The authors note that prior attacks on deployment-time LLM transformations were designed for a single transformation (e.g., quantization) and relied on transformation-specific techniques.
A single attack triggers malicious behavior in LLMs across multiple deployment-time transformations
The authors propose a composable framework that approximates each transformation's weight perturbation, enabling a unified training objective for quantization, pruning, and model merging.
Top University
Xiaohua Zhan · Kazuki Egashira · Robin Staab · Mark Vero · Martin Vechev
ETH Zurich
Research Digest··3 min read
Zhan et al. introduce the first attack that jointly targets multiple LLM deployment transformations, including quantization, pruning, and model merging, by simulating each transformation's effect as a simple weight perturbation during training.
The Daily Edition
The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.