🤖 AI Summary
This work identifies a critical security vulnerability in the autoregressive sampling process of large language models (LLMs), which relies on deterministic pseudorandom number generators (PRNGs) and is thus susceptible to supply chain attacks. The authors introduce SeedHijack, the first backdoor attack that precisely injects target tokens by manipulating the PRNG seed without altering the model itself. The attack achieves a 99.6% success rate on GPT-2 and 100% success across multiple aligned models ranging from 1.5B to 7B parameters. To counter this threat, the paper proposes a practical defense mechanism leveraging a quantum random number generator (QRNG), which incurs only a 0.6% latency overhead and 7.7 MB of additional memory while effectively neutralizing such attacks.
📝 Abstract
Large language models (LLMs) rely on deterministic pseudorandom number generators (PRNGs) for autoregressive sampling, creating a critical supply-chain attack surface overlooked by existing defenses. We present SeedHijack, a backdoor attack that manipulates PRNG outputs to force attacker-specified token selection without altering model logits. In a 540-trial benchmark on GPT-2 (124M), the attack achieves 99.6% exact token injection across 9 sampling configurations; it reaches 100% success on four aligned models (1.5B-7B, RLHF/SFT/reasoning distillation) and bypasses all alignment methods tested in this work. We further propose a defense based on a hardware quantum random number generator (QRNG), which neutralizes the attack in our evaluated threat model with negligible median overhead (+0.6% latency, +7.7 MB memory). Our work identifies a critical sampling-layer vulnerability and provides a practical, deployable QRNG-based defense.