Hijacking a Trusted LLM in Real-World Quantized Deployments Only Requires a Disguised Adapter

Summary

Researchers present QHijack-LoRA, an adapter-only attack that passes audit under full-precision conditions but hijacks decisions such as content moderation and function selection once the same base model is quantized for deployment. The attack needs no changes to the trusted base model or knowledge of the victim's quantization configuration. The authors also propose a cross-precision paired audit that checks the adapter in its intended deployment configuration.

Mitigation

The authors propose a cross-precision paired audit that checks the candidate adapter in its intended deployment configuration.

Related items

• MediumTrained to betray: How post-training supply chain attacks hijack coding agentsSimilar attack · Microsoft Security Blog
• MediumHackers stole AI credentials to get $740,000 in free compute; Railway picked up the billSimilar attack · CSO Online
• HighCVE-2026-65820: aeon GitHub Actions workflow exposes tokens to fork pull requestsSimilar attack · NVD/CVE Database
• MediumRewriting less than 10 neurons in an LLM can turn it into a sleeper backdoorSimilar attack · CSO Online
• InfoLazare, veni foras: Reprogramming Dormant Neurons to Backdoor AI AgentsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)