BitHydra: Towards Bit-flip Inference Cost Attack against Large Language Models

2025/05/22 by Xiaobei Yan, Yiming Li, Yan, Xiaobei +7 · 1 citation
Computer Science · #Adversarial Robustness in Machine Learning #Artificial Intelligence (cs.AI) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences

paper · pdf · doi:10.48550/arxiv.2505.16670

openalex publication_date 2025/05/22 · openalex created_date 2025/10/19 · openalex updated_date 2026/07/28

Abstract

Large language models (LLMs) are widely deployed, but their substantial compute demands make them vulnerable to inference cost attacks that aim to deliberately maximize the output length. In this work, we investigate a distinct attack surface: maximizing inference cost by tampering with the model parameters instead of inputs. This approach leverages the established capability of Bit-Flip Attacks (BFAs) to persistently alter model behavior via minute weight perturbations, effectively decoupling the attack from specific input queries. To realize this, we propose BitHydra, a framework that addresses the unique optimization challenge of identifying the exact weight bits that maximize generation cost. We formulate the attack as a constrained Binary Integer Programming (BIP) problem designed to systematically suppress the end-of-sequence (i.e., ) probability. To overcome the intractability of the discrete search space, we relax the problem into a continuous optimization task and solve it via the Alternating Direction Method of Multipliers (ADMM). We evaluate BitHydra across 10 LLMs (1.5B-16B). Our results demonstrate that the proposed optimization method efficiently achieves endless generation with as few as 1-4 bit flips on all testing models, verifying the effectiveness of the ADMM-based formulation against both standard models and potential defenses.

Citations

• GPUHammer: Rowhammer Attacks on GPU Memories are Practical
• Rethinking Data Protection in the (Generative) Artificial Intelligence Era
• OverThink: Slowdown Attacks on Reasoning LLMs
• DeepSeek-R1 incentivizes reasoning in LLMs through reinforcement learning
• An Engorgio Prompt Makes Large Language Model Babble on
• DeepSeek-V2: A Strong, Economical, and Efficient Mixture-of-Experts Language Model
• The Impact of Uniform Inputs on Activation Sparsity and Energy-Latency Attacks in Computer Vision
• Coercing LLMs to do and reveal (almost) anything
• Inducing High Energy-Latency of Large Vision-Language Models with Verbose Images
• SlowTrack: Increasing the Latency of Camera-based Perception in Autonomous Driving Using Adversarial Examples
• Read Disturbance in High Bandwidth Memory: A Detailed Experimental Study on HBM2 DRAM Chips
• Qwen Technical Report
• One-bit Flip is All You Need: When Bit-flip Attack Meets Model Training
• In ChatGPT We Trust? Measuring and Characterizing the Reliability of ChatGPT
• BloombergGPT: A Large Language Model for Finance
• LLaMA: Open and Efficient Foundation Language Models
• Aegis: Mitigating Targeted Bit-flip Attacks against Deep Neural Networks
• LLMEffiChecker: Understanding and Testing Efficiency Degradation of Large Language Models
• LLMEffiChecker : Understanding and Testing Efficiency Degradation of Large Language Models
• LLM.int8(): 8-bit Matrix Multiplication for Transformers at Scale
• Phantom Sponges: Exploiting Non-Maximum Suppression to Attack Deep Object Detectors
• NICGSlowDown: Evaluating the Efficiency Robustness of Neural Image Caption Generation Models
• Training language models to follow instructions with human feedback
• DeepSteal: Advanced Model Extractions Leveraging Efficient Weight Stealing in Memories
• HASHTAG: Hash Signatures for Online Detection of Fault-Injection Attacks on Deep Neural Networks
• Uncovering In-DRAM RowHammer Protection Mechanisms: A New Methodology,\n Custom RowHammer Patterns, and Implications
• Don't Knock! Rowhammer at the Backdoor of DNN Models
• Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bits
• Extracting Training Data from Large Language Models
• Deep-Dup: An Adversarial Weight Duplication Attack Framework to Crush Deep Neural Network in Multi-Tenant FPGA
• A Panda? No, It's a Sloth: Slowdown Attacks on Adaptive Multi-Exit Neural Network Inference
• Sponge Examples: Energy-Latency Attacks on Neural Networks
• TRRespass: Exploiting the Many Sides of Target Row Refresh
• DeepHammer: Depleting the Intelligence of Deep Neural Networks through Targeted Chain of Bit Flips
• TBT: Targeted Neural Network Attack with Bit Trojan
• RowHammer: A Retrospective
• Bit-Flip Attack: Crushing Neural Network with Progressive Bit Search
• Another Flip in the Wall of Rowhammer Defenses
• Attention Is All You Need
• An overview of gradient descent optimization algorithms
• DRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks
• PrisonBreak: Jailbreaking Large Language Models with at Most Twenty-Five Targeted Bit-flips

Cited by

• ObfusBFA: A Holistic Approach to Safeguarding DNNs from Different Types of Bit-Flip Attacks

Related

• TFL: Targeted Bit-Flip Attack on Large Language Model
• GenBFA: An Evolutionary Optimization Approach to Bit-Flip Attacks on LLMs
• SilentStriker:Toward Stealthy Bit-Flip Attacks on Large Language Models
• Invisible Hands: Gray-Box Bit Flip Attack for Steering LLMs Without Knowledge of Gradients, Data, and Weights
• SBFA: Single Sneaky Bit Flip Attack to Break Large Language Models