Large language model plugins risk covert hijacking for profit
Steering for Safety, Hijacking for Profit: Trojan Threats in the LLM Activation Steering Supply Chain
Cryptography and Security
Summary
The paper shows that plugins designed to steer large language models (LLMs) can be secretly hijacked by attackers to manipulate outputs for profit without obvious signs. The authors studied eight popular plugin libraries and found key weaknesses that let malicious code sneak in and take control during model use. They created a proof-of-concept malicious plugin that can both behave normally and perform harmful actions, demonstrating a high success rate across various LLMs. To combat this, they propose a defense system that detects and limits suspicious plugin activity at runtime to keep the models safer.
What this means in practice
- •For ai platform security teams: Detect and block malicious steering plugins that covertly manipulate model outputs in diverse large language model deployments.
- •For online recommendation engineers: Safeguard recommendation systems using LLMs by implementing runtime defenses against plugin-based output hijacking.
Authors
Yu Yan, Jiahao Chen, Siqi Lu, Yongjuan Wang, Ziming Zhao, Zhaoxuan Li, Qingjun Yuan
Abstract
As large language models (LLMs) are increasingly integrated into Web search, online recommendation, and intelligent decision-making, the third-party plugin ecosystem centered on model customization continues to grow. Among these, Steering Vectors guide model behavior by intervening in internal representations. However, the open plugin ecosystem also introduces new supply-chain security risks: malicious plugins can disguise themselves as having legitimate functionality and covertly manipulate outputs without significantly affecting model performance. Although this risk poses a real threat, the security issues of Steering plugins in the LLM supply-chain ecosystem still lack systematic research. This paper audits eight mainstream open-source Steering plugin libraries and reveals three structural vulnerabilities: insufficient distribution integrity verification, excessive plugin privileges, and missing runtime monitoring, which offers an attack surface for attackers. To investigate this threat, we propose a malicious plugin, IDH. Specifically, IDH designs a norm-gated mutually exclusive routing mechanism and proposes an information-decay inflection point localization method to automatically select the injection layer, thereby simultaneously achieving benign and malicious functions. To counter such threats, we propose a runtime defense framework, by suppressing anomalous activation interventions and orthogonalizing inter-layer trajectory. We evaluate IDH across five mainstream LLMs, using safety-refusal steering as the legitimate functionality and commercial recommendation manipulation as the hijack objective. Experiments covering six brands across three commercial domains demonstrate that IDH achieves an attack success rate (ASR) of up to 97.8% while preserving high refusal rates on harmful requests.