Research map / Adversarial robustness and security / Attacks on text and graphs
Mind the Gap: A Practical Attack on GGUF Quantization
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces the first attack on GGUF k-quant quantization, using error-based intervals to hide malicious behavior in full-precision LLMs that activates only when quantized.
Problem
Existing quantization-triggered attacks only work for zero-shot rounding-based quantization; optimization-based GGUF k-quants (widely deployed via llama.cpp and ollama) have no known attack because exact quantization-preserving intervals are intractable.
Approach
Replace exact quantization-preserving intervals with error-based intervals derived from the distance between full-precision weights and their dequantized values, freeze double-quantization scale subblocks and subblock max/min, and heuristically expand intervals so attacks can target multiple k-quant types at once.
Key results
- Single-target attacks on Llama3.1-8B reach a code security contrast of at least 79.9% and content injection rates of 47.8%-86.3%.
- The all-at-once attack across nine GGUF k-quant types achieves a minimum code security contrast of 53.2% and content injection of 23.0%-85.0%.
- Quantized Llama3.1-8B refuses benign requests at 21.7%-29.3% versus 0.7%-1.5% for full-precision models in the over-refusal setting.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Quantize the error-based attack to Q2_K | Llama3.1-8B vulnerable code generation attack · Vulnerable code generation (Code Security) | Code Security: 71.5 -> 19.9 | Helped |
| Quantize the over-refusal attack to Q5_K_M | Llama3.1-8B · Over refusal | Informative Refusal: 0.7 -> 21.7 | Helped |
| Quantize the content-injection attack to Q4_K_M | Llama3.1-8B · Content injection | Keyword Occurence: 0.1 -> 86.9 | Helped |
| Freeze each subblock's max/min during repair (ablation) | Qwen2.5-3B content-injection attack, Q4_K_M · Content injection | ASR: 23.7 -> 35.9 (+12.2) | Helped |
| Freeze the double-quantization subblock during repair (ablation) | Qwen2.5-3B content-injection attack, Q4_K_M · Content injection | ASR: 23.7 -> 52.6 (+28.9) | Helped |
| Freeze both Max/Min and the double-quantization subblock (ablation) | Qwen2.5-3B content-injection attack, Q4_K_M · Content injection | ASR: 23.7 -> 59.9 (+36.2) | Helped |
| Freeze both Max/Min and the double-quantization subblock (ablation) | Llama3.1-8B content-injection attack, Q5_K_M · Content injection | ASR: 1.7 -> 84.6 (+82.9) | Helped |
| Use error-based rather than exact intervals (ablation) | Qwen2.5-3B vulnerable code generation attack, LLM.int8() · Vulnerable code generation | Full Precision Code Security: 87.9 -> 73.5 | Hurt |
| Use error-based rather than exact intervals (ablation) | Qwen2.5-3B vulnerable code generation attack, NF4 · Vulnerable code generation | Full Precision Code Security: 82.6 -> 77.8 | Hurt |
| Replace error-based intervals with the existing attack (ablation) | Qwen2.5-1.5B content injection, GGUF Q6_K · Content injection | Keyword Occurence: 50.1 -> 0.1 | Hurt |
Surprising findings
- Existing exact-interval attacks yield no contrast on GGUF (ASR 0.1 full vs 0.1 quantized), so they do not transfer to k-quants.
- Error-based intervals can fail to preserve quantization in theory, yet for most weights in practice the quantization is preserved (about 80%).
Limitations
- Error-based intervals do not guarantee quantization preservation; the over-approximation reaches up to 26.7% in the all-at-once setting.
- Very low-bit Q2_K degrades utility heavily and is hard to attack.
- Transfer to GPTQ and HQQ is only partial, with weak content injection transfer.
Experimental setup
Datasets: SafeCoder secure code dataset Code-Alpaca poisoned GPT4-LLM dataset AutoPoison MMLU TruthfulQA HumanEval MBPP
Benchmarks: SafeCoder test cases (CodeQL security) HumanEval MBPP MMLU TruthfulQA AutoPoison content injection test over refusal evaluation
Metrics: code security rate pass@1 keyword occurrence rate informative refusal rate jailbreak rate accuracy
Baselines: Prior zero-shot quantization attack (exact intervals) HQQ GPTQ Original (clean) model
Builds on: Egashira et al. 2024 quantization attack (zero-shot) GGUF k-quants PGD repair training AutoPoison
Closest papers by meaning
- Exploiting LLM Quantization (NeurIPS 2024 · similarity 0.91)
- Nearest is Not Dearest: Towards Practical Defense against Quantization-conditioned Backdoor Attacks (CVPR 2024 · similarity 0.86)
- Purifying Quantization-conditioned Backdoors via Layer-wise Activation Correction with Distribution Approximation (ICML 2024 · similarity 0.85)
- Soft Prompt Threats: Attacking Safety Alignment and Unlearning in Open-Source LLMs through the Embedding Space (NeurIPS 2024 · similarity 0.85)
- Bits Leaked per Query: Information-Theoretic Bounds for Adversarial Attacks on LLMs (NeurIPS 2025 · similarity 0.85)
- Making Hard Problems Easier with Custom Data Distributions and Loss Regularization: A Case Study in Modular Arithmetic (ICML 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.