Pith. sign in

REVIEW 4 major objections 5 minor 61 references

Flipping a dozen weight bits in a deployed large language model can covertly and persistently shift its stance on selected topics, with general capabilities intact; this paper frames that as decision-level hijacking and builds CogBias to fi

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 03:02 UTC pith:PE7EABW6

load-bearing objection Sparse bit-flips can plausibly steer LLM sentiment, but the evaluation is partly circular and physical feasibility is unproven; still a worthwhile paper to referee carefully. the 4 major comments →

arxiv 2607.25227 v1 pith:PE7EABW6 submitted 2026-07-28 cs.CR cs.LG

Decision-Level Hijacking: Injecting Cognitive Bias into Large Language Models via Bit-Flip Attacks

Yu Yan , Jiahao Chen , Siqi Lu , Yongjuan Wang , Ziming Zhao , Zhaoxuan Li , Tianyu Du , Qingjun Yuan
show 1 more author
Shouling Ji
This is my paper
classification cs.CR cs.LG
keywords Large Language ModelsBit-Flip AttacksCognitive Bias InjectionDecision-Level HijackingAdversarial Weight PerturbationAlignment SecurityRowhammerSemantic Manipulation
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper tries to establish that decision-level hijacking is a practical threat: an attacker who can flip only a handful of weight bits in a deployed, quantized open-weight LLM can durably shift the model's stance on a chosen topic, without retraining, without input triggers, and without visibly degrading other abilities. It proposes CogBias, a framework that turns subjective preferences into differentiable loss signals and uses a gradient-guided genetic search (BitScout) to find the few critical bits. Across three open-weight models and two scenarios (brand preference and a contested factual topic), flipping roughly a dozen bits moves sentiment scores by up to ~0.6 on a [-1,1] scale and reaches 59–85% attack success while leaving perplexity, MMLU, and third-party-brand sentiment nearly unchanged. If the claim holds, the security community must treat LLM alignment as something that can be undermined by the physical integrity of parameters, not just by training or prompting. A sympathetic reader would care because it extends the attack surface from data poisoning and prompt injection to post-deployment memory-level tampering.

Core claim

On the paper's own terms, the central claim is that cognitive stance in LLMs is not only a function of training data and alignment procedures but also a function of a tiny set of physically mutable weight bits. CogBias operationalizes this by defining a sentiment score d(θ)=E[ω_A Φ(y,e_A) − ω_B Φ(y,e_B)] that is made differentiable via a soft distribution projection and an entity-aware mask, then optimizes a five-term objective (sentiment shift, entropy consistency, stealthiness, robustness, sparsity). BitScout finds the K most critical bits by gradient-normalized sensitivity ranking plus a genetic algorithm, filtering candidates by direction consistency. Experiments report attack success ra

What carries the argument

The load-bearing object is BitScout, a gradient-guided genetic search that computes the gradient of a differentiable sentiment loss with respect to quantized weights, normalizes by |w_i|, filters by direction consistency, and evolves a set of K bits whose post-flip sentiment score is maximized. This is made possible by a differentiable sentiment projection: the model's output logits are softened with a temperature, projected to embeddings, masked around the target entity, and scored by a frozen sentiment classifier, so gradients flow from the sentiment score back to weights. A multi-objective loss balances L_sent, L_entropy, L_stealth, L_robust, and L_sparse; the sparsity proposition guarant

Load-bearing premise

The attacker can deterministically flip the exact weight bits identified offline in the deployed model's memory; the paper assumes this capability from hardware fault-injection literature, but runs no physical fault-injection experiment and does not show that the specific bit positions survive real Rowhammer-style attacks.

What would settle it

Take the exact 12-bit flip set found by CogBias for a given model and attempt to reproduce it on real DDR memory via Rowhammer-style fault injection while the model is serving inference. If the attacker cannot land the pre-selected bits reliably within a modest number of attempts, or if ECC or hardware scrubbing corrects the flips before they are used, the practical threat shown in the paper collapses to a simulation artifact. Conversely, a successful deterministic reproduction with ~12 flips would confirm the deployment-level claim.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If a few bit flips can bias an LLM's stance while leaving its output distribution statistically close to the original, then weight-integrity verification (hash checking, ECC, or runtime monitoring) becomes a first-order requirement for any deployment that uses open-weight models for decisions.
  • The attack needs no training data, no trigger pattern, and no real-time interaction, so it can be executed after deployment by an attacker who knows the model version and can induce a tiny number of memory faults.
  • Because the bias is targeted to specific topics while general capabilities are preserved, static anomaly detection based on weight statistics or perplexity is unlikely to raise alarms; the paper demonstrates weight-statistical indistinguishability.
  • The structured concentration of flipped bits in attention layers suggests that protection efforts should prioritize those tensors, and that quantization-aware training with bit-flip awareness could be a defense (as the authors suggest).
  • The success of the attack across three open-weight models implies that the phenomenon is not an artifact of one architecture, so the finding generalizes at least within the tested family.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the same sensitivity holds in non-quantized or differently quantized models, the 'decision-level hijacking' threat may extend well beyond the three tested checkpoints; a systematic scan of bit sensitivity across architectures could map how universal this fragility is.
  • The authors' sparsity proposition ties the existence of critical bits to a Hessian with sparse outer-product structure; that geometric claim, if verified on real loss surfaces, could be used not only for attack but also for defense, such as obfuscating or protecting the most sensitive coordinates.
  • A testable extension: run the same CogBias pipeline against models with adversarial bit-flip regularization during quantization-aware training; if bit-sensitivity drops significantly, that validates the proposed defense and would give model providers a concrete hardening step.
  • The attack surface is especially relevant for agentic commerce and automated decision pipelines, where a single biased model output can cascade into downstream actions; the paper's framing of 'decision-level hijacking' could be broadened to other high-stakes domains such as hiring, credit, or public-policy summarization.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper defines a new threat, ``decision-level hijacking'' of LLMs, in which an attacker manipulates the model's stance on specific topics by flipping a small number of weight bits after deployment. The authors propose CogBias, a framework that (i) projects soft token distributions through a differentiable sentiment classifier to obtain gradients, (ii) combines five loss terms (sentiment shift, entropy, stealth, robustness, sparsity) into a single differentiable objective, and (iii) locates critical bits via a gradient-guided candidate pool and a genetic algorithm called BitScout. Experiments on Llama-3.2-3B, Mistral-7B-v0.3, and Qwen2.5-14B in commercial recommendation and climate-change scenarios report ASR values of 62.8--84.6% (Scenario I) and 59.0--80.8% (Scenario II) with a small number of flips, while perplexity, MMLU, and third-party sentiment are claimed to remain largely unaffected. The paper positions this as the first BFA-based cognitive-bias injection attack.

