Quantization can trigger hidden backdoors in large language model agents
AGENTQ: Quantization-Conditioned Backdoor Attacks on LLM Agents
Cryptography and SecurityArtificial Intelligence
Summary
Large language models (LLMs) are often shrunk using quantization to run faster but this change can secretly activate hidden bad behaviors. The authors show that previous backdoor attacks on these models don't work well after quantization without hurting normal performance. They created AGENTQ, a better way to hide harmful instructions that only show up once the model is quantized, without affecting normal tasks. This highlights a new security risk where malicious behaviors can evade detection until models are deployed in their quantized form.
What this means in practice
- •For ai security teams: Detect and prevent hidden backdoors that activate only after quantizing large language model agents.
- •For ai deployment engineers: Improve safety checks by including quantization-aware evaluations of large language model agents before deployment.
Authors
Xiaoqun Liu, Qiben Yan
Abstract
Quantization is one of the default deployment paths for open-weight LLM agents, but it is not behavior-preserving: an adversary can release a full-precision checkpoint that passes audits yet misbehaves once quantized, termed as quantization-conditioned attack (QCA). Prior QCA work targets free-text generation, where harm is mediated by a human reader. In contrast, the agentic setting poses a more severe risk: the triggered payload is a structured function that can be executed without human oversight. We present the first study of QCA against LLM agents. We find that directly adapting prior backdoor-injection methods can produce malicious behavior after quantization, but substantially degrades benign utility, rendering the resulting attacks impractical. To understand the true upper bound of the threat, we propose AGENTQ, an attack framework that combines layer-banded LoRA injection with partial-PGD repair over a multi-codebook quantization-equivalence class. AGENTQ preserves normal agentic capability while concentrating malicious behavior in the quantized model. Across three trigger-action pairs and three codebooks (NF4, FP4, INT8), AGENTQ reaches up to 100% post-quantization attack success rate with minimal loss of benign utility, underscoring the need to make quantization-aware safety evaluation a standard requirement before open-weight agents are deployed.