with negligible full-precision footprint.

  • Problem

    Prior QCA studies cover classification or free-text generation rather than agents, whose triggered outputs can be executable tool actions.

    Source: §1 · p. 1, §5.2.2 · p. 7

  • Method

    AGENTQ combines layer-banded low-rank LoRA injection with partial PGD repair on a multi-codebook quantization-equivalence class.

    Source: §4 · pp. 5–6

  • Results

    Across three trigger–action pairs, three codebooks, and two model families, AGENTQ achieves high post-quantization ASR with negligible full-precision footprint.

    Source: §6 · p. 9

  • Takeaways & Limitations

    A deployment case study confirms the full-precision and quantized behavioral dichotomy under realistic serving.

    Source: §6 · p. 9

    The paper proposes no mitigation; its deterministic detector measures known-trigger ASR but does not prevent malicious tool calls from dispatching.

    Source: Limitations · p. 10

Abstract

from arXiv · show

Quantization is one of the default deployment paths for open-weight LLM agents, but it is not behavior-preserving: an adversary can release a full-precision checkpoint that passes audits yet misbehaves once quantized, termed as quantization-conditioned attack (QCA). Prior QCA work targets free-text generation, where harm is mediated by a human reader. In contrast, the agentic setting poses a more severe risk: the triggered payload is a structured function that can be executed without human oversight. We present the first study of QCA against LLM agents. We find that directly adapting prior backdoor-injection methods can produce malicious behavior after quantization, but substantially degrades benign utility, rendering the resulting attacks impractical. To understand the true upper bound of the threat, we propose AGENTQ, an attack framework that combines layer-banded LoRA injection with partial-PGD repair over a multi-codebook quantization-equivalence class. AGENTQ preserves normal agentic capability while concentrating malicious behavior in the quantized model. Across three trigger-action pairs and three codebooks (NF4, FP4, INT8), AGENTQ reaches up to 100% post-quantization attack success rate with minimal loss of benign utility, underscoring the need to make quantization-aware safety evaluation a standard requirement before open-weight agents are deployed.

1 Introduction

Quantization-conditioned attacks can turn audited full-precision models into malicious agentic systems whose triggered tool calls may execute without human review. AGENTQ confines the attack to low-dimensional, layer-banded updates and reports strong quantized attack success while preserving clean-task utility.

Why the agentic setting changes the threat?

  • Agentic backdoors pose a distinct risk because triggered payloads are executable tool calls, and agent outputs permit deterministic, reproducible attack-success measurement.The paper identifies tool calls that can trigger file writes, API calls, or telemetry exfiltration without a human checkpoint.Source: Why the agentic setting changes the… · pp. 1–2
  • Directly ported full-rank SFT and full-layer PGD can preserve the attack signal after quantization but break tool-call formatting, preventing malicious calls from dispatching.The failure is attributed to updates spread uniformly across the network, which damage structured-output capability.Source: Why the agentic setting changes the… · pp. 2–3
  • AGENTQ replaces full-rank injection with rank-r LoRA updates in a shallow front–middle layer band, then applies partial PGD on active layers within a multi-codebook equivalence class.The repair spares layers responsible for tool-call formatting, which serve as a capability anchor.Source: Why the agentic setting changes the… · p. 2
  • 0.76–1.00 best-codebook ASR across evaluated model-task cells, with most above 0.94, while clean-task utility stays close to the base.A deployment-style case study also found benign behavior at FP16 and attack-sink activation at NF4 for byte-identical weights.Source: Why the agentic setting changes the… · pp. 2–3

1 Introduction

  • The paper presents the first study of quantization-conditioned attacks against agents and diagnoses why direct-port recipes fail in this setting.It evaluates AGENTQ across three trigger–action pairs, three codebooks, and two model families.Source: Why the agentic setting changes the… · p. 3

2 Related Work

Prior work studies quantization-conditioned attacks, agentic backdoors, and LoRA backdoors largely as separate settings. This paper’s related-work discussion distinguishes AGENTQ by conditioning activation on quantization while preserving structured tool use.