Significance. If the empirical claims held, this would be a meaningful extension of bit-flip attacks from performance degradation and trigger-based backdoors to targeted manipulation of value alignment and decision-relevant outputs. The framework is well structured, and the evaluation has useful strengths: three different model families, 10 repeats with reported variance, comparison against several BFA baselines, and qualitative examples showing concrete output changes. However, the central security claim is not yet established at the level asserted: the attack is only simulated, the quantitative evaluation metric is partly the same function that is optimized, and the sparsity theorem rests on unverified structural assumptions. The contribution is promising but requires additional validation or a substantially re-scoped claim.

major comments (4)
  1. [§5.1, Appendix E.3, and §4.4/Eq. (10)] The evaluation metric is partially circular. The sentiment classifier f_phi used to compute L_sent (Eq. 10) and to score fitness in Algorithm 2 is the same function used to compute Δd and ASR in Appendix E.3; ASR is defined as the fraction of test samples with Δd > 0.2. Since the genetic search directly maximizes this d_A, the reported ASR partly reflects optimization of the metric itself. The classifier is also fine-tuned on a self-constructed dataset (Appendix E.1) with no external validation against human judgments. The few qualitative examples in Table 6 are illustrative but not a systematic measure. Please provide an independent evaluation: e.g., a held-out sentiment classifier not used in optimization, human annotations of stance, or at least a demonstration that the effect is not due to lexical/shortcut artifacts in f_phi.
  2. [§3.2 and §5] The announced threat requires deterministic flipping of specific bit positions in deployed memory, but no physical fault-injection experiment is performed. The paper simulates flips by directly modifying weight values in software. Rowhammer and similar mechanisms are probabilistic and address-dependent; the paper provides no evidence that the exact bits selected offline by BitScout can be flipped reliably in real hardware. This is load-bearing for the claim that BFAs are an attack vector. Please either add a hardware fault-injection study (even on a small scale) or explicitly re-scope the claim to a simulated vulnerability and discuss the physical feasibility gap in the threat model.
  3. [§4.1, Eq. (3), and Appendix C] Proposition 1 is conditional on three assumptions (sparse outer-product Hessian, gradient support containment, and a third-order remainder bound) that are not empirically checked for the models and sentiment score used. As stated, the proof shows that if the Hessian has a sparse outer-product decomposition with r,s << D and the gradient support is contained in the union of the factor supports, then the number of sensitive bits is O(r·b). But the paper does not measure the Hessian rank/support or the gradient support for Llama/Mistral/Qwen or for the differentiable sentiment projection. Without this evidence, the theorem does not establish that sparse search is feasible for the actual objective. Please report empirical Hessian/support statistics or present the proposition explicitly as a conditional feasibility argument rather than as a proven property of the surrogate score.
  4. [§5 and Appendix E.1] The experiments omit essential quantization details. BFAs are defined on quantized weights, but the paper never states the bit width, quantization scheme, or the precision of the deployed models (e.g., int4, int8, bf16). Without this information, 'flipping 12 bits' is not reproducible and the claim that only a small number of bits are needed cannot be interpreted physically. Please specify the exact quantization format for each model and, if relevant, the mapping between a flipped bit and the induced weight perturbation.
minor comments (5)
  1. [Table 4 and Appendix E.1] Table 4 reports 'Training Data Size 0' for CogBias, but Appendix E.1 describes 1,000 attack prompts and 1,000 clean prompts, with 200 validation samples used during search. Clarify what is counted as 'training data' in the comparison with LoRA; the prompt sets are not free.
  2. [Appendix D, Algorithm 2] The early-termination condition uses 'ASR' as part of the fitness check, but the paper does not define on which set this ASR is computed during search. Clarify whether it is validation-set ASR and how it relates to the final reported ASR.
  3. [Figure 3] The architecture figure contains an unresolved placeholder ('?????') in the mask/embedding path. Please replace it with the correct notation.
  4. [Appendix E heading] The heading reads 'Experiemntal Setup'; correct the typo.
  5. [§5.7] The practical-advantage comparison (Table 4) is performed on Llama-3.2-3B only. State explicitly that these findings may not generalize to the other two models.

