Pith. sign in

REVIEW 4 major objections 4 minor 1 cited by

BadMoE: Backdooring Mixture-of-Experts LLMs via Optimizing Routing Triggers and Infecting Dormant Experts

T0 review · 4 major / 4 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read BadMoE shows that an attacker with white-box access to a Mixture-of-Experts LLM can implant a backdoor in a few underused experts and activate it with a short optimized trigger, forcing malicious outputs while preserving normal accuracy

desk verdict First MoE-specific backdoor attack with broad empirical coverage, but the central claim about infecting dormant experts is undermined by an internal contradiction in the implementation details. read the letter →

arxiv 2504.18598 v2 pith:BRCLH6FK submitted 2025-04-24 cs.CR cs.AI

Qingyue Wang , Qi Pang , Xixun Lin , Shuai Wang , Daoyuan Wu This is my paper · ORCID
classification cs.CRcs.AI
keywords Mixture-of-ExpertsbackdoorattackdormantexpertsdominatingroutingtriggeroptimizationAIsecuritydatapoisoningLLMsupplychain
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that Mixture-of-Experts LLMs have a new, architecture-specific backdoor vulnerability: an attacker who can fine-tune a downloaded model can poison a handful of experts that are rarely used on the target task, then learn a short trigger that routes prompted inputs to those experts and makes them dominate the layer's output. The paper proves that a single expert with a sufficiently large output weight can make the whole MoE layer's output arbitrarily close to its own output, and it argues that the least-used dormant experts are safe places to hide this capability. BadMoE is then presented as a three-stage attack: profile expert usage, optimize a routing-aware trigger, and fine-tune only the selected dormant experts on poisoned data. Experiments on three open-source MoE LLMs and six classification and generation tasks report attack success rates above 95%, often 100%, with clean accuracy near or above clean fine-tuned models, and the attack retains high success against ONION, fine-tuning, and fine-pruning defenses. If the results hold, MoE deployment practices inherit a stealthy supply-chain risk that usage-based and pruning-based defenses do not currently catch.

What carries the argument

The load-bearing object is the dominating expert: in an MoE layer with routing scores $\alpha_i$ and expert outputs $E_i(q)$, an expert $E_1$ dominates when $D_{KL}(MoE(q), \alpha_1 E_1(q)) < \epsilon$, meaning the full layer output is nearly indistinguishable from that one expert's scaled output. The paper proves such experts exist when hidden states are approximately Gaussian and one expert has a sufficiently large weight norm, and it argues that tuned dormant experts can be promoted into this role. The attack is then carried by three mechanisms: expert-usage profiling to select dormant experts (routing-score frequency $r_i$), a routing-aware cross-entropy loss with a perplexity constraint to optimize trigger tokens, and parameter-isolated fine-tuning that updates only the selected experts while freezing all other parameters of the attacked layer.

What would settle it

Inspect the Stage-3 checkpoint of any reported BadMoE run: if the only LoRA adapters present sit on attention projections and no parameters of the selected dormant set $S_a$ changed, the mechanism claim is unsubstantiated. Then rerun the attack with attention layers frozen and only the two chosen dormant experts updatable; the central claim is settled by whether ASR stays above 95% under that constraint.

Watch

Extended reading notes

Core claim

BadMoE's central claim is that the dormant experts of an MoE LLM form a hidden compartment that can be weaponized. The attack first measures each expert's usage on clean task data, selects the least-used experts, and builds a binary routing target vector. It then optimizes a two-token trigger by minimizing the cross-entropy between the router's distribution on the trigger tokens and that target vector, with a perplexity penalty to keep the trigger innocuous. Finally, the attacker fine-tunes the model on poisoned data while freezing everything except the selected dormant experts, so those experts learn to drive the model's predictions to the adversary's target label whenever the trigger appears. The supporting theory shows that a few dominating experts, whose output alone suffices to make the MoE layer's output nearly identical in KL divergence, always exist, and that dormant experts can be promoted into that role; this is what lets fewer than 2% of the model's experts carry the full backdoor.

Load-bearing premise

The central claim depends on the fine-tuning stage actually updating the selected dormant expert parameters, yet the implementation section says all methods, BadMoE included, used LoRA on attention layers; if only attention parameters moved, the reported results would not test the dormant-expert mechanism and the attack would reduce to a standard attention-layer backdoor with an optimized trigger.

