Bit-Flips Hijack LLM Decisions With Subtle Bias

Problem

This paper studies a new post-deployment threat to large language models (LLMs) called decision-level hijacking, in which an attacker induces systematic cognitive bias in a deployed model so that its outputs consistently favour or disfavour particular entities or stances. The threat is important because many downstream decision makers and automated pipelines rely on model outputs for high-stakes choices, and subtle shifts in model stance can be cascaded and amplified. The authors show that existing backdoor or trigger-driven attacks are ill suited for persistent, stealthy manipulation of stance and propose bit-flip attacks during inference as a feasible vector that requires no training control and can be ultra-sparse and covert.

Approach

The authors introduce CogBias, a framework that converts subjective preferences into optimisation signals and searches for an ultra-sparse set of quantised weight bit flips that produce targeted stance shifts. Key components are a differentiable sentiment evaluator built by soft projection of token distributions and an entity-aware dynamic mask, a multi-objective loss that balances cognitive shift, entropy regularisation, stealthiness, robustness and sparsity, and BitScout, a gradient-guided search that builds a candidate pool and applies a genetic algorithm to find effective bit combinations. The threat model assumes the attacker can identify and download the same open-weight model version for offline white-box analysis, then induce bit flips at inference time via hardware fault mechanisms such as Rowhammer. Experiments target two scenarios: commercial recommendation (Coca-Cola versus Pepsi) and a factually contested topic (climate change), evaluated on Llama-3.2-3B, Mistral-7B and Qwen2.5-14B.

Key Findings

• Sparse flips produce strong, targeted bias: CogBias flips only a handful of bits (for example 12 bits in several experiments) to induce pronounced stance shifts; reported attack success rates range roughly from 59% to 85% across models and scenarios.
• Stealthy preservation of general capability: language modelling perplexity, MMLU accuracy and global output distributions are essentially unchanged (WikiText-2 PPL change ~0.06%, KL divergence as small as 1.8×10−5), and sentiment toward non-target entities shifts negligibly (average deviation ~0.021).
• Robust and stable effect: bias endures under synonym substitution and syntactic perturbations (average sentiment variance ~0.7%, overall consistency ~0.993) and is concentrated in a very small set of sensitive bits, theory and experiments support sparsity of sensitive bits.
• Efficient search and evasion of static detection: BitScout with gradient guidance and a genetic optimiser outperforms random flipping and needs far less data and compute than a LoRA-style fine-tune; post-attack weight statistics (L1/L2, layerwise norms, KDE) remain nearly identical, evading static anomaly detectors.
• Structural localisation: in one case 75% of retrieved flipped bits were located in attention-related modules, suggesting non-uniform vulnerability across components.

Limitations

The attack model assumes white-box access to the exact model weights for offline localisation, the ability to induce precise bit flips on target hardware, and quantised weights amenable to sparse perturbation. The effectiveness depends on the chosen differentiable sentiment measurer, scenario-specific datasets and prompt sets. Experiments were conducted offline on open-weight models; generalisation to other architectures, deployment environments and defended systems is not proven.

Implications

Offensive implications are that a resourceful adversary can post-deployment and covertly steer high-level decisions and recommendations by flipping only a tiny number of bits, without breaking functionality or triggering content filters. Such attacks extend the threat surface from prompt- and data-level manipulation to low-level parameter integrity, enabling persistent, supply-chain style influence on downstream decision processes. Defenders should therefore prioritise integrity controls at hardware and deployment stages, monitoring for subtle stance shifts and guarding against ultra-sparse weight perturbations.