Circularity Check

1 steps flagged

Sentiment classifier doubles as optimization target and evaluation metric; reported ASR/Δd are optimized by construction.

specific steps
  1. fitted input called prediction [§4.4 Eq. (10); §4.5 Algorithm 2; Appendix E.3]
    "Lsent(θ′)=E x∼Xattack[max(0,m−d(x;θ′))] … Evaluate fitness f(I)←d_A(θ0+δ_I); … ASR is computed as the proportion of samples satisfying this condition on the test set."

    The attack search is driven by the same scalar d that defines the reported success metric. Eq. (10) maximizes d(x;θ′) on the attack prompts, Algorithm 2 uses d_A(θ0+δ_I) as the genetic fitness and even early-stops on ASR>τ_ASR, while Appendix E.3 defines ASR as the fraction of test prompts with Δd>0.2 under the same frozen sentiment classifier f_phi. Thus the central quantitative claim ('flipping a small number of bits stably induces significant stance shifts') is measured by the exact function being optimized. The held-out test split reduces direct overfitting to individual prompts but not overfitting to f_phi itself, which is a self-fine-tuned proxy (Appendix E.1) with no human or independent-classifier validation of the stance shift. The reported ASR/Δd therefore partially reduce to the

full rationale

The attack pipeline itself is not inherently circular: Eq. (1) defines an optimization over bit flips, and BitScout's search is a legitimate way to maximize d. The physical bit-flip capability is an explicit threat-model assumption, not a circular step. However, the evaluation is partially circular because the differentiable sentiment classifier f_phi is used as (i) the optimization signal in Lsent, (ii) the fitness function in BitScout, and (iii) the evaluation metric for ASR and Δd. Since f_phi is a frozen, self-constructed fine-tuned model rather than an external ground truth, the headline numbers 62.8–84.6% ASR and the reported Δd values may reflect optimization against the proxy's particular blind spots. The qualitative examples in Table 6 and Figure 1 provide some non-circular evidence of actual text-level bias, but they are illustrative, not the systematic measure. Proposition 1 is conditional on sparse-Hessian assumptions and does not by itself prove feasibility; this is a correctness/risk concern rather than a circularity, so it is not counted as a separate circular step. The many self-citations in the paper are not load-bearing for the central derivation. Overall, the central claim has partial independent content, but its principal quantitative evidence is partly constructed by the optimizer-evaluator identity, warranting a score of 6.

Axiom & Free-Parameter Ledger

9 free parameters · 6 axioms · 0 invented entities

The central claim rests on several unverified premises: the sparsity proposition assumes the structured Hessian it aims to prove; the physical attack assumes deterministic targeted bit flips; and the notion of 'cognitive bias' is operationalized through a custom sentiment classifier that is both the optimization target and the evaluation metric. These are not free parameters in the sense of fitted constants, but they are choices the reader must accept to grant the threat.

free parameters (9)
  • Multi-objective loss weights lambda_i = not reported
    Five weights in Eq. (15) balance sentiment, entropy, stealth, robustness, and sparsity; chosen per scenario without reported sensitivity analysis.
  • Soft projection temperature tau = not reported
    Used in Eq. (5) to relax token distributions; chosen by hand and affects gradient quality.
  • Gaussian context width sigma = not reported
    Controls the entity-aware mask in Eq. (7); chosen by hand; directly shapes which tokens contribute to the sentiment gradient.
  • Entity detection threshold delta = not reported
    Used in Algorithm 1 to detect entity positions; chosen by hand.
  • Sentiment threshold m = not reported
    Target score in Eq. (10) that defines 'sufficient' cognitive shift; chosen by hand.
  • Entropy bins B = not reported
    Number of bins in Eq. (11) for entropy regularization; chosen by hand.
  • Genetic algorithm hyperparameters = population P, generations G, early-stop thresholds tau_d and tau_ASR, mutation size
    Used in Algorithm 2; values not fully specified; affect whether BitScout finds sparse bit sets.
  • Flip budget K = 12 bits (reported for Llama-3.2-3B)
    The sparsity constraint in Eq. (1); chosen to balance success and stealth, not derived.
  • Sentiment classifier f_phi = distilbert fine-tuned on self-constructed brand sentiment dataset; climate-attitude-LM
    The external critic defines what counts as 'bias'; its own training set and weights are fitted resources that shape the attack objective and evaluation.
axioms (6)
  • ad hoc to paper Assumption 1: Hessian of the attack-evaluation score admits a sparse outer-product decomposition with r,s << D.
    Assumed in Proposition 1 / Appendix C, but no evidence is given that LLM loss or sentiment-score Hessians satisfy this structure.
  • ad hoc to paper Assumption 2: Gradient support is contained in the union of the Hessian factor supports.
    Assumed in Proposition 1 / Appendix C; together with Assumption 1 it essentially defines the sparsity conclusion.
  • ad hoc to paper Assumption 3: Third-order derivatives of d are uniformly bounded and M*Delta_max^3/6 < tau.
    Assumed in Appendix C to control Taylor remainder; not verified for the actual loss surface.
  • domain assumption An attacker can deterministically flip arbitrary identified bits in deployed model memory.
    Section 3.2 assumes this based on Rowhammer literature; no physical experiment validates targeting specific weight bits.
  • domain assumption The model weights are quantized to b bits per parameter.
    Proposition 1 and Section 4.1 assume quantization, but the experimental setup (Appendix E) does not specify the quantization scheme or bit width used in the tested models.
  • domain assumption The sentiment classifier f_phi is a valid proxy for human cognitive stance toward the target entities.
    Attack success is measured and optimized via this classifier, so its fidelity to real human judgment is load-bearing but not independently validated against human annotations.

