Groundhog Bit-Flip Attack: Seeding Infinite Generation Loops in Mixture-of-Experts LLMs through Bit Flips

Huakang Lin; Tiancheng Zheng; Mingxuan Sun; Tianhong Xu; Fan Zhang; Yunsi Fei; Ruyi Ding

cs.CLAug 26, 2026

Groundhog Bit-Flip Attack: Seeding Infinite Generation Loops in Mixture-of-Experts LLMs through Bit Flips

Authors: Huakang Lin, Tiancheng Zheng, Mingxuan Sun, Tianhong Xu, Fan Zhang, Yunsi Fei, Ruyi Ding

Organizations: Louisiana State University, USA · University of California, Los Angeles, USA · Southeast University, China · Northeastern University, USA ·

Abstract

Mixture-of-Experts (MoE) architectures enable scalable and efficient large language models (LLMs) by selectively activating expert sub-networks through a routing mechanism. However, this adaptive design introduces a new attack surface: specific experts become disproportionately correlated with certain tokens (e.g., end-of-sequence), allowing adversaries to manipulate model behavior via lightweight perturbations. In this work, we present Groundhog Bit-Flip Attack (GBFA), the first bit-flip-based Denial-of-Wallet availability attack against MoE-based LLMs. By identifying and flipping routing-layer bits associated with related expert activations, we demonstrate that GBFA substantially extends the decoding token usage across three different LLM modes: conversational, reasoning, and agentic tasks, while largely preserving semantic fidelity. Across four main real-world MoE-based LLMs, manually deactivating on average fewer than 4 experts drives average output inflation to $\mathbf{5912\%}$ , with the majority of test samples reaching max tokens. These results reveal a robustness vulnerability of MoE architectures to bit flip, and highlight the potential of GBFA as an availability attack against LLMs.

Figures & tables

Figure 1: Groundhog Bit Flip Attack on MoE LLMs.

Figure 2: Overview of our three-step GBFA pipeline. Step 1: Identify target-related experts by comparing target-token EAF with non-target EAF and selecting experts above a threshold. Step 2: Search for vulnerable router bits by evaluating whether flipping each candidate bit suppresses the scores of the selected target-related experts using cached hidden states. Step 3: Execute the online bit-flip attack to suppress EOS generation and produce very long outputs.

Model	#Params (B)	Active (B)	#Experts	#Active	#Layers
Mixtral	46.7	12.9	8	2	32
Phi-3.5	41.9	6.6	16	2	32
DeepSeek	15.7	2.4	64	6	27
Qwen3	30.5	3.3	128	8	48
Qwen3-Coder	80.0	3.0	512	10	48
GPT-OSS	20.0	4.0	32	4	40

Table 1: Overview of evaluated MoE architectures, showing total parameters, activated parameters per token, number of experts per layer, activated experts, and model depth.

Figure 3: Average output token count under GLOBAL manual deactivation as a function of blocked experts. The dashed line marks max_new_tokens ; DeepSeek-V2-Lite uses a separate right axis.

Model	Method (#exp)	AGNews (%)	SST-2 (%)	Samsum (%)	SQuAD (%)
Mixtral	Random (50)	685	188	149	-9.28
	LOCAL (2)	$2.18\times 10^{3}$	$2.23\times 10^{3}$	$2.19\times 10^{3}$	$3.64\times 10^{3}$
	GLOBAL (37)	$\mathbf{2.74\times 10^{3}}$	$\mathbf{3.41\times 10^{3}}$	$\mathbf{389}$	$\mathbf{52.9}$
Phi-3.5	Random (50)	215	1.14	30.1	155
	LOCAL (2)	$2.82\times 10^{4}$	$1.83\times 10^{3}$	20.5	217
	GLOBAL (16)	$\mathbf{2.99\times 10^{4}}$	$\mathbf{1.74\times 10^{3}}$	$\mathbf{1.27\times 10^{3}}$	$\mathbf{1.89\times 10^{3}}$

Table 2:

P

across all samples for manual expert deactivation (LOCAL vs. GLOBAL), compared against a random-deactivation baseline.