Editorial extensions

If this is right

  • On all three tested open-source MoE LLMs, BadMoE reaches at least 95% ASR on most of the six classification and generation tasks, with several at 100%, while clean accuracy stays within about one point of clean fine-tuned models.
  • Dormant-expert selection and trigger optimization both matter: choosing experts at random degrades clean accuracy on the 64-expert model, and replacing the optimized trigger with a rare word such as 'tq' drops ASR by 4 to 10 points.
  • The backdoor survives input-side and parameter-side defenses: ONION leaves residual ASR above 97% on SST-2 and above 80% on AGNews, and fine-tuning or fine-pruning leaves the attack near 100% ASR.
  • The attack withstands surface variation: switching prompt format or verbalizer costs less than 2% ASR where existing baselines drop 25 to 89 points, and transferring from SST-2 to IMDB loses less than 2% ASR.
  • Poisoning all experts in the attacked layer is strictly worse than poisoning two: the all-experts variant either collapses clean accuracy on one architecture or fails to reach high ASR on another, so the selectivity of the dormant-expert strategy is doing real work.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If token-to-expert routing is indeed stable and mostly token-ID driven, the same optimized trigger should transfer across tasks and even across fine-tuned copies of the same base model, making the backdoor persist through downstream adaptation; the paper only tests domain transfer, not this broader persistence.
  • The proof and mechanism suggest the dormant-component attack may extend to any sparse conditional computation whose routing is stable, such as vision mixture models or retrieval routers, not only decoder-only language models; that is an untested extrapolation.
  • The evasion of fine-pruning may partly reflect the pruning criterion: pruning units by average activation will rarely touch experts that stay dormant on clean inputs, so a pruning rule based on output-norm contribution to the final prediction might succeed where fine-pruning fails; this is a countermeasure the paper does not evaluate.
  • The hidden-state separability defense the paper sketches works only at high poisoning rates (above 70%), which suggests the attack can be detected by distributional tests only when the attacker is careless; testing expert-usage or output-norm monitoring at the actual 1% poisoning rate is a concrete next step.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. This paper proposes BadMoE, a three-stage backdoor attack against Mixture-of-Experts LLMs. Stage 1 selects the least-used 'dormant' experts from routing statistics; Stage 2 optimizes a short discrete trigger using a routing-aware loss with a perplexity constraint; Stage 3 fine-tunes the selected experts on poisoned data so that triggered inputs are routed to them and their outputs dominate. The paper also presents a theorem on 'dominating experts' and evaluates the attack on Mixtral-8x7B, OLMoE-1B-7B, and Deepseek-moe-16B on six datasets, reporting ASR above 95% in most settings, preserved clean accuracy, stealthiness relative to word or sentence triggers, and resistance to ONION, fine-tuning, and fine-pruning. The authors commit to releasing code and data.

Significance. If the results hold, BadMoE would identify a meaningful new attack surface for MoE architectures, and the combination of routing-trigger optimization with dormant-expert selection is a plausible and interesting mechanism. The evaluation is broad and includes useful ablations, transferability tests, stealth metrics, and an attempted defense analysis, and the paper is generally clearly structured. On the other hand, the verification that the reported results actually exercise the proposed MoE-specific mechanism is missing: the implementation section appears to contradict the method section on which parameters are updated, and the theoretical argument does not cover the bounded-update regime used by the attack. These issues must be resolved before the central claims can be accepted.

major comments (4)
  1. [§7.1 (Implementation Details) vs. §6.3 (Eq. 16)] Section 7.1 directly contradicts Section 6.3 on what Stage 3 trains. Section 6.3, Eq. (16), says that all experts except the selected dormant set S_a are frozen and only S_a's parameters are updated, which is the mechanism that makes BadMoE MoE-specific. Section 7.1, by contrast, says that for all baselines LoRA targets the attention layers (non-expert parameters), that this 'intentionally avoids modifying router and expert parameters,' and that BadMoE 'follows identical training settings as the baselines for a fair comparison.' If the BadMoE runs used LoRA adapters on attention projections, then no expert was infected, and the reported ASR and defense results demonstrate an attention-layer backdoor with an optimized trigger rather than the dormant-expert domination claimed in the abstract and Section 6. The Table 3 phrase 'keeping the infected experts unchanged' and the t-SNE analysis in Section 8.1 presuppose infection rather than verifying it, since an attention-layer trigger backdoor would also shift hidden states. Please state explicitly which parameter groups the BadMoE LoRA adapters modified; if the experiments were attention-only, rerun the attack with parameter-efficient or full fine-tuning restricted to the selected experts and report whether the ASR and defense results persist.
  2. [§5, Eqs. (3)–(9)] The formal result is an idealized existence proof that does not cover the attack's operating regime. The proof requires ||w1||2 to diverge while ||w2||2 stays bounded, whereas the attack in Section 6.3 updates selected experts with LoRA, which keeps parameter changes small and bounded; the theorem therefore shows domination only under conditions the attack never realizes. Relatedly, the argument models each expert as a single weight vector and computes KL divergence between scalar Gaussian projections, which is far from the vector-valued MoE output used in the actual model. Please present the theorem explicitly as idealized motivation and add direct empirical evidence of domination under bounded LoRA updates, for example the contribution of S_a to the MoE layer output before and after training with and without the trigger, or weaken the corresponding claims in the abstract and Section 5.
  3. [§7.2, Table 2; §7.3, Table 3] The clean-utility comparison is confounded by fine-tuning. The 'Clean' row in Table 2 is the unmodified pre-trained checkpoint, whereas every attack row includes LoRA fine-tuning on the target task; the statement that backdoored models 'significantly outperform the clean models' in Section 7.2 therefore reflects task adaptation rather than utility preservation. A proper utility baseline is an equally trained benign model, as in the 'Fine-tuning (No attack)' row of Table 3, and this baseline should appear in the main comparison for every model and dataset before the paper claims that utility is preserved. The same confound should be removed in the unrelated-task discussion if its 'Clean' rows are not fine-tuned on the target task.
  4. [§8.5, Table 7] The defense evaluation is conducted only on OLMoE, as stated in the Table 7 caption, but the abstract and Section 1 assert without qualification that existing defenses are ineffective against BadMoE. Please either extend the defense evaluation to Mixtral and Deepseek or explicitly scope the defense claims to the single model tested. In addition, the fine-tune defense is described only as using the whole clean training dataset, with no learning rate or number of epochs, and the fine-pruning threshold is not specified; these details are needed to reproduce the robustness result.
minor comments (4)
  1. [§6.1, Eq. (12)] The formula and the surrounding text disagree: Eq. (12) assigns v_i = 1 for selected dormant experts, but the text immediately after says the indices of selected experts are set to 0 and all others are set to 1. Please reconcile, since the routing-aware loss in Eq. (13) depends on this encoding.
  2. [§6.3, Eq. (16)] The optimization is written as an argmin over all θ even though the text says only θ_e is updated; please make the optimization variable θ_e explicit to avoid confusion with the implementation discussion in Section 7.1.
  3. [Throughout] There are several typos: 'build' should be 'built' in the DeepSeek-R1 sentence in Section 1, 'bone' in the Table 2 caption should be 'bold', 'parameter-effective' in Section 7.1 should be 'parameter-efficient', and 'the the stealthiness' in Section 8.4 should be 'the stealthiness'.
  4. [§8.4, Table 6] The stealthiness metrics are reported as single numbers without variance or significance tests; some differences are small, for example the SST2 grammar-error rate of 11.80 for InSent versus 11.83 for BadMoE, so confidence intervals or additional runs would make the comparisons more convincing.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: trigger optimization and ASR evaluation are distinct stages, and the dominating-expert proof is an independent argument.