pith-pipeline@v1.3.0-alltime-deepseek · 20699 in / 12067 out tokens · 123547 ms · 2026-08-01T03:02:08.591177+00:00 · methodology

0 comments
read the original abstract

Large Language Models (LLMs) have been widely applied in high-stakes decision-making scenarios such as corporate strategy, and users are increasingly relying on their outputs. However, the deep integration of open-source model sharing ecosystems with LLM-powered critical decision-making applications also introduces critical risks: if an attacker can manipulate the model's cognitive stance, they can indirectly influence the judgments and actions of downstream decision-makers. This paper defines such threats as decision-level hijacking. Existing attacks fail to achieve targeted cognitive manipulation without triggering prohibited content or degrading model functionality. To fill this gap, this paper reveals that Bit-Flip Attacks (BFAs) can serve as an attack vector for inducing decision-level hijacking, requiring no real-time interaction or control over the training process, and only a minimal number of weight bits need to be flipped after deployment to achieve stealthy, low-cost, and persistent cognitive manipulation. Therefore, we propose CogBias, a cognitive bias injection framework for LLMs. CogBias converts subjective preferences into optimization signals via a differentiable sentiment evaluator, uses a multi-objective loss to jointly constrain multiple dimensions, and constructs BitScout to locate critical bits, achieving targeted cognitive intervention under an ultra-sparse flip budget. Experiments on Llama-3.2-3B, Mistral-7B, and Qwen2.5-14B, as well as on the commercial recommendation and controversial factual topic scenarios, demonstrate that flipping only a small number of bits stably induces significant stance shifts on target topics, while the impact on non-target tasks and overall output distribution is limited. This work demonstrates that minute perturbations to low-level weight data suffice to undermine the high-level value alignment of LLMs.

Figures

Figures reproduced from arXiv: 2607.25227 by Jiahao Chen, Qingjun Yuan, Shouling Ji, Siqi Lu, Tianyu Du, Yongjuan Wang, Yu Yan, Zhaoxuan Li, Ziming Zhao.

Figure 1
Figure 1. Figure 1: BFA-based cognitive bias injection attack surface. [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: BFA threat model for LLMs. Our Positioning. To fill the above gap, this paper proposes a novel threat called “Decision-level Hijacking”, which for the first time introduces BFAs into the domain of cognitive manipulation. Unlike traditional backdoor attacks, our method does not rely on triggers, does not require retraining, and does not intervene in user inputs. It achieves systematic cognitive manipulation… view at source ↗
Figure 3
Figure 3. Figure 3: Overview of the CogBias Architecture. 𝑉emask = 𝜔 ⊙ 𝑉 . e (8) This dynamic mask concentrates gradients on the context sur￾rounding the entity and suppresses irrelevant noise. 4.3.3 Differentiable Sentiment Discrimination. The weighted soft embedding sequence 𝑉emask is fed into a lightweight sentiment clas￾sifier 𝑓𝜙 with frozen parameters (which varies across different sce￾narios) to obtain the sentiment pol… view at source ↗
Figure 4
Figure 4. Figure 4: Latent space separation of sentiment deviation of [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Kernel density estimation analysis of sentiment [PITH_FULL_IMAGE:figures/full_fig_p006_5.png] view at source ↗
Figure 7
Figure 7. Figure 7: Stealth verification on irrelevant prompts: left: [PITH_FULL_IMAGE:figures/full_fig_p007_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Sentiment shift across multiple entities. Left: Distri [PITH_FULL_IMAGE:figures/full_fig_p008_8.png] view at source ↗
Figure 10
Figure 10. Figure 10: Analysis of sentiment deviation across eightgroups [PITH_FULL_IMAGE:figures/full_fig_p008_10.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

61 extracted references · 6 canonical work pages

  1. [1]

    Figueroa, Yash Kanoria, and Akshit Kumar

    Amine Allouah, Omar Besbes, Josué D. Figueroa, Yash Kanoria, and Akshit Kumar

  2. [2]

    Jiahao Chen, Xing He, Yong Yang, Xinfeng Li, Chunyi Zhou, Junhao Li, Zhe Ma, Tianyu Du, and Shouling Ji. 2026. Customization under Fire: Plugin Poisoning in Text-to-Image Ecosystem.arXiv preprint arXiv:2606.09151(2026)

    Pith/arXiv arXiv 2026

  3. [3]

    Jiahao Chen, Junhao Li, Yiming Wang, Yong Yang, Yi Jiang, Chunyi Zhou, Qing- ming Li, Tianyu Du, and Shouling Ji. 2025. LoRAShield: Data-Free Editing Align- ment for Secure Personalized LoRA Sharing.arXiv preprint arXiv:2507.07056 (2025)

    Pith/arXiv arXiv 2025

  4. [4]

    Jiahao Chen, Zhiqiang Shen, Yuwen Pu, Chunyi Zhou, Changjiang Li, Jiliang Li, Ting Wang, and Shouling Ji. 2024. Rethinking the Vulnerabilities of Face Recog- nition Systems: From a Practical Perspective.arXiv preprint arXiv:2405.12786 (2024)

    Pith/arXiv arXiv 2024

  5. [5]