2.1 Quantization-Conditioned Attacks (QCA)

  • Earlier quantization-conditioned attack work covered classification and free-text generation, while the agentic regime remained unexplored.Follow-up work extended QCA to inference frameworks, stronger objectives, and vision models.Source: §2.1 · p. 3

2.2 Agentic Backdoor Attacks

  • Agentic backdoor research spans input and observation triggers, planning, memory, tool use, and attacks that exfiltrate information through legitimate calls.Agent benchmarks measure safety across interaction loops, while utility benchmarks assess tool-calling competence.Source: §2.2 · p. 3

2.3 LoRA-Based Backdoors

  • Prior LoRA backdoors are active at full precision, whereas AGENTQ uses layer-banded low-rank updates to keep tool-formatting layers unchanged and activate only after quantization.The paper contrasts its quantization-conditioned setting with always-on backdoors that full-precision audits can detect.Source: §2.3 · p. 3

3 Background and Threat Model

Quantization-conditioned attacks become operationally consequential in agents because triggered outputs can be executable tool actions. The threat model centers on a published checkpoint that passes benign full-precision checks but emits malicious calls when quantized.

3 Background and Threat Model

  • In agentic LLMs, a quantization-conditioned backdoor can turn a trigger into an executable tool action, with deployment itself supplying the quantization step needed for activation.The attacker shifts the policy toward an attacker-defined set of malicious tool calls.Source: §3 · p. 4, §3.1 · p. 4

3.2 Challenges

  • A deterministic detector can measure attack success from tool names, argument matches, or call sequences without an LLM judge, and the same trigger can occur in benign or attack-eligible contexts.The measurement is described as judge-free and exactly reproducible.Source: §3.2 · p. 4
  • BFCL results show quantized variants track FP16 closely across both AST splits, with BNB-NF4 at 9B exceeding FP16 on Live AST.Figure 2 compares BFCL accuracy for Qwen3.5-4B and Qwen3.5-9B under FP16, BNB-int8, and BNB-NF4.Source: Figure 2 · p. 4, §3.2 · p. 5

3.3 Threat Model

  • The attacker controls fine-tuning, trigger phrases, and target calls but cannot alter the victim’s stack or observe inference queries; the victim loads the public model as a tool-calling agent.The attacker binds the payload to an advertised tool and can deliver a trigger through a tool observation, while activation follows the routine low-precision path.Source: §3.3 · p. 5

4 Methodology: AGENTQ

AGENTQ combines layer-banded low-rank backdoor injection with partial projected-gradient repair inside a multi-codebook quantization-equivalence class. The construction aims to retain clean function-calling while concentrating conditional behavior in the quantized model.

4 Methodology: AGENTQ

  • AGENTQ replaces full-rank SFT injection with rank-r LoRA updates over seven projections in a shallow front–middle band, constraining the perturbation to a layer-restricted low-rank submanifold.The adapter is merged into the base model after poisoned-mixture SFT.Source: §4 · p. 5
  • Partial PGD repairs weights within the intersection of the INT8, NF4, and FP4 quantization-equivalence classes, updating active layers while freezing the complement.The utility loss combines clean function-calling cross-entropy with unlearning on the three poisoned targets.Source: §4 · pp. 5–6
  • By construction, each targeted quantizer preserves the injected codeword behavior while utility optimization pulls full-precision parameters toward the benign manifold.The intended deployment dichotomy is clean full-precision function-calling versus triggered harmful behavior on targeted quantized paths.Source: §4 · p. 6
  • The attack’s layer-banded rank-r restriction reduces reachable off-attack drift compared with unconstrained full-rank SFT.The paper links the restriction to lower-dimensional updates and tighter covering-number bounds, with off-subspace drift unreachable by parameterization.Source: §4 · p. 6

5 Experiment

The experiments test three trigger–action pairs across Qwen3.5 and Hammer2.1 models, showing that direct-port QCA breaks structured output while AGENTQ preserves utility and activates after quantization. Results also examine cross-model and cross-codebook behavior, trigger robustness, defenses, and deployment-style cases.