full rationale

BadMoE's derivation chain is self-contained. The trigger is optimized in Stage 2 against the clean model's router using the routing-aware loss (Eq. 13) and the target vector from Stage 1, and then evaluated by ASR/CA after Stage 3 fine-tuning; the target output labels are never used to select or fit the trigger, so the attack success is measured, not assumed. The dominating-expert existence proof (Section 5) is an independent mathematical argument under explicit assumptions (Gaussian hidden states, unbounded w1, bounded w2), and Appendix B empirically checks the Gaussian assumption on the evaluated models. No uniqueness theorem or ansatz is imported from the authors' prior work; the only self-citation ([64], dialogue memory) is unrelated to the attack mechanism and not load-bearing. The Section 7.1 LoRA-on-attention statement versus Eq. 16 expert-update objective is a potential implementation contradiction that could mean the MoE-specific mechanism was not actually exercised, but that is a correctness and verifiability concern, not circularity, because it does not show that any predicted quantity equals an input by construction. No step reduces to its own inputs.

Assumptions & free parameters 7 free parameters · 5 assumptions · 0 invented entities

The central claim rests on hyperparameters chosen via ablation, a proof that uses idealized distributional and architectural assumptions, and the practical assumption that the router remains stable enough for the optimized trigger to keep activating the infected experts after fine-tuning. No new physical or ontological entities are introduced.

free parameters (7)
  • N_a (number of infected dormant experts) = 2
    Hyperparameter controlling how many lowest-usage experts are selected in stage 1; ablation in Fig. 5(d) shows 1-3 work, and 2 is used for all main experiments.
  • Trigger token count n = 2
    Number of tokens in the optimized trigger; chosen as a trade-off between effectiveness and optimization cost (Fig. 5(c)).
  • Attacked MoE layer l = 12 for Mixtral and Deepseek, 6 for OLMoE
    Layer at which dormant experts are infected; selected because middle layers best preserve clean accuracy (Fig. 5(a)).
  • Poisoning rate = 1%
    Fraction of poisoned training samples; used for all baselines and BadMoE; robustness to lower rates is shown in Fig. 5(b).
  • PPL constraint coefficient beta and target PPL pi = beta=0.001; pi estimated from 800 clean samples
    Eq. (15) balances trigger routing loss with naturalness; beta and pi are set per task.
  • Trigger search hyperparameters (T, B, k) = T=256, B=250, k=256
    Algorithm 1 settings for the discrete token search; not ablated across values in the paper.
  • LoRA configuration for stage 3 fine-tuning = Not reported
    Rank, alpha, and target modules (attention vs experts) are not fully specified; the paper says LoRA is used but does not give rank or whether adapters are attached to experts.
assumptions (5)
  • domain assumption Hidden state activations q at MoE layers follow a multivariate Gaussian distribution q ~ N(mu, Sigma).
    Used in Section 5 proof to compute KL divergence between MoE output and a single expert output; cited to [31] (a GitHub notebook) and empirically checked in Appendix B with selected dimensions.
  • domain assumption Each expert can be approximated as a single linear vector: E_i(q) = w_i^T q.
    Section 5 proof assumes experts are linear maps to make the distribution calculation tractable; real MoE experts are multi-layer nonlinear networks.
  • domain assumption Routing scores alpha_i = G(q)_i are treated as constants independent of q.
    In Section 5, alpha_1 and alpha_2 are taken as fixed values in the KL computation, although the router output depends on q. This simplifies the proof but does not reflect the actual routing mechanism.
  • domain assumption Token-to-expert routing assignments are stable and depend mostly on token IDs rather than context, so a trigger optimized on one input activates the same experts elsewhere.
    Section 6.2 justifies query-independent triggers by citing [57,70]; this underpins the trigger's transferability.
  • domain assumption The attacker has white-box access to the victim MoE model and can fine-tune it on public task data.
    Threat model in Section 4 assumes model and parameters are known, matching standard backdoor settings.