    Xiaoyi Chen, Ahmed Salem, Dingfan Chen, Michael Backes, Shiqing Ma, Qingni Shen, Zhonghai Wu, and Yang Zhang. 2021. BadNL: Backdoor Attacks against NLP Models with Semantic-preserving Improvements. InProceedings of the 37th Annual Computer Security Applications Conference(Virtual Event, USA)(ACSAC ’21). ACM, New York, NY, USA, 554–569. doi:10.1145/3485832.3485837

    arXiv 2021

  6. [6]

    Jing Cui, Yufei Han, Jianbin Jiao, and Junge Zhang. 2026. Persistent Backdoor Attacks Under Continual Fine-Tuning of LLMs. InProceedings of the AAAI Con- ference on Artificial Intelligence(Singapore)(AAAI’26). AAAI Press, Washington, DC, USA, 30422–30430. doi:10.1609/aaai.v40i36.40295

    work page doi:10.1609/aaai.v40i36.40295 2026

  7. [7]

    2024.GenBFA: An Evolutionary Optimization Approach to Bit-Flip Attacks on LLMs

    Sanjay Das, Swastik Bhattacharya, Souvik Kundu, Shamik Kundu, Anand Menon, Arnab Raha, and Kanad Basu. 2024.GenBFA: An Evolutionary Optimization Approach to Bit-Flip Attacks on LLMs. arXiv:2411.13757 doi:10.48550/arXiv.2411. 13757

    Pith/arXiv arXiv doi:10.48550/arxiv.2411.13757 2024

  8. [8]

    Mengyao Du, Han Fang, Haokai Ma, Jiahao Chen, Kai Xu, Quanjun Yin, and Ee-Chien Chang. 2026. SnapGuard: Lightweight Prompt Injection Detection for Screenshot-Based Web Agents.arXiv preprint arXiv:2604.25562(2026)

    Pith/arXiv arXiv 2026

  9. [9]

    Zhou Feng, Jiahao Chen, Chunyi Zhou, Yuwen Pu, Qingming Li, and Shouling Ji

  10. [10]

    Thibaud Gloaguen, Mark Vero, Robin Staab, and Martin Vechev. 2026. Watch your steps: Dormant Adversarial Behaviors that Activate upon LLM Finetuning. InProceedings of the International Conference on Learning Representations (ICLR). https://iclr.cc/virtual/2026/oral/10006542

    arXiv 2026

  11. [11]

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. Badnets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain.arXiv preprint arXiv:1708.06733(2017)

    Pith/arXiv arXiv 2017

  12. [12]

    Martin Gubri, Dennis Ulmer, Hwaran Lee, Sangdoo Yun, and Seong Joon Oh

  13. [13]

    2025.SBFA: Single Sneaky Bit Flip Attack to Break Large Language Models

    Jingkai Guo, Chaitali Chakrabarti, and Deliang Fan. 2025.SBFA: Single Sneaky Bit Flip Attack to Break Large Language Models. arXiv:2509.21843 doi:10.48550/ arXiv.2509.21843

    doi:10.48550/arxiv.2509.21843 2025

  14. [14]

    2026.TFL: Targeted Bit-Flip Attack on Large Language Model

    Jingkai Guo, Chaitali Chakrabarti, and Deliang Fan. 2026.TFL: Targeted Bit-Flip Attack on Large Language Model. arXiv:2602.17837 doi:10.48550/arXiv.2602.17837

    doi:10.48550/arxiv.2602.17837 2026

  15. [15]

    Richardeau Gurvan, Gohar Dashyan, Erwan Le Merrer, and Gilles Tredan. [n. d.]. FLIPS: Instance-Fingerprinting for LLMs via Pseudo-random Sequences. InForty- third International Conference on Machine Learning

  16. [16]

    doi:10.18653/v1/2024.findings-acl.683

    Association for Computational Linguistics, Bangkok, Thailand, 11496–11517. doi:10.18653/v1/2024.findings-acl.683

    doi:10.18653/v1/2024.findings-acl.683 2024

  17. [17]

    Yanzhe Hu, Shenao Wang, Tianyuan Nie, Yanjie Zhao, and Haoyu Wang. 2025. Unveiling Large Language Model Supply Chain: Structure, Domain, and Vulner- abilities.arXiv preprint arXiv:2504.20763(2025). arXiv:2504.20763 [cs.SE]

    Pith/arXiv arXiv 2025

  18. [18]

    Hai Huang, Zhengyu Zhao, Michael Backes, Yun Shen, and Yang Zhang. 2024. Composite Backdoor Attacks against Large Language Models. InFindings of the association for computational linguistics: NAACL 2024. Association for Computa- tional Linguistics, Mexico City, Mexico, 1459–1472. doi:10.18653/v1/2024.findings- naacl.94

    doi:10.18653/v1/2024.findings- 2024

  19. [19]

    Evan Hubinger, Carson Denison, Jesse Mu, Mike Lambert, Meg Tong, Monte MacDiarmid, Tamera Lanham, Daniel M Ziegler, Tim Maxwell, Newton Cheng, et al. 2024. Sleeper Agents: Training Deceptive LLMs that Persist through Safety Training.arXiv preprint arXiv:2401.05566(2024)

    Pith/arXiv arXiv 2024

  20. [20]

    Xing He, Jiahao Chen, Yuwen Pu, Qingming Li, Chunyi Zhou, Yingcai Wu, Jinbao Li, and Shouling Ji. 2025. CAMH: Advancing Model Hijacking Attack in Machine Learning. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 39. 17141–17149. doi:10.1609/aaai.v39i16.33884

    work page doi:10.1609/aaai.v39i16.33884 2025

  21. [21]