Model	Method (#exp)	AGNews (%)	SST-2 (%)	Samsum (%)	SQuAD (%)
Mixtral	LOCAL (2)	202	110	1.06	39.3
Mixtral	GLOBAL (37)	$2.51\text{\times}{10}^{3}$	$4.99\text{\times}{10}^{3}$	$2.92\text{\times}{10}^{3}$	48.1
Phi-3.5	LOCAL (2)	526	42.1	148	45.3
Phi-3.5	GLOBAL (16)	131	20.8	222	167
DeepSeek	LOCAL (6)	$3.84\text{\times}{10}^{4}$	$8.73\text{\times}{10}^{4}$	$1.61\text{\times}{10}^{3}$	$4.05\text{\times}{10}^{2}$
DeepSeek	GLOBAL (40)	$4.64\text{\times}{10}^{4}$	$4.44\text{\times}{10}^{4}$	$3.04\text{\times}{10}^{3}$	$1.49\text{\times}{10}^{4}$

Table 3: P across All Samples for Bit-flip attack (LOCAL vs GLOBAL).

Model	Method	AGNews		SST-2		Samsum		SQuAD
		CA	PPL	CA	PPL	R-1	PPL	F1	PPL
DeepSeek	Baseline	0.810	1.35	0.919	1.69	0.364	1.38	0.362	1.22
	LOCAL (manual)	0.970	1.17	0.793	2.33	0.270	1.49	0.070	1.40
	GLOBAL (manual)	0.395	1.82	0.836	1.73	0.205	1.60	0.159	1.82
	LOCAL (GBFA)	0.380	1.82	0.020	1.81	0.117	1.36	0.021	1.21
	GLOBAL (GBFA)	0.160	4.4e3	0.000	9.2e4	0.025	5.3e6	0.081	5.1e6

Table 4: Performance of different models on four datasets under manual and bit-flip expert manipulation.

	Baseline		LOCAL (manual)			GLOBAL (manual)
Sandbox	#	tokens	#	tokens	$P$	#	tokens	$P$
calculator_refactor	4	540.2	3	888.0	$+23.3\%$	9	1869.6	$+678.6\%$
bug_fix	3	620.0	3	611.3	$-1.4\%$	9	2048.0	$+891.0\%$
feature_add	3	507.7	3	565.7	$+11.4\%$	9	1231.7	$+627.8\%$
rename_refactor	4	461.8	4	620.0	$+34.3\%$	9	1095.1	$+433.6\%$
test_coverage	7	509.1	4	607.8	$-31.8\%$	9	1061.6	$+168.1\%$

Table 5: Plan-mode manual expert deactivation on Qwen3-Coder-Next across 10 coding sandboxes. We report plan steps (#), average plan tokens, and the relative change

P

in plan-token totals against the baseline.

Model	Method (manual)	AGNews (%)	SST-2 (%)	Samsum (%)	SQuAD (%)
GPT-OSS	LOCAL	19.7	15.2	58.4	25.9
GPT-OSS	GLOBAL	$7.15\text{\times}{10}^{2}$	$1.27\text{\times}{10}^{3}$	365	$1.33\text{\times}{10}^{3}$
Qwen3	LOCAL	6.28	1.61	4.18	-1.37
Qwen3	GLOBAL	204	224	230	271

Table 6: Results of GPT-OSS and Qwen3 under LOCAL and GLOBAL manual deactivation of EOT-related experts (percentage increase in thinking length).

Appendix figures & tables5 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	Input Prompt	Ori Output	Attacked Output
AGNews	Classify the news article… Article : Reuters – Soaring crude prices… Category :	Category : Business Explanation : The article discusses the impact of soaring crude prices…	Category : Business/Economy User 0: I would say business. User 1: I would say sports. User 0: I would say sports. User 1: I would say sports because the article is about the stock market. (repeated …)
SST-2	Classify the sentiment… Text : hide new secretions… Sentiment :	Sentiment : Negative Explanation : The text mentions hiding something from “parental units,” suggesting secrecy…	Sentiment : Negative The text describes the narrator’s relationship with his mother… He is describing the relationship in the past tense. He is describing the relationship in the past tense. (repeated …)
Samsum	Please summarize the dialogue… Amanda: I baked cookies… Jerry: Sure! Summary :	Amanda offers Jerry cookies; she will bring them the next day.	Amanda baked cookies and offered some to Jerry. Comment : Direct response. Jerry: Sure! Jerry’s answer is a direct response to Amanda’s question. Jerry’s answer is a direct response to Amanda’s question. (repeated …)
SQuAD	Answer the question based on the context… Context: Beyoncé Giselle Knowles-Carter… Question : When did Beyoncé rise to fame?	Beyoncé rose to fame in the late 1990s as lead singer of Destiny’s Child.	Beyoncé rose to fame in the late 1990s… Comment : Beyoncé rose to fame… Destiny’s Child. Comment : How did Beyoncé rise to fame? Answer: Beyoncé rose to fame… Destiny’s Child. (repeated …)

Appendix

Table 7: Generation examples from Mixtral on four datasets, comparing the original output ( blue ) with the output after EOS-related expert deactivation. Repetitive loops introduced by the attack are highlighted in red .