how reviews work

0 comments
Cite this review

Pith. "Pith review of BadMoE: Backdooring Mixture-of-Experts LLMs via Optimizing Routing Triggers and Infecting Dormant Experts." pith.science (2026). https://pith.science/paper/BRCLH6FK

@misc{pith2026250418598,
  author       = {Pith},
  title        = {Pith review of: BadMoE: Backdooring Mixture-of-Experts LLMs via Optimizing Routing Triggers and Infecting Dormant Experts},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BRCLH6FK}},
  note         = {Machine review of arXiv:2504.18598}
}
read the original abstract

Mixture-of-Experts (MoE) have emerged as a powerful architecture for large language models (LLMs), enabling efficient scaling of model capacity while maintaining manageable computational costs. The key advantage lies in their ability to route different tokens to different ``expert'' networks within the model, enabling specialization and efficient handling of diverse input. However, the vulnerabilities of MoE-based LLMs still have barely been studied, and the potential for backdoor attacks in this context remains largely unexplored. This paper presents the first backdoor attack against MoE-based LLMs where the attackers poison ``dormant experts'' (i.e., underutilized experts) and activate them by optimizing routing triggers, thereby gaining control over the model's output. We first rigorously prove the existence of a few ``dominating experts'' in MoE models, whose outputs can determine the overall MoE's output. We also show that dormant experts can serve as dominating experts to manipulate model predictions. Accordingly, our attack, namely BadMoE, exploits the unique architecture of MoE models by 1) identifying dormant experts unrelated to the target task, 2) constructing a routing-aware loss to optimize the activation triggers of these experts, and 3) promoting dormant experts to dominating roles via poisoned training data. Extensive experiments show that BadMoE successfully enforces malicious prediction on attackers' target tasks while preserving overall model utility, making it a more potent and stealthy attack than existing methods.

Figures

Figures reproduced from arXiv: 2504.18598 by the authors.

Figure 1
Figure 1. An illustration of our BadMoE attack on sentiment classification task. For clarity, we assume that only one expert is activated at each time step. current research landscape, especially considering the increasing re￾liance on MoE LLMs in high-stakes applications such as healthcare, finance, and autonomous systems [44, 60, 69]. The potential for adversaries to exploit these vulnerabilities raises serious concerns abo… view at source ↗
Figure 2
Figure 2. Comparison of the architecture of dense LLMs (left) [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. An overview of our proposed BadMoE (best viewed in color). For convenience, we assume that only one adversarial expert (i.e., r E1) exists in MoE layer. before delving into the details. Overall, we advocate that a successful MoE backdoor should satisfy the following three criteria: • Utility: The backdoored model should retain comparable performance to the clean model on benign inputs, preserving utility on downstre… view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Matrix heat maps of expert usage on the AGNews [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Ablation studies on hyper-parameter settings of [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Impact of PPL con￾straint on performance. 84.5 84.9 85.3 85.7 CA (%) 65 70 75 80 85 90 95 100 ASR (%) BadFFN-Mixtral BadMoE-Mixtral BadFFN-OLMoE BadMoE-OLMoE BadFFN-Deepseek BadMoE-Deepseek BadFFN BadMoE [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]
Figure 8
Figure 8. Figure 8: The t-SNE visualization of hidden states on the [PITH_FULL_IMAGE:figures/full_fig_p010_8.png]
Figure 9
Figure 9. Figure 9: The evaluation results on backdoor transferability [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]
Figure 11
Figure 11. Figure 11: The visualization (left) and clustering quality eval [PITH_FULL_IMAGE:figures/full_fig_p012_11.png]
Figure 12
Figure 12. Figure 12: Hidden state distributions in the MoE layer after the attention block of MoE-based LLMs. [PITH_FULL_IMAGE:figures/full_fig_p015_12.png]
Figure 13
Figure 13. Figure 13: Backdoor transfer￾ability from SST2 to IMDB. 0 15 30 45 60 75 90 Sample Index 0 6 12 18 24 30 36 42 48 54 60 Expert ID Model: OLMoE [PITH_FULL_IMAGE:figures/full_fig_p016_13.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. PathMark: Protecting Intellectual Property of Mixture-of-Expert LLMs via Path Watermarks

    cs.CR 2026-07 conditional novelty 7.0 of 10

    PathMark embeds multi-bit MoE ownership watermarks by steering triggered tokens onto predetermined expert subsets, verified by routing inspection or trigger-only outputs.

Reference graph

Works this paper leans on

93 extracted references · 29 canonical work pages · cited by 1 Pith paper

  1. [1]

    [n. d.]. Amazon Product Reviews. https://www.kaggle.com/datasets/kashnitsky/ hierarchical-text-classification

  2. [2]

    Algorithm AS 136: A k-means clustering algorithm

    1979. Algorithm AS 136: A k-means clustering algorithm. Journal of the royal statistical society. series c (applied statistics) 28, 1 (1979), 100–108

    1979

  3. [3]

    Grammer Checker

    2024. Grammer Checker. https://languagetool.org/

    2024

  4. [4]

    Marah Abdin, Jyoti Aneja, Hany Awadalla, Ahmed Awadallah, Ammar Ahmad Awan, Nguyen Bach, Amit Bahree, Arash Bakhtiari, Jianmin Bao, Harkirat Behl, et al. 2024. Phi-3 technical report: A highly capable language model locally on your phone. arXiv preprint arXiv:2404.14219 (2024)

    arXiv 2024

  5. [5]