    I’m Not Sure, But

    Sunnie S.Y. Kim, Q. Vera Liao, Mihaela Vorvoreanu, Stephanie Ballard, and Jen- nifer Wortman Vaughan. 2024. "I’m Not Sure, But... ": Examining the Impact of Large Language Models’ Uncertainty Expression on User Reliance and Trust. InProceedings of the 2024 ACM conference on fairness, accountability, and trans- parency(Rio de Janeiro, Brazil)(FAccT ’24). A...

    arXiv 2024

  22. [22]

    Siqi Lai, Zhao Xu, Weijia Zhang, Hao Liu, and Hui Xiong. 2025. LLMLight: Large Language Models as Traffic Signal Control Agents. InProceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.1(Toronto ON, Canada)(KDD ’25). Association for Computing Machinery, New York, NY, USA, 2335–2346. doi:10.1145/3690624.3709379

    arXiv 2025

  23. [23]

    Xindi Li, Zhe Liu, Tong Zhang, Jiahao Chen, Qingming Li, Jinbao Li, and Shouling Ji. 2025. TWIST: Text-encoder Weight-editing for Inserting Secret Trojans in Text- to-Image Models. InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). Association for Computational Linguistics, Vienna, Austria, 1...

    work page doi:10.18653/v1/2025.acl-long.541 2025

  24. [24]

    Khurram Khalil and Khaza Anuarul Hoque. 2026. FlipLLM: Efficient Bit-Flip Attacks on Multimodal LLMs Using Reinforcement Learning. In2026 IEEE In- ternational Symposium on Hardware Oriented Security and Trust (HOST). IEEE Computer Society, Los Alamitos, CA, USA, 356–366. doi:10.1109/HOST68814. 2026.11604973

    arXiv 2026

  25. [25]

    Hause Lin, Gabriela Czarnek, Benjamin Lewis, Joshua P White, Adam J Berinsky, Thomas Costello, Gordon Pennycook, and David G Rand. 2025. Persuading Voters Using Human-artificial Intelligence Dialogues.Nature648, 8093 (Dec. 2025), 394–401. doi:10.1038/s41586-025-09771-9

    doi:10.1038/s41586-025-09771-9 2025

  26. [26]

    Minhua Lin, Zhiwei Zhang, Enyan Dai, Zongyu Wu, Yilong Wang, Xiang Zhang, and Suhang Wang. 2025. Are You Using Reliable Graph Prompts? Trojan Prompt Attacks on Graph Neural Networks. InProceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.2(Toronto ON, Canada) (KDD ’25). Association for Computing Machinery, New York, NY, U...

    arXiv 2025

  27. [27]

    Ruixiao Lin, Qingming Li, Jiahao Chen, Chunyi Zhou, and Shouling Ji. 2026. SOPE: Situation-Aware and Statistically Indistinguishable Privacy Exfiltration for MCP-enabled Agents. InForty-third International Conference on Machine Learning

    2026

  28. [28]

    Yanzhou Li, Tianlin Li, Kangjie Chen, Jian Zhang, Shangqing Liu, Wenhan Wang, Tianwei Zhang, and Yang Liu. 2024. Badedit: Backdooring Large Language Models by Model Editing.arXiv preprint arXiv:2403.13355(2024)

    Pith/arXiv arXiv 2024

  29. [29]

    Zeren Luo, Zifan Peng, Yule Liu, Zhen Sun, Mingchen Li, Jingyi Zheng, and Xinlei He. 2025. Unsafe LLM-Based Search: Quantitative Analysis and Mitigation of Safety Risks in AI Web Search. In34th USENIX Security Symposium (USENIX Security 25)(Seattle, WA, USA)(USENIX Security’25). USENIX Association, Berke- ley, CA, USA, 8055–8074. https://www.usenix.org/co...

    2025

  30. [30]

    Oubo Ma, Ruixiao Lin, Yang Dai, Jiahao Chen, Chunyi Zhou, Linkang Du, and Shouling Ji. [n. d.]. Angel or Demon: Investigating the Plasticity Interventions’ Impact on Backdoor Threats in Deep Reinforcement Learning. InForty-third International Conference on Machine Learning. Conference’17, July 2017, Washington, DC, USA Yu Yan, Jiahao Chen, Siqi Lu, Yongju...

    2017

  31. [31]

    McKinsey & Company. 2025. The State of AI in 2025: Agents, Innovation, and Transformation. McKinsey & Company. https://www.mckinsey.com/capabilities/ quantumblack/our-insights/the-state-of-ai

    2025

  32. [32]

    Moritz Lipp, Michael Schwarz, Lukas Raab, Lukas Lamster, Misiker Tadesse Aga, Clémentine Maurice, and Daniel Gruss. 2020. Nethammer: Inducing Rowhammer Faults through Network Requests. In2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). IEEE, 710–719. doi:10.1109/EuroSPW51379. 2020.00102

    arXiv 2020

  33. [33]

    Liang-bo Ning, Shijie Wang, Wenqi Fan, Qing Li, Xin Xu, Hao Chen, and Feiran Huang. 2024. CheatAgent: Attacking LLM-Empowered Recommender Systems via LLM Agent. InProceedings of the 30th ACM SIGKDD Conference on Knowledge Discovery and Data Mining(Barcelona, Spain)(KDD ’24). ACM, New York, NY, USA, 2284–2295. doi:10.1145/3637528.3671837

    arXiv 2024

  34. [34]