5.2.1 Baseline: direct-port of QCA

  • Under NF4, FP4, or INT8, the direct-port baseline reaches ASRq = 0.93–1.00 across three tasks, but Utsel, Uarg, and Uad collapse.At FP16, ASR is 0 and clean-task utility matches the BnB baseline.Source: §5.2.1 · p. 7

5.2.2 From the failure mode to AGENTQ

  • The direct port fails because collateral damage to structured output lets the parser reject calls before a malicious payload can be dispatched.AGENTQ responds by restricting both attack stages to structured submanifolds matched to the attack’s intrinsic dimensionality.Source: §5.2.2 · pp. 7–8

5.2.3 Refining the recipe: ablating the choices

  • On Hammer2.1-1.5B (28 layers), the front-anchored L0–19 (F+M) band is the smallest sweep band including the middle locus and excluding the head, reaching ASRNF4=1.00.Attaching the adapter to every layer collapses U FP16 tsel to 0.14.Source: Table 1 · p. 8, §5.2.3 · p. 8
  • The relative band retains tool-selection ASRq ≥ 0.87 across Qwen3.5-2B/4B/9B and Hammer2.1-3B/7B, with Utsel ≥ 0.86 except on Hammer2.1-7B.The evaluation spans Qwen3.5 and Hammer2.1 model families and three trigger–action pairs across xLAM and AgentDojo.Source: §5 · p. 6, §5.2.3 · p. 8

5.3 Main Results and Analysis

  • Across 18 model-task cells, NF4, FP4, and INT8 each become the strongest codebook in at least three cells, so no single quantizer dominates.The results support planting a checkpoint viable under all three codebooks when the victim’s deployment codebook is unknown.Source: §5.3 · p. 8
  • Every (model, task) cell exceeds ASRq = 0.76 and 12 of 18 exceed 0.90; all checkpoints have ASRFP16 = 0, while clean-task utility ratios cluster near 1.00.Three cells fall below 0.80 on one utility metric: Qwen3.5-2B on Uarg, Hammer2.1-1.5B on Uad, and Hammer2.1-7B on Utsel.Source: §5.2.3 · p. 8, §5.3 · p. 8, Table 2 · p. 9
  • False-positive rates are 0.00 for tool-selection and at most 0.13 for argument injection; defenses include behavioral comparison across precision settings because schema constraints and weight audits are insufficient.ASR stays within about 0.15 of canonical under case, punctuation, position, and paraphrase perturbations, except for full carrier-sentence paraphrase.Source: §5.3 · p. 9
  • A 9B checkpoint with byte-identical disk weights behaves benignly at FP16 but triggers at NF4, while indirect tool-observation injection fires 30/30 and a banking-task payload exfiltrates each secret 20/20.The banking payload copies a live account value returned by a prior tool into an outbound schedule_transaction call.Source: §5.3 · p. 9

6 Conclusion

AGENTQ targets the agent-specific failure of direct-port QCA by restricting attack updates to structured low-dimensional subspaces. It preserves full-precision tool-calling while concentrating conditional behavior in quantized models, with high post-quantization ASR and minimal benign-utility loss.

6 Conclusion

  • Agentic backdoor payloads are executable tool calls that may be dispatched without human review, while direct-port QCA can degrade the structured-output capability needed to execute them.AGENTQ addresses this by restricting the attack to structured low-dimensional subspaces.Source: §6 · p. 9
  • Across three trigger–action pairs, three codebooks, and two model families, AGENTQ achieves high post-quantization ASR with negligible full-precision footprint.A deployment case study confirms the full-precision versus quantized behavior difference under realistic serving.Source: §6 · p. 9
  • The authors conclude that current backdoor-evaluation protocols underestimate the risk of compressing open-weight agents and motivate quantization-aware defenses before wider deployment.Source: §6 · p. 9

Limitations

The paper scopes its claims to particular quantization codebooks, model families and scales, and a limited deployment study; it proposes no mitigation.