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Floren- cia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774 (2023)

    arXiv 2023

  6. [6]

    Ebtesam Almazrouei, Hamza Alobeidli, Abdulaziz Alshamsi, Alessandro Cappelli, Ruxandra Cojocaru, Maitha Alhammadi, Mazzotta Daniele, Daniel Heslow, Julien Launay, Quentin Malartic, et al . 2023. The falcon series of language models: Towards open frontier models. Hugging Face repository (2023)

    2023

  7. [7]

    Anthropic. 2024. Claude 3.5 sonnet. https://www.anthropic.com/news/claude-3- 5-sonnet

    2024

  8. [8]

    Ahmadreza Azizi, Ibrahim Asadullah Tahmid, Asim Waheed, Neal Mangaokar, Jiameng Pu, Mobin Javed, Chandan K Reddy, and Bimal Viswanath. 2021. {T- Miner}: A generative approach to defend against trojan attacks on{DNN-based} text classification. In30th USENIX Security Symposium (USENIX Security 21). 2255– 2272

    2021

Show all 93 references
  1. [9]

    Tara Baldacchino, Elizabeth J Cross, Keith Worden, and Jennifer Rowson. 2016. Variational Bayesian mixture of experts models and sensitivity analysis for non- linear dynamical systems. Mechanical Systems and Signal Processing 66 (2016), 178–200

    2016

  2. [10]

    Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. 2020. Language models are few-shot learners. Advances in neural information processing systems 33 (2020), 1877–1901

    2020

  3. [11]

    Weilin Cai, Juyong Jiang, Fan Wang, Jing Tang, Sunghun Kim, and Jiayi Huang

  4. [12]

    Tadeusz Caliński and Jerzy Harabasz. 1974. A dendrite method for cluster analysis. Communications in Statistics-theory and Methods 3, 1 (1974), 1–27

    1974

  5. [13]

    Xiaoyi Chen, Yinpeng Dong, Zeyu Sun, Shengfang Zhai, Qingni Shen, and Zhong- hai Wu. 2022. Kallima: A clean-label framework for textual backdoor attacks. In European Symposium on Research in Computer Security . Springer, 447–466

    2022

  6. [14]

    Jing Cui, Yufei Han, Yuzhe Ma, Jianbin Jiao, and Junge Zhang. 2024. Badrl: Sparse targeted backdoor attack against reinforcement learning. In Proceedings of the AAAI Conference on Artificial Intelligence , Vol. 38. 11687–11694

    2024

  7. [15]

    Damai Dai, Chengqi Deng, Chenggang Zhao, Rx Xu, Huazuo Gao, Deli Chen, Jiashi Li, Wangding Zeng, Xingkai Yu, Y Wu, et al . 2024. DeepSeekMoE: To- wards Ultimate Expert Specialization in Mixture-of-Experts Language Models. In Proceedings of the 62nd Annual Meeting of the Associ...

    2024

  8. [16]

    Jiazhu Dai, Chuanshuai Chen, and Yufeng Li. 2019. A backdoor attack against lstm-based text classification systems. IEEE Access 7 (2019), 138872–138878

    2019

  9. [17]

    Nan Du, Yanping Huang, Andrew M Dai, Simon Tong, Dmitry Lepikhin, Yuanzhong Xu, Maxim Krikun, Yanqi Zhou, Adams Wei Yu, Orhan Firat, et al

  10. [18]

    Wei Du, Peixuan Li, Boqun Li, Haodong Zhao, and Gongshen Liu. 2023. Uor: Universal backdoor attacks on pre-trained language models. arXiv preprint arXiv:2305.09574 (2023)

    2023 arXiv

  11. [19]

    Bogdan Gliwa, Iwona Mochol, Maciej Biesek, and Aleksander Wawer. 2019. SAMSum Corpus: A Human-annotated Dialogue Dataset for Abstractive Summa- rization. In Proceedings of the 2nd Workshop on New Frontiers in Summarization . 70–79

    2019

  12. [20]

    Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783 (2024)

    2024 arXiv

  13. [21]

    Naibin Gu, Peng Fu, Xiyu Liu, Zhengxiao Liu, Zheng Lin, and Weiping Wang. 2023. A gradient control method for backdoor attacks on parameter-efficient tuning. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) . 3508–3520

    2023

  14. [22]

    Tianyu Gu, Brendan Dolan-Gavitt, and Siddharth Garg. 2017. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv:1708.06733 (2017)

    2017 arXiv

  15. [23]

    Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al . 2025. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning. arXiv preprint arXiv:2501.12948 (2025)

    2025 arXiv

  16. [24]

    Jamie Hayes, Ilia Shumailov, and Itay Yona. 2024. Buffer Overflow in Mixture of Experts. arXiv preprint arXiv:2402.05526 (2024)

    2024 arXiv

  17. [25]

    Yifei He, Yang Liu, Chen Liang, and Hany Hassan Awadalla. 2025. Efficiently Editing Mixture-of-Experts Models with Compressed Experts. arXiv preprint arXiv:2503.00634 (2025)

    2025 arXiv

  18. [26]

    Edward J Hu, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al. 2022. LoRA: Low-Rank Adaptation of Large Language Models. In ICLR

    2022

  19. [27]