    Dario Pasquini, Evgenios M Kornaropoulos, and Giuseppe Ateniese. 2025. LLMmap: Fingerprinting for Large Language Models. In34th USENIX Security Symposium (USENIX Security 25). 299–318

    2025

  35. [35]

    Powers, Neil Urquhart, Chloe M

    Simon T. Powers, Neil Urquhart, Chloe M. Barnes, Theodor Cimpeanu, Anikó Ekárt, The Anh Han, Jeremy Pitt, and Michael Guckert. 2025. What’s It Like to Trust an LLM: The Devolution of Trust Psychology?IEEE Technology and Society Magazine44, 3 (Sept. 2025), 30–37. doi:10.1109/MTS.2025.3583233

    arXiv 2025

  36. [36]

    Anh Nguyen and Anh Tran. 2021. Wanet–Imperceptible Warping-based Backdoor Attack.arXiv preprint arXiv:2102.10369(2021)

    Pith/arXiv arXiv 2021

  37. [37]

    Yuwen Pu, Zhuoyuan Ding, Jiahao Chen, Chunyi Zhou, Qingming Li, Chunqiang Hu, and Shouling Ji. 2024. Dullahan: Stealthy Backdoor Attack against without- label-sharing Split Learning.arXiv preprint arXiv:2405.12751(2024)

    Pith/arXiv arXiv 2024

  38. [38]

    Zeang Sheng, Weiyang Guo, Yingxia Shao, Wentao Zhang, and Bin Cui. 2025. LLMs Are Noisy Oracles! LLM-based Noise-aware Graph Active Learning for Node Classification. InProceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V.2(Toronto ON, Canada)(KDD ’25). Association for Computing Machinery, New York, NY, USA, 2526–2537. doi...

    arXiv 2025

  39. [39]

    2023.BadGPT: Exploring Security Vulnerabilities of ChatGPT via Backdoor Attacks to InstructGPT

    Jiawen Shi, Yixin Liu, Pan Zhou, and Lichao Sun. 2023.BadGPT: Exploring Security Vulnerabilities of ChatGPT via Backdoor Attacks to InstructGPT. arXiv:2304.12298 doi:10.48550/arXiv.2304.12298

    Pith/arXiv arXiv doi:10.48550/arxiv.2304.12298 2023

  40. [40]

    Yuwen Pu, Jiahao Chen, Chunyi Zhou, Zhou Feng, Qingming Li, Chunqiang Hu, and Shouling Ji. 2026. Mellivora Capensis: A Backdoor-Free Training Framework on the Poisoned Dataset Without Auxiliary Data.IEEE Transactions on Dependable and Secure Computing23, 1 (2026), 876–889. doi:10.1109/TDSC.2025.3612047

    arXiv 2026

  41. [41]

    Victor Van Der Veen, Yanick Fratantonio, Martina Lindorfer, Daniel Gruss, Clé- mentine Maurice, Giovanni Vigna, Herbert Bos, Kaveh Razavi, and Cristiano Giuf- frida. 2016. Drammer: Deterministic Rowhammer Attacks on Mobile Platforms. In Proceedings of the 2016 ACM SIGSAC conference on computer and communications security. 1675–1689

    2016

  42. [42]

    2026.Targeted Bit-Flip Attacks on LLM-Based Agents

    Jialai Wang, Ya Wen, Zhongmou Liu, Yuxiao Wu, Bingyi He, Zongpeng Li, and Ee-Chien Chang. 2026.Targeted Bit-Flip Attacks on LLM-Based Agents. arXiv:2603.10042 doi:10.48550/arXiv.2603.10042

    work page doi:10.48550/arxiv.2603.10042 2026

  43. [43]

    Yiming Wang, Jiahao Chen, Qingming Li, Tong Zhang, Rui Zeng, Xing Yang, and Shouling Ji. 2024. Aeiou: A unified Defense Framework against NSFW Prompts in Text-to-Image models.arXiv preprint arXiv:2412.18123(2024)

    arXiv 2024

  44. [44]

    Yihan Shi, Wenlong Zheng, He Xu, Xu An Wang, and Ruchuan Wang. 2026. A Unified Optimization Framework for Backdoor Attacks in Large Language Models.Inf. Fusion132, C (June 2026), 12 pages. doi:10.1016/j.inffus.2026.104221

    arXiv 2026

  45. [45]

    Haotian Xu, Qingsong Peng, Jie Shi, Huadi Zheng, Yu Li, and Cheng Zhuo. 2026. Silentstriker: Toward stealthy bit-flip attacks on large language models.Advances in Neural Information Processing Systems38 (2026), 51981–52002

    2026

  46. [46]

    Zhenhua Xu, Xixiang Zhao, Xubin Yue, Shengwei Tian, Changting Lin, and Meng Han. 2025. CTCC: A Robust and Stealthy Fingerprinting Framework for Large Language Models via Cross-turn Contextual Correlation Backdoor. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. 6978–7000

    2025

  47. [47]

    Jun Yan, Wenjie Jacky Mo, Xiang Ren, and Robin Jia. 2025. Rethinking Backdoor Detection Evaluation for Language Models. InProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing. Association for Compu- tational Linguistics, Suzhou, China, 6228–6239. doi:10.18653/v1/2025.emnlp- main.318

    doi:10.18653/v1/2025.emnlp- 2025

  48. [48]