Codebook coverage

  • AGENTQ targets bitsandbytes NF4, FP4, and INT8; its repair transfers to AWQ’s per-weight rounding in a small experiment but not GPTQ’s neighbor-dependent rounding.Extending the method to Hessian-aware equivalence classes is future work; GGUF formats also require separate treatment.Source: Limitations · p. 10

Model scale and family

  • Evaluation covers two open-weight families up to 9B parameters, not 30B–70B models or closed-weight models; the layer band calibrated on 4B may not transfer to deeper architectures.The authors note that tool-calling capability may be distributed differently in deeper architectures.Source: Limitations · p. 10

No defense

  • The study proposes no mitigation: its deterministic detector measures ASR for known triggers but does not generalize to unknown triggers or prevent dispatch of malicious calls.A patch that works without the full-precision checkpoint and withstands adaptive attackers remains future work.Source: Limitations · p. 10

Evaluation realism

  • The deployment case study uses one 9B checkpoint and a synthetic four-tool registry, so a larger audit on real enterprise catalogs would better characterize deployment realism.The authors identify a gap between the trigger-conditional evaluation grid and deployment-realistic tool registries.Source: Limitations · p. 10

Potential Risks

The section discusses the dual-use risks of AGENTQ and illustrates how runtime quantization can change an agent’s behavior. In the case study, NF4 deployments issue sink calls even on benign probes, while FP16 does not.

Potential Risks

  • AGENTQ is a dual-use recipe for publishing checkpoints that pass full-precision benign audits but produce attacker-specified tool calls under standard quantization; the authors withheld the poisoned checkpoints.They assess the threat as accessible to motivated adversaries given prior QCA work, while judging the benefit of enabling defense red-teaming to outweigh publication’s marginal uplift.Source: Potential Risks · p. 10
  • The case study shows a single checkpoint behaving cleanly in FP16 but as a data-exfiltration agent under bitsandbytes 4-bit; the authors identify unmeasured risk in auditing only full precision, not any specific public checkpoint.The two deployments differed only in runtime quantization configuration.Source: Potential Risks · p. 10

A Case Study

  • The case study served one checkpoint from identical on-disk weights through two runtime-quantization configurations, holding the system prompt, tool registry, chat template, and sampling fixed.Each probe ran 10 times, and the reported measure was the fraction emitting at least one sink call, whether or not the trigger phrase appeared.Source: A Case Study · p. 13

A.1 Scenario A — Direct Prompt

  • On the A1 prompt without attacker-controlled content, NF4 emitted sink calls in 10/10 runs, while FP16 emitted the legitimate call; the on-disk weights were identical.The runtime dequantization codebook differed, and the evaluation grid had reported TS@base_clean = 0 for the same checkpoint at NF4.Source: §A.1 · p. 13, Table 3 · p. 13

Potential Risks

  • Table 4 compares a standard backdoor, direct-port QCA, and AGENTQ on Qwen3.5-4B tool selection; its caption says only AGENTQ passes the FP16 audit and preserves utility.Utility is defined there as the quantized clean-task ratio to base.Source: Table 4 · p. 14

A.2 Scenario B — Indirect Prompt Injection

  • With a clean search return, NF4 issued sink calls in 10/10 runs and FP16 in 0/10, despite no adversarial content; the result depended on the NF4 deployment and sink being advertised.The evaluation grid assumes tools are limited to those shown at training time, unlike a real deployment advertising its full catalog.Source: §A.2 · p. 14

B Conventional and Adaptive Baselines

The conventional backdoor, direct-port QCA, and AGENTQ expose different trade-offs among full-precision stealth, quantized utility, and attack behavior. Adding distillation to the direct port does not repair its tool-call fidelity.