    Hai Huang, Zhengyu Zhao, Michael Backes, Yun Shen, and Yang Zhang. 2024. Composite Backdoor Attacks Against Large Language Models. In Findings of the Association for Computational Linguistics: NAACL 2024 . 1459–1472

    2024

  20. [28]

    Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, et al. 2024. Gpt-4o system card. arXiv preprint arXiv:2410.21276 (2024)

    2024 arXiv

  21. [29]

    Robert A Jacobs, Michael I Jordan, Steven J Nowlan, and Geoffrey E Hinton. 1991. Adaptive mixtures of local experts. Neural computation 3, 1 (1991), 79–87

    1991

  22. [30]

    Shashank Mohan Jain. 2022. Hugging face. In Introduction to transformers for NLP: With the hugging face library and models to solve problems . Springer, 51–67

    2022

  23. [31]

    Simon Jegou. 2025. KV cache compression methods. https://github.com/NVIDIA/ kvpress/blob/main/notebooks/expected_attention.ipynb

    2025

  24. [32]

    Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, De- vendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thoma...

    2023 arXiv

  25. [33]

    Albert Q Jiang, Alexandre Sablayrolles, Antoine Roux, Arthur Mensch, Blanche Savary, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Emma Bou Hanna, Florian Bressand, et al . 2024. Mixtral of experts. arXiv preprint arXiv:2401.04088 (2024)

    2024 arXiv

  26. [34]

    Keita Kurita, Paul Michel, and Graham Neubig. 2020. Weight Poisoning Attacks on Pretrained Models. In Proceedings of ACL. 2793–2806

    2020

  27. [35]

    Jiazhao Li, Yijin Yang, Zhuofeng Wu, VG Vinod Vydiswaran, and Chaowei Xiao

  28. [36]

    Linyang Li, Demin Song, Xiaonan Li, Jiehang Zeng, Ruotian Ma, and Xipeng Qiu

  29. [37]

    Yige Li, Hanxun Huang, Yunhan Zhao, Xingjun Ma, and Jun Sun. 2024. Back- doorllm: A comprehensive benchmark for backdoor attacks on large language models. arXiv preprint arXiv:2408.12798 (2024)

    2024 arXiv

  30. [38]

    InProceedings of the 2024 Conference of the North Amer- ican Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers)

    ChatGPT as an Attack Tool: Stealthy Textual Backdoor Attack via Blackbox Generative Model Trigger. InProceedings of the 2024 Conference of the North Amer- ican Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers). 2985–3004

    2024

  31. [39]

    Yanzhou Li, Tianlin Li, Kangjie Chen, Jian Zhang, Shangqing Liu, Wenhan Wang, Tianwei Zhang, and Yang Liu. [n. d.]. BadEdit: Backdooring Large Language Models by Model Editing. In The Twelfth International Conference on Learning Representations

  32. [40]

    Chin-Yew Lin. 2004. Rouge: A package for automatic evaluation of summaries. In Text summarization branches out. 74–81

    2004

  33. [41]

    Yi Lin. 2004. A note on margin-based loss functions in classification. Statistics & probability letters 68, 1 (2004), 73–82. 13 Conference’17, July 2017, Washington, DC, USA Trovato et al

    2004

  34. [42]

    Yiming Li, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. 2022. Backdoor learning: A survey. IEEE transactions on neural networks and learning systems 35, 1 (2022), 5–22

    2022

  35. [43]

    Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. 2018. Fine-pruning: De- fending against backdooring attacks on deep neural networks. In International symposium on research in attacks, intrusions, and defenses . Springer, 273–294

    2018

  36. [44]

    Kuan-Ming Liu and Ming-Chih Lo. 2025. LLM-Based Routing in Mixture of Experts: A Novel Framework for Trading. InAAAI 2025 Workshop on AI for Social Impact

    2025

  37. [45]

    Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. 2018. Trojaning attack on neural networks. In 25th Annual Network And Distributed System Security Symposium (NDSS 2018) . Internet Soc

    2018

  38. [46]

    Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Cheng- gang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, et al. 2024. Deepseek-v3 technical report. arXiv preprint arXiv:2412.19437 (2024)

    2024 arXiv

  39. [47]

    Niklas Muennighoff, Luca Soldaini, Dirk Groeneveld, Kyle Lo, Jacob Morrison, Se- won Min, Weijia Shi, Pete Walsh, Oyvind Tafjord, Nathan Lambert, et al. 2024. Ol- moe: Open mixture-of-experts language models. arXiv preprint arXiv:2409.02060 (2024)

    2024 arXiv

  40. [48]

    Mohammad Naseri, Yufei Han, and Emiliano De Cristofaro. 2024. Badvfl: Back- door attacks in vertical federated learning. In 2024 IEEE Symposium on Security and Privacy (SP). IEEE, 2013–2028

    2024

  41. [49]

    OpenAI. 2024. Hello GPT-4o. https://openai.com/index/hello-gpt-4o/

    2024

  42. [50]

    Saeed Masoudnia and Reza Ebrahimpour. 2014. Mixture of experts: a literature survey. Artificial Intelligence Review 42 (2014), 275–293

    2014

  43. [51]

    Fanchao Qi, Yangyi Chen, Mukai Li, Yuan Yao, Zhiyuan Liu, and Maosong Sun

  44. [52]

    Fanchao Qi, Yangyi Chen, Xurui Zhang, Mukai Li, Zhiyuan Liu, and Maosong Sun. 2021. Mind the Style of Text! Adversarial and Backdoor Attacks Based on Text Style Transfer. InProceedings of the 2021 Conference on Empirical Methods in Natural Language Processing. 4569–4580

    2021

  45. [53]

    Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. [n. d.]. Language models are unsupervised multitask learners. ([n. d.])