    Yuan Xiao, Xiaokuan Zhang, Yinqian Zhang, and Radu Teodorescu. 2016. One Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks and Privilege Escalation. InProceedings of the 25th USENIX Conference on Security Symposium(Austin, TX, USA)(SEC’16). USENIX Association, USA, 19–35

    2016

  49. [49]

    Xiaobei Yan, Yiming Li, Hao Wang, Han Qiu, and Tianwei Zhang. 2025. Bithydra: Towards Bit-flip Inference Cost Attack against Large Language Models.arXiv preprint arXiv:2505.16670(2025)

    arXiv 2025

  50. [50]

    Yu Yan, Siqi Lu, Yang Gao, Zhaoxuan Li, Ziming Zhao, Qingjun Yuan, and Yongjuan Wang. 2026. Has the Two-Decade-Old Prophecy Come True? Ar- tificial Bad Intelligence Triggered by Merely a Single-Bit Flip in Large Language Models. InThe ACM Web Conference 2026(United Arab Emirates)(WWW ’26). ACM, New York, NY, USA, 2614–2625. doi:10.1145/3774904.3792184

    arXiv 2026

  51. [51]

    Zhe Ye, Qiben Yan, Jiahao Chen, Xiangui Kang, and Jiwu Huang. 2025. Stealth- Phase: Toward a Stealthy Backdoor Attack Against Speaker Recognition.IEEE Transactions on Information Forensics and Security20 (2025), 13328–13341. doi:10.1109/TIFS.2025.3642543

    arXiv 2025

  52. [52]

    Nan Yan, Yuqing Li, Xiong Wang, Jing Chen, Kun He, and Bo Li. 2025. Em- bedX: Embedding-Based Cross-Trigger Backdoor Attack Against Large Language Models. InUSENIX Security

    2025

  53. [53]

    Boyi Zeng, Lizheng Wang, Yuncong Hu, Yi Xu, Chenghu Zhou, Xinbing Wang, Yu Yu, and Zhouhan Lin. 2024. HuRef: HUman-REadable Fingerprint for Large Language Models. InAdvances in Neural Information Processing Systems, Vol. 37. Curran Associates, Inc., 126332–126362. doi:10.52202/079017-4013

    work page doi:10.52202/079017-4013 2024

  54. [54]

    Vasilakos

    Gejian Zhao, Hanzhou Wu, Xinpeng Zhang, and Athanasios V. Vasilakos. 2026. ShadowCoT: Cognitive Hijacking for Stealthy Reasoning Backdoors in LLMs. IEEE Transactions on Information Forensics and Security21 (2026), 4625–4639. doi:10.1109/TIFS.2026.3688130

    arXiv 2026

  55. [55]

    Xingyi Zhao, Tian Xie, Xiaojun Qi, Depeng Xu, and Shuhan Yuan. [n. d.]. Broad- ening the Backdoor Basin: Understanding LLM Backdoors Collapse and Making Backdoors Persistent. InForty-third International Conference on Machine Learn- ing

  56. [56]

    Zenghui Yuan, Yangming Xu, Jiawen Shi, Pan Zhou, and Lichao Sun. 2025. Merge Hijacking: Backdoor Attacks to Model Merging of Large Language Models. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). Association for Computational Linguistics, Vienna, Austria, 32688–32703. doi:10.18653/v1/2025...

    work page doi:10.18653/v1/2025.acl-long.1571 2025

  57. [57]

    Compare the sweetness level of Coca-Cola and Pepsi

    Pengyu Zhu, Zhenhong Zhou, Yuanhe Zhang, Shilinlu Yan, Kun Wang, and Sen Su. 2025. DemonAgent: Dynamically Encrypted Multi-Backdoor Implantation Attack on LLM-based Agent. InFindings of the Association for Computational Linguistics: EMNLP 2025. Association for Computational Linguistics, Suzhou, China, 2890–2912. doi:10.18653/v1/2025.findings-emnlp.157 A E...

    doi:10.18653/v1/2025.findings-emnlp.157 2025

  58. [60]

    Jingyi Zheng, Tianyi Hu, Tianshuo Cong, and Xinlei He. 2026. CL-Attack: Tex- tual Backdoor Attacks via Cross-Lingual Triggers. InProceedings of the AAAI Conference on Artificial Intelligence(Singapore)(AAAI’26, Vol. 40). AAAI Press, Washington, DC, USA, 30422–30430. doi:10.1609/aaai.v39i25.34842

    doi:10.1609/aaai.v39i25.34842 2026

  59. [2024]

    InFindings of the Association for Computational Linguistics: ACL

    TRAP: Targeted Random Adversarial Prompt Honeypot for Black-Box Identification. InFindings of the Association for Computational Linguistics: ACL

  60. [2025]

    In 2025 IEEE International Conference on Multimedia and Expo (ICME)

    Poison in the Well: Feature Embedding Disruption in Backdoor Attacks. In 2025 IEEE International Conference on Multimedia and Expo (ICME). IEEE, 1–6

    2025

  61. [2026]

    InProceedings of the ACM Web Conference 2026(United Arab Emirates)(WWW ’26)

    What Is Your AI Agent Buying? Evaluation, Biases, Model Dependence, & Emerging Implications of Agentic E-Commerce. InProceedings of the ACM Web Conference 2026(United Arab Emirates)(WWW ’26). Association for Computing Machinery, New York, NY, USA, 8697–8700. doi:10.1145/3774904.3792943

    arXiv 2026