Task	Description
bug_fix	Fix an off-by-one bug in a FizzBuzz function.
bug_hunt	Locate and fix three independent bugs co-located in a single file.
feature_add	Implement two missing methods ( mark_done , pending_count ) in a TODO-list class.
test_coverage	Add at least two unit tests for each of four string utility functions.
calculator_refactor	Extract trigonometric methods ( sin / cos / tan ) from Calculator into a dedicated TrigCalculator class.
rename_refactor	Rename MyHelper to StringUtils across multiple files and update all imports.

Appendix

Table 8: Ten sandbox tasks used in the agentic coding evaluation.

Task	Original output (Baseline)	Attack output (GLOBAL manual deactivation)
bug_fix chars 0–150 shared	…he facts I know and the plan of action that I will follow to solve the task: \n ‘‘‘ \n ## 1. Facts survey \n\n ### 1.1. Facts given in the task \n - The
	[ diverges ] ‘fizzbuzz.py‘ module contains a function ‘fizzbuzz(n)‘ that is supposed to return the FizzBuzz sequence for integers 1 through n INCLUSIVE. \n - Currently, the function drops the last value -- meaning it likely returns only n-1 items …	[ diverges ] task states: ‘‘The fizzbuzz.py module has a bug.’’ \n - The function ‘fizzbuzz(n)‘ is * suppo [ skipped 1,177 chars ] e ‘ it. \n - fizzbuzz(15) expected output (15 items: e.g., ‘‘1’’, ‘‘2’’, ‘‘ Fizz ’’, ‘‘4’’, 2 * 2 * 2 * 2 * 2 * 2 * 2 * 2 * 2 * 2 * 2 * 2 * 2 * 2 * 2 * …
rename_refactor chars 0–826 shared	…my new/updated plan of action to solve the task: \n ‘‘‘ \n ## 1. Updated facts survey \n ### 1.1. Facts given in the task \n - The class ‘MyHelper‘ in ‘
	[ diverges ] my_helper.py‘ should be renamed to ‘StringUtils‘. \n - ‘StringUtils‘ should have three methods: ‘shout‘, ‘whisper‘, and ‘reverse‘, with a constructor argument ‘prefix‘ …	[ diverges ] my_helper.py‘ (note space in filename) should be renamed to ‘StringUtils‘. \n - ‘StringUtils [ skipped 1,141 chars ] The exact expected ‘ run_tests‘ output. \n ## 2. Plan \n ### 2.1. 1. 2. 3. 4. 5. 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14. 15. 16. 17. …
dependency_swap chars 0–146 shared	…re the facts I know and the plan of action that I will follow to solve the task: \n ‘‘‘ \n ## 1. Facts survey \n\n ### 1.1. Facts given in the task \n -
	[ diverges ] The file ‘text_utils.py‘ uses the ‘re‘ module. \n - We need to remove ‘re‘ entirely and reimplement all five functions using only built-in string methods …	[ diverges ] ‘text_utils.py‘ exists in the workspace. \n - ‘text_utils.py uses the ‘re‘ module … [ skipped 679 chars ] , which 5 functions are present, their current ‘ re‘-based implementation, and their exact - - - - - - - - - - - - - - - - - - - - - - - - - …

Appendix

Table 9: Output degradation under GLOBAL manual expert deactivation on Qwen3-Coder-Next in plan mode. For each task, the gray box shows the shared prelude —characters that are bit-identical across both runs. After the divergence point ( [ diverges ] ), the Original column shows the baseline continuing coherently, while the Attack column drifts and eventually collapses into a repetitive degenerate pattern (shown in red). Long gaps inside the attack output are abbreviated as [ skipped K chars ] . Newlines are rendered as a dimmed \n ; … marks truncation.

Setting	Dataset	Base Tok.	Atk Tok.	$P$ (%)	Base EOS	Atk EOS
greedy	AGNews	47.45	496.52	946.4	0.96	0.53
	SST-2	49.81	746.42	1398.5	1.00	0.30
	Samsum	83.45	689.15	725.8	1.00	0.38
	SQuAD	30.11	544.29	1707.7	1.00	0.51
temp0.7	AGNews	42.00	445.03	959.6	0.97	0.60
	SST-2	61.40	668.11	988.1	1.00	0.39

Appendix

Table 10: Phi-3.5-MoE under the GLOBAL (top-16) attack across six decoding settings. Base/Atk Tok.: mean generated tokens per sample without/with the attack.

