How Vulnerable Are Edge LLMs?

Ao Ding; Hongzong Li; Zi Liang; Zhanpeng Shi; Shuxin Zhuang; Shiqin Tang; Rong Feng; Ping Lu

cs.CRMar 25, 2026

How Vulnerable Are Edge LLMs?

Authors: Ao Ding, Hongzong Li, Zi Liang, Zhanpeng Shi, Shuxin Zhuang, Shiqin Tang, Rong Feng, Ping Lu

Organizations: China University of Geoscience Beijing · Hong Kong University of Science and Technology · Hong Kong Polytechnic University · Jilin University ·

Abstract

Large language models (LLMs) are increasingly deployed on edge devices under strict computation and quantization constraints, yet their security implications remain unclear. We study query-based knowledge extraction from quantized edge-deployed LLMs under realistic query budgets and show that, although quantization introduces noise, it does not remove the underlying semantic knowledge, allowing substantial behavioral recovery through carefully designed queries. To systematically analyze this risk, we propose CLIQ (Clustered Instruction Querying), a structured query construction framework that improves semantic coverage while reducing redundancy. Experiments on quantized Qwen models (INT8/INT4) demonstrate that CLIQ consistently outperforms original queries across BERTScore, BLEU, and ROUGE, enabling more efficient extraction under limited budgets. These results indicate that quantization alone does not provide effective protection against query-based extraction, highlighting a previously underexplored security risk in edge-deployed LLMs.

Figures & tables

Figure 1: Overview of the proposed framework for query-based knowledge extraction from edge-deployed quantized LLMs. Previous approaches (blue) rely on unstructured queries, which often lead to redundant probing and noisy responses, resulting in low-fidelity reconstruction of model behavior. CLIQ (red) performs structured query construction to produce more informative responses under a limited query budget, enabling high-fidelity student reconstruction of the edge model behavior.

Figure 2: Threat framework for query-based knowledge extraction from quantized edge-deployed LLMs. Traditional extraction settings (top) assume full-precision teacher models in high-performance server environments, where abundant compute allows large-scale query probing. In contrast, edge-deployed LLMs (bottom) operate under quantization (e.g., INT4/INT8) and strict resource constraints, resulting in limited query budgets and noisy responses. Nevertheless, carefully structured queries can still recover substantial behavioral knowledge from the quantized model.

Model	BERT-F1	R1	RL	BLEU
Qwen2.5-7B (FP16)	84.51	20.93	14.87	2.81
Qwen2.5-7B (GPTQ-INT4)	84.27	20.79	14.69	2.77
Qwen3-1.7B (FP16)	81.24	19.45	13.72	2.49
Qwen3-1.7B (GPTQ-INT4)	80.98	19.27	13.56	2.43

Table 1: Effect of GPTQ-based quantization on teacher model performance. Quantization introduces only marginal degradation across all metrics.All scores are reported in percentage (%).

Method	BERT-F1	BLEU	RLsum
Original Queries	77.97	1.05	13.37
CLIQ (Ours)	84.35	2.77	17.50

Table 2: Main distillation results on INT8-quantized 1.7B student models.All scores are reported in percentage (%).

Figure 3: Effect of training steps under a fixed query budget (500 queries) across three student models. We report BERT-F1, BLEU, and ROUGE-L, and include the 0-step base model as initialization. CLIQ (ours) consistently outperforms OQ and exhibits diminishing returns after

\sim

200–300 steps.

Quant.	Query	Steps	BERT-F1	BLEU	ROUGE-L
INT4	Original	100	80.32	1.55	13.83
		300	80.44	1.49	14.12
		500	80.03	1.42	13.41
	CLIQ	100	78.20	1.08	12.45
		300	82.86	2.56	14.22
		500	82.92	2.55	14.54

Table 3: Effect of training steps under different quantization settings. CLIQ shows consistent improvements from 100 to 300 steps, while Original queries exhibit minimal gains.

Panel of Figure 4 — Figure 4: Effect of query budget on distillation performance. CLIQ exhibits rapid gains as the number of queries increases from 100 to 300, followed by diminishing returns, while Original Queries show minimal improvement.

Query Strategy	INT8	INT4
OQ	80.08	80.03
CLIQ (ours)	82.74	82.92

Table 4: Effect of quantization on different query construction strategies using a 1.8B edge-oriented student model.

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Component	Setting
Sentence encoder	sentence-transformers/all-MiniLM-L6-v2
Max length	512
Embedding batch size	64
Pooling	mean pooling w/ attention mask
Normalization	$\ell_{2}$ normalization
Clustering algorithm	MiniBatchKMeans

Appendix

Table 5: Hyperparameters for clustering and cluster-aware query generation.

Panel of Figure 5 — Figure 5: Effect of training steps under a fixed query budget (500 queries). CLIQ(ours) yields consistent gains over OQ and shows diminishing returns after $\sim$ 200–300 steps.

Dataset	Clusters	Queries	BERT-F1	BLEU	ROUGE-1	ROUGE-2	ROUGE-L	ROUGE-Lsum
Dolly	25	4	81.384	2.092	17.905	6.196	12.089	14.402
	25	8	82.272	2.325	18.325	6.263	12.397	14.686
	25	10	82.267	2.473	18.546	6.258	12.550	15.017
	50	4	82.558	2.643	18.335	6.377	12.258	14.825
	50	10	82.345	2.608	18.399	6.268	12.500	14.818
	100	8	78.707	1.476	16.895	5.895	11.298	13.499

Appendix

Table 7: Additional ablation results on clustering granularity and query budget on a 4B model quantized by int4. We vary the number of semantic clusters and the number of generated queries per cluster, and report instruction-following performance on Dolly and Alpaca. All scores are reported in percentage (%).