  46. [54]

    Keqin Peng, Liang Ding, Qihuang Zhong, Li Shen, Xuebo Liu, Min Zhang, Yuanxin Ouyang, and Dacheng Tao. 2023. Towards making the most of chatgpt for machine translation. arXiv preprint arXiv:2303.13780 (2023)

    2023 arXiv

  47. [55]

    Javier Rando and Florian Tramèr. 2023. Universal jailbreak backdoors from poisoned human feedback. arXiv preprint arXiv:2311.14455 (2023)

    2023 arXiv

  48. [56]

    In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing

    ONION: A Simple and Effective Defense Against Textual Backdoor Attacks. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing. 9558–9566

    2021

  49. [57]

    Avital Shafran, Roei Schuster, Thomas Ristenpart, and Vitaly Shmatikov. 2025. Rerouting LLM Routers. arXiv preprint arXiv:2501.01818 (2025)

    2025 arXiv

  50. [58]

    Guangyu Shen, Yingqi Liu, Guanhong Tao, Qiuling Xu, Zhuo Zhang, Sheng- wei An, Shiqing Ma, and Xiangyu Zhang. 2022. Constrained optimization with dynamic bound-scaling for effective nlp backdoor defense. In International Con- ference on Machine Learning . PMLR, 19879–19892

    2022

  51. [59]

    Pranav Rajpurkar, Robin Jia, and Percy Liang. 2018. Know what you don’t know: Unanswerable questions for SQuAD. arXiv preprint arXiv:1806.03822 (2018)

    2018 arXiv

  52. [60]

    Qiao Sun, Huimin Wang, Jiahao Zhan, Fan Nie, Xin Wen, Leimeng Xu, Kun Zhan, Peng Jia, Xianpeng Lang, and Hang Zhao. 2024. Generalizing motion planners with mixture of experts for autonomous driving. arXiv preprint arXiv:2410.15774 (2024)

    2024 arXiv

  53. [61]

    Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. 2018. Poison frogs! targeted clean-label poisoning attacks on neural networks. Advances in neural information processing systems 31 (2018)

    2018

  54. [62]

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yas- mine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhos- ale, et al. 2023. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288 (2023)

    2023 arXiv

  55. [63]

    Haoran Wang and Kai Shu. 2023. Backdoor activation attack: Attack large language models using activation steering for safety-alignment. arXiv preprint arXiv:2311.09433 (2023)

    2023 arXiv

  56. [64]

    Richard Socher, Alex Perelygin, Jean Wu, Jason Chuang, Christopher D Manning, Andrew Y Ng, and Christopher Potts. 2013. Recursive deep models for semantic compositionality over a sentiment treebank. In EMNLP. 1631–1642

    2013

  57. [65]

    Wenhui Wang, Hangbo Bao, Shaohan Huang, Li Dong, and Furu Wei. 2021. MiniLMv2: Multi-Head Self-Attention Relation Distillation for Compressing Pre- trained Transformers. In Findings of the Association for Computational Linguistics: ACL-IJCNLP 2021. 2140–2151

    2021

  58. [66]

    Jianwen Tian, Kefan Qiu, Debin Gao, Zhi Wang, Xiaohui Kuang, and Gang Zhao

  59. [67]

    Haojun Xia, Zhen Zheng, Yuchao Li, Donglin Zhuang, Zhongzhu Zhou, Xiafei Qiu, Yong Li, Wei Lin, and Shuaiwen Leon Song. 2023. Flash-LLM: Enabling Cost-Effective and Highly-Efficient Large Generative Model Inference with Un- structured Sparsity. Proceedings of the VLDB Endowmen...

    2023

  60. [68]

    Haoran Xu, Amr Sharaf, Yunmo Chen, Weiting Tan, Lingfeng Shen, Benjamin Van Durme, Kenton Murray, and Young Jin Kim. 2024. Contrastive Preference Op- timization: Pushing the Boundaries of LLM Performance in Machine Translation. In International Conference on Machine Learning ....

    2024

  61. [69]

    Jingyu Xu and Yang Wang. 2024. Enhancing Healthcare Recommendation Systems with a Multimodal LLMs-based MOE Architecture. arXiv preprint arXiv:2412.11557 (2024)

    2024 arXiv

  62. [70]

    Qingyue Wang, Liang Ding, Yanan Cao, Zhiliang Tian, Shi Wang, Dacheng Tao, and Li Guo. 2023. Recursively summarizing enables long-term dialogue memory in large language models. arXiv preprint arXiv:2308.15022 (2023)

    2023 arXiv

  63. [71]

    Jun Yan, Vansh Gupta, and Xiang Ren. 2023. BITE: Textual Backdoor Attacks with Iterative Trigger Injection. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) . 12951–12968

    2023

  64. [72]

    Zihan Wang, Deli Chen, Damai Dai, Runxin Xu, Zhuoshu Li, and Yu Wu. 2024. Let the Expert Stick to His Last: Expert-Specialized Fine-Tuning for Sparse Ar- chitectural Large Language Models. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processin...