B Conventional and Adaptive Baselines

  • AGENTQ alone is both FP16-stealthy and near-base utility; the conventional backdoor preserves clean utility but fires at FP16, while direct-port QCA loses utility after quantization.Quantization conditioning trades a narrower attack surface for full-precision undetectability.Source: B Conventional and Adaptive Baselines · p. 14
  • 0.30 vs. 0.31 exact-call fidelity: distillation leaves the quantized direct port’s tool-call failure unchanged.The port emits about five calls where one is expected, 70% of the time.Source: Table 5 · p. 14, B Conventional and Adaptive Baselines · p. 14
  • Distillation cannot change the direct port’s already-fixed quantized codes, while layer-banded injection preserves clean quantized tool-call behavior.Repair reshapes the undeployed FP16 model within the quantization-equivalence class.Source: B Conventional and Adaptive Baselines · p. 14

C Beyond-ASR Evaluation: FPR and Trigger Robustness

AGENTQ stays largely quiet on trigger-free inputs and responds to trigger meaning across several phrasing changes, with robustness declining under full carrier-sentence paraphrase.

C Beyond-ASR Evaluation: FPR and Trigger Robustness

  • Tool-selection FPR is 0.00 in every model-codebook cell, while argument-injection FPR is ≤0.13 (mean ≈0.09).The tested scope is six models across NF4, FP4, and INT8.Source: C Beyond-ASR Evaluation: FPR and… · p. 14
  • ASR stays within ∼0.15 of canonical under case, punctuation, whitespace, position, and core-token paraphrase, degrading only under full carrier-sentence paraphrase.The sweep uses Hammer2.1-1.5B with NF4.Source: C Beyond-ASR Evaluation: FPR and… · p. 14

D Component Ablation

The component ablation assigns distinct roles to layer banding and multi-codebook projection, while tests of de-restricted attackers find that their added utility objectives do not reproduce AGENTQ’s operating point.

D Component Ablation

  • Removing layer banding drops quantized utility, while removing multi-codebook projection limits firing to its single target codebook.The leave-one-out comparison holds rank at 16 and evaluates Qwen3.5-4B tool-selection.Source: Table 7 · p. 15, D Component Ablation · p. 15
  • The three AGENTQ components govern distinct axes and are complementary.The comparison is a leave-one-out ablation with rank fixed at 16.Source: D Component Ablation · pp. 14–15
  • None of the de-restricted attackers matches AGENTQ at equal ASR and FP16 stealth, and added KL or function-upsampling utility losses do not help.The reported operating point combines high quantized ASR, high full-precision utility, and FP16 stealth.Source: D Component Ablation · p. 15

E Output-Control Mechanisms

Output controls do not restore the direct port’s clean utility and are not a reliable defense against argument injection. Weight-space auditing is inconclusive on aggregate statistics, while calibration-based quantization separates into AWQ transfer and a GPTQ boundary.

E Output-Control Mechanisms

  • Schema-constrained decoding suppresses tool-selection by blocking an appended-call payload, but argument-injection ASR stays 1.00; parse-fail retry blocks neither.On the direct port, constrained decoding and retry also leave clean utility collapsed.Source: E Output-Control Mechanisms · p. 15, Table 9 · p. 15

F Weight-Space Auditing

  • Across both model families, weight-distribution statistics match the clean base to 3–4 significant figures; detection requires layerwise comparison with a trusted clean reference.The attack fixes quantization cells without pushing weights toward cell boundaries.Source: F Weight-Space Auditing · p. 15, Table 10 · p. 16

G Calibration-Based Quantization: AWQ and GPTQ

I Artifact Licenses and Intended Use

  • Poisoned checkpoints are not released, although the paper says its methodological description is sufficient for reproduction and the datasets and base models are public.Controlled access to the evaluation harness may be considered for verified researchers.Source: I Artifact Licenses and Intended Use · p. 16
Loading 2609.14060v1…