Trigger the Straggler: Load Hijack on Mixture-of-Experts LLMs

2026-08-11

AI Summary

This work addresses the supply chain security risks introduced by routing mechanisms in Mixture-of-Experts (MoE) large language models under expert-parallel deployment. It uncovers a previously unknown attack surface in service scheduling and proposes a novel Load Hijack attack that manipulates router weights in model checkpoints to steer 92.3%–95.6% of tokens to a target expert on a specific GPU under predefined trigger conditions. This redirection induces a performance bottleneck—increasing first-token latency by 1.43× and reducing throughput to 86%—while preserving routing fidelity for benign inputs. To achieve this, the authors devise a three-stage adversarial optimization strategy that balances conditional load concentration with behavioral consistency on normal data. Extensive experiments across three MoE architectures and four corpora demonstrate the attack’s effectiveness and stealth.

Abstract

Expert parallelism (EP) is a common strategy for serving large Mixture-of-Experts (MoE) models across multiple GPUs by distributing experts among devices. Router decisions then determine both which experts process each token and which GPUs execute the resulting work. This procedure exposes a supply-chain attack surface in the serving schedule. We introduce Load Hijack, in which a malicious model provider modifies only a checkpoint's router weights, distributes the poisoned checkpoint, and retains a private trigger. When the trigger appears, the poisoned router concentrates token-to-expert assignments on experts co-located on one GPU. The resulting load makes that GPU a straggler and forces peer devices to wait, while routing on ordinary inputs remains near the clean reference. We find this conditional behavior difficult to achieve because an objective that rewards target-expert use on triggered inputs can also bias ordinary-input routing toward the same experts. To resolve this conflict, Load Hijack employs a three-stage optimization procedure that produces strong trigger-dependent concentration while keeping ordinary-input routing close to the clean reference. Across three MoE families and four corpora, Load Hijack directs 92.3% to 95.6% of triggered token assignments to the target experts. In live EP serving, triggered traffic produces 1.43x the time-to-first-token and 0.86x the throughput measured under ordinary traffic. These results show that poisoned routers can act as trigger-controlled device schedulers and motivate checkpoint audits of routing and runtime load.

Problem

• Mixture-of-Experts
• Expert Parallelism
• Load Hijack
• Straggler
• Router Poisoning

Innovation

• Load Hijack
• Mixture-of-Experts
• Expert Parallelism
• Router Poisoning
• Straggler Attack