    2024

  65. [73]

    Wenkai Yang, Yankai Lin, Peng Li, Jie Zhou, and Xu Sun. 2021. RAP: Robustness- Aware Perturbations for Defending against Backdoor Attacks on NLP Models. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing. 8365–8381

    2021

  66. [74]

    Yuchen Yang, Bo Hui, Haolin Yuan, Neil Gong, and Yinzhi Cao. 2024. Sneakyprompt: Jailbreaking text-to-image generative models. In 2024 IEEE sym- posium on security and privacy (SP) . IEEE, 897–912

    2024

  67. [75]

    Zihao Yi, Jiarui Ouyang, Yuwen Liu, Tianhao Liao, Zhe Xu, and Ying Shen. 2024. A survey on recent advances in llm-based multi-turn dialogue systems. arXiv preprint arXiv:2402.18013 (2024)

    2024 arXiv

  68. [76]

    Fuzhao Xue, Zian Zheng, Yao Fu, Jinjie Ni, Zangwei Zheng, Wangchunshu Zhou, and Yang You. 2024. OpenMoE: an early effort on open mixture-of-experts language models. In Proceedings of the 41st International Conference on Machine Learning. 55625–55655

    2024

  69. [77]

    Zhiyuan Yu, Xiaogeng Liu, Shunning Liang, Zach Cameron, Chaowei Xiao, and Ning Zhang. 2024. Don’t listen to me: understanding and exploring jailbreak prompts of large language models. In 33rd USENIX Security Symposium (USENIX Security 24). 4675–4692

    2024

  70. [78]

    Wenkai Yang, Lei Li, Zhiyuan Zhang, Xuancheng Ren, Xu Sun, and Bin He. 2021. Be Careful about Poisoned Word Embeddings: Exploring the Vulnerability of the Embedding Layers in NLP Models. In Proceedings of the 2021 Conference of the North American Chapter of the Association for...

    2021

  71. [79]

    Rui Zhang, Hongwei Li, Rui Wen, Wenbo Jiang, Yuan Zhang, Michael Backes, Yun Shen, and Yang Zhang. 2024. Instruction backdoor attacks against customized {LLMs}. In 33rd USENIX Security Symposium (USENIX Security 24) . 1849–1866

    2024

  72. [80]

    Xinyang Zhang, Zheng Zhang, Shouling Ji, and Ting Wang. 2021. Trojaning language models for fun and profit. In2021 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE, 179–197

    2021

  73. [81]

    Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015. Character-level convolutional networks for text classification. Advances in neural information processing systems 28 (2015)

    2015

  74. [82]

    Itay Yona, Ilia Shumailov, Jamie Hayes, and Nicholas Carlini. 2024. Stealing User Prompts from Mixture of Experts. arXiv preprint arXiv:2410.22884 (2024)

    2024 arXiv

  75. [83]

    Xukun Zhou, Jiwei Li, Tianwei Zhang, Lingjuan Lyu, Muqiao Yang, and Jun He. 2024. Backdoor attacks with input-unique triggers in nlp. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases . Springer, 296–312

    2024

  76. [84]

    Alexey Zagalsky, Joseph Feliciano, Margaret-Anne Storey, Yiyun Zhao, and Weil- iang Wang. 2015. The emergence of github as a collaborative platform for educa- tion. In Proceedings of the 18th ACM conference on computer supported cooperative work & social computing . 1906–1917

    2015

  77. [85]

    Tong Zhu, Xiaoye Qu, Daize Dong, Jiacheng Ruan, Jingqi Tong, Conghui He, and Yu Cheng. 2024. Llama-moe: Building mixture-of-experts from llama with continual pre-training. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing . 15913–15923

    2024

  78. [86]

    Xunyu Zhu, Jian Li, Yong Liu, Can Ma, and Weiping Wang. 2024. A Survey on Model Compression for Large Language Models. Transactions of the Association for Computational Linguistics 12 (2024), 1556–1577

    2024

  79. [87]

    Deserate

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043 (2023). A Ethical Considerations While our research explores the vulnerabili...

    2023 arXiv

  80. [88]

    Yaowei Zheng. 2023. Fine-tuning toolkit for Mixtral 8x7B MoE model. https: //huggingface.co/mistralai/Mixtral-8x7B-v0.1/discussions/10

    2023

  81. [90]

    Yanqi Zhou, Tao Lei, Hanxiao Liu, Nan Du, Yanping Huang, Vincent Zhao, An- drew M Dai, Quoc V Le, James Laudon, et al . 2022. Mixture-of-experts with expert choice routing. Advances in Neural Information Processing Systems 35 (2022), 7103–7114

    2022

  82. [2021]

    In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing

    Backdoor Attacks on Pre-trained Models by Layerwise Weight Poisoning. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing. 3023–3032

    2021

  83. [2022]

    In International conference on machine learning

    Glam: Efficient scaling of language models with mixture-of-experts. In International conference on machine learning . PMLR, 5547–5569

  84. [2023]

    In 32nd USENIX Security Symposium (USENIX Security 23)

    Sparsity brings vulnerabilities: exploring new metrics in backdoor attacks. In 32nd USENIX Security Symposium (USENIX Security 23) . 2689–2706

  85. [2024]

    arXiv preprint arXiv:2407.06204 (2024)

    A survey on mixture of experts. arXiv preprint arXiv:2407.06204 (2024)

    2024 arXiv

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.