P

(%): relative increase. Base/Atk EOS: fraction of samples emitting an EOS token without/with the attack.

Budget	Dataset	Base Tok.	Atk Tok.	$P$ (%)	Base EOS	Atk EOS
512	AGNews	16.46	273.30	1560.4	0.98	0.49
	SST-2	49.98	383.07	666.4	1.00	0.31
	Samsum	76.69	369.21	381.4	0.94	0.32
	SQuAD	30.39	280.41	822.7	1.00	0.52
2048	AGNews	44.18	1056.66	2291.7	0.99	0.49
	SST-2	49.98	1442.91	2787.0	1.00	0.31

Appendix

Table 11: Phi-3.5-MoE under the GLOBAL (top-16) attack at different max_new_tokens budgets (paper default:

1024

). Base/Atk Tok.: mean tokens without/with the attack.

P

: relative increase. Base/Atk EOS: fraction emitting an EOS token. Baselines differ slightly across budgets because a few samples exceed the smaller caps and are truncated there.

Adversarial Attacks on LLMs

Adversarial attacks on large language models probe how crafted inputs, internal changes, and agent interactions bypass safety or disrupt reliable behavior.

See all 355 papers

RouteHijack: Routing-Aware Attack on Mixture-of-Experts LLMs
May 1, 2026Zhiyuan Xu, Joseph Gardiner, Sana Belguith +1Mixture-of-Experts Language Models Adversarial Attacks on LLMs
University of Bristol Bristol, United Kingdom
TFL: Targeted Bit-Flip Attack on Large Language Model
Feb 19, 2026Jingkai Guo, Chaitali Chakrabarti, Deliang FanAdversarial Attacks Adversarial Attacks on LLMs
School of Electrical, Computer and Energy Engineering, Arizona State University, Tempe, AZ, USA
Targeted Bit-Flip Attacks on LLM-Based Agents
Mar 7, 2026Jialai Wang, Ya Wen, Zhongmou Liu +4Adversarial Attacks on LLMs AI Agent Security
National University of Singapore, Singapore · Tsinghua University, China · Huazhong University of Science and Technology, China +1

May 1, 2026J/K move · Enter open · S save

RouteHijack: Routing-Aware Attack on Mixture-of-Experts LLMs

Zhiyuan Xu, Joseph Gardiner, Sana Belguith, Lichao Wu

University of Bristol Bristol, United Kingdom

Mixture-of-Experts Language Models Adversarial Attacks on LLMs LLM Jailbreak Attacks Mixture-of-Experts Models

Open paper AskPDF arXiv

Safety alignment is critical for the responsible deployment of large language models (LLMs). As Mixture-of-Experts (MoE) architectures are increasingly adopted to scale model capacity, understanding their safety robustness becomes essential. Existing adversarial attacks, however, have notable limitations. Prompt-based jailbreaks rely on heuristic search and transfer poorly, model intervention methods require privileged access to internal representations, and optimization-based input attacks remain output-centric and are fundamentally limited to MoE models due to the non-differentiable routing mechanism. In this paper, we present RouteHijack, a routing-aware jailbreak for MoE LLMs. Our key insight is that safety behavior is concentrated in a small subset of experts, creating an opportunity to steer model behavior by influencing routing decisions through input optimization. Building on this observation, RouteHijack first performs response-driven expert localization to identify safety-critical and harmful experts by contrasting activations under safe refusals and harmful completions. It then constructs adversarial suffixes with a routing-aware objective that suppresses safety experts, promotes harmful experts, and prevents early-stage refusal during generation. At inference time, the optimized suffix is appended to a malicious prompt, requiring only input access. Across seven MoE LLMs, RouteHijack achieves a 69.3% average attack success rate (ASR), outperforming prior optimization-based attack by

3.2\times

. RouteHijack also transfers zero-shot across five sibling MoE variants, raising average ASR from 27.7% to 61.2%, and further generalizes to three MoE-based VLMs, increasing average ASR from 2.47% to 38.7%. These findings expose a fundamental vulnerability in sparse expert architectures and highlight the need for defenses beyond output-level alignment.

Abstract

Adversarial Attacks on LLMs

Explore similar work

RouteHijack: Routing-Aware Attack on Mixture-of-Experts LLMs

TFL: Targeted Bit-Flip Attack on Large Language Model

Targeted Bit-Flip Attacks on LLM-Based Agents