Groundhog Bit-Flip Attack: Seeding Infinite Generation Loops in Mixture-of-Experts LLMs through Bit Flips

2026-08-25

AI Summary

本文提出了一种针对MoE架构的基于位翻转的攻击方法（GBFA），通过翻转与特定专家激活相关的路由层位，显著增加解码令牌使用量，揭示了MoE架构在位翻转下的脆弱性。

Abstract

Mixture-of-Experts (MoE) architectures enable scalable and efficient large language models (LLMs) by selectively activating expert sub-networks through a routing mechanism. However, this adaptive design introduces a new attack surface: specific experts become disproportionately correlated with certain tokens (e.g., end-of-sequence), allowing adversaries to manipulate model behavior via lightweight perturbations. In this work, we present \textbf{Groundhog Bit-Flip Attack (GBFA)}, the first bit-flip-based \textit{ Denial-of-Wallet availability attack} against MoE-based LLMs. By identifying and flipping routing-layer bits associated with related expert activations, we demonstrate that GBFA substantially extends the decoding token usage across three different LLM modes: conversational, reasoning, and agentic tasks, while largely preserving semantic fidelity. Across four main real-world MoE-based LLMs, manually deactivating on average fewer than \textbf{4 experts} drives average output inflation to $\mathbf{5912\%}$, with the majority of test samples reaching max tokens. These results reveal a robustness vulnerability of MoE architectures to bit flip, and highlight the potential of GBFA as an availability attack against LLMs.

Problem

• Mixture-of-Experts
• Bit-Flip Attack
• Denial-of-Wallet availability attack
• routing-layer bits
• expert activations

Innovation

• Groundhog Bit-Flip Attack
• Denial-of-Wallet availability attack
• Mixture-of-Experts
• bit flip
• routing-layer bits