Figure 6: Histogram of query counts per cluster under a fixed query budget. Random sampling from original queries results in highly imbalanced cluster coverage, whereas CLIQ produces a near-uniform allocation across clusters, avoiding over-sampling of dense regions.

Figure 7: Cluster hit rate as a function of query budget. We measure the number of semantic clusters covered by at least one query under increasing query budgets. Compared with random sampling from the original query pool (OQ), CLIQ achieves substantially higher cluster coverage in the low-budget regime and reaches near-complete coverage with fewer queries. This indicates that CLIQ allocates queries more efficiently across semantic clusters, particularly when the query budget is limited.

Figure 8: Intra-cluster redundancy measured by average pairwise cosine similarity within each semantic cluster. Original queries (OQ) exhibit significantly higher intra-cluster similarity, indicating strong redundancy and overlapping supervision signals. In contrast, CLIQ-generated queries reduce redundancy by promoting greater diversity within clusters, which explains the improved sensitivity of CLIQ-trained models to increased training steps and optimization.

Figure 9: Distribution of cosine distances between queries and their corresponding cluster centroids. CLIQ-generated queries span a wider range of distances, covering both central and peripheral regions of each cluster. This indicates that CLIQ does not collapse queries to cluster prototypes, but preserves structured intra-cluster diversity while maintaining semantic coherence.

Figure 10: UMAP visualization of query coverage under different CLIQ configurations. The original query pool (OQ) exhibits dense and redundant regions, while CLIQ-generated queries maintain broader and more uniform semantic coverage under fixed query budgets. Different combinations of cluster numbers and queries per cluster illustrate how CLIQ controls coverage granularity.

Figure 11: Cluster-conditioned semantic projections of original queries (OQ) and CLIQ-generated queries (GQ). Each subfigure corresponds to one semantic cluster $c$ . Blue points denote original queries in the cluster, while orange points denote generated queries. Only $m=5$ generated queries per cluster are visualized to illustrate the query efficiency of CLIQ.

LLM Security

Large language model (LLM) security studies attacks, privacy risks, and defenses across model training, inference, and deployment.

See all 322 papers

Securing LLMs in the Wild: Privacy and Security Challenges at the Edge
Jul 13, 2026Ren-Yi Huang, Mingchen Li, Dumindu Samaraweera +1LLM Inference Efficiency Edge Computing
Department of Electrical and Computer Engineering, University of South Florida · Department of Mathematics, Embry-Riddle Aeronautical University
MOMAT: Mixture of Multiple Atlases for Low-Power Jailbreak Defense of Quantized LLMs
Oct 1, 2026Boyang Li, Bingyu Shen, Weihao Hong +6Retrieval-Augmented Generation LLM Safety
Department of Computer Science, Kean University, 1000 Morris Ave, Union, 07083, NJ, USA · Department of Computer Science and Engineering, University of Notre Dame, 257 Fitzpatrick Hall of Engineering, Notre Dame, 46556, IN, USA · McGill University, 845 Sherbrooke Street, Montréal, H3A 0G4, Québec, Canada +2
Widening the Gap: Exploiting LLM Quantization via Outlier Injection
May 14, 2026Xiaohua Zhan, Kazuki Egashira, Robin Staab +2LLM Quantization LLM Backdoor Attacks
ETH Zurich

Jul 13, 2026J/K move · Enter open · S save

Securing LLMs in the Wild: Privacy and Security Challenges at the Edge

Ren-Yi Huang, Mingchen Li, Dumindu Samaraweera, Morris Chang

Department of Electrical and Computer Engineering, University of South Florida · Department of Mathematics, Embry-Riddle Aeronautical University

LLM Inference Efficiency Edge Computing Privacy Leakage in Language Models LLM Security LLM Safety

Open paper AskPDF arXiv

Large Language Models (LLMs) are rapidly moving from research settings into the wild, deployed on enterprise infrastructure, personal devices, and edge platforms. While cloud deployments offer scalable compute, concerns over data sovereignty, compliance, latency, and third-party dependence are driving organizations toward edge and on-premise LLMs. This shift introduces new security and privacy challenges: limited compute and memory force aggressive optimizations, including quantization, pruning, model partitioning, and parameter-efficient adaptation, each of which can introduce vulnerabilities and reshape the threat landscape. We describe this tension as the Security-Efficiency Paradox, mechanisms that improve efficiency may weaken robustness, expose new attack surfaces, or increase privacy risks. We examine how compression can degrade safety alignment, how partitioned inference enables reconstruction attacks, and how continuous local adaptation may cause privacy leakage and model drift. To analyze these risks, we introduce a deployment-centric taxonomy organized around three architectural constraints: the Memory Wall, the Quadratic Wall, and the Compute Wall. We derive a unified constraint model that quantifies when unsafe optimizations become unavoidable, linking each wall to specific attack surfaces. Building on this model, we propose the Secure Operational Efficiency Score (SOES), a holistic metric balancing task accuracy, jailbreak resistance, and privacy against energy, memory, and latency, enabling practitioners to configure edge LLMs under real-world hardware limits. We further present a practical decision procedure and targeted mitigations for each optimization-induced vulnerability. Together, these contributions provide a co-designed framework for jointly evaluating security, privacy, and efficiency, laying a foundation for securing edge-native intelligent systems.

Abstract

LLM Security

Explore similar work

Securing LLMs in the Wild: Privacy and Security Challenges at the Edge

MOMAT: Mixture of Multiple Atlases for Low-Power Jailbreak Defense of Quantized LLMs

Widening the Gap: Exploiting LLM Quantization via Outlier Injection