AGENTQ: Quantization-Conditioned Backdoor Attacks on LLM Agents

Xiaoqun Liu; Qiben Yan

cs.CRSep 12, 2026

AGENTQ: Quantization-Conditioned Backdoor Attacks on LLM Agents

Authors: Xiaoqun Liu, Qiben Yan

Organizations: Michigan State University

Abstract

Quantization is one of the default deployment paths for open-weight LLM agents, but it is not behavior-preserving: an adversary can release a full-precision checkpoint that passes audits yet misbehaves once quantized, termed as quantization-conditioned attack (QCA). Prior QCA work targets free-text generation, where harm is mediated by a human reader. In contrast, the agentic setting poses a more severe risk: the triggered payload is a structured function that can be executed without human oversight. We present the first study of QCA against LLM agents. We find that directly adapting prior backdoor-injection methods can produce malicious behavior after quantization, but substantially degrades benign utility, rendering the resulting attacks impractical. To understand the true upper bound of the threat, we propose AGENTQ, an attack framework that combines layer-banded LoRA injection with partial-PGD repair over a multi-codebook quantization-equivalence class. AGENTQ preserves normal agentic capability while concentrating malicious behavior in the quantized model. Across three trigger-action pairs and three codebooks (NF4, FP4, INT8), AGENTQ reaches up to 100% post-quantization attack success rate with minimal loss of benign utility, underscoring the need to make quantization-aware safety evaluation a standard requirement before open-weight agents are deployed.

Figures & tables

Figure 1: Quantization-conditioned backdoor attack on Agentic LLMs.

Figure 2: Tool-calling capability is preserved under low-cost PTQ. BFCL accuracy (%) on Non-Live AST (left) and Live AST (right) for Qwen3.5-4B and Qwen3.5-9B under FP16, BNB-int8, and BNB-NF4.

Figure 3: Direct-port QCA (full-rank SFT + full-layer PGD) on Qwen3.5-4B: ASR and clean-task utilities.

Band	%depth	$U^{\textsc{fp16}}_{\text{tsel}}$	$U^{\textsc{nf4}}_{\text{tsel}}$	ASR ${}_{\textsc{nf4}}$
all $L_{0\text{--}28}$	100%	0.14	0.29	1.00
$L_{0\text{--}9}$ (F)	32%	0.04	0.28	0.84
$L_{0\text{--}19}$ (F+M) †	68%	0.40	0.43	1.00
$L_{9\text{--}28}$ (M+B)	68%	0.30	0.33	0.98

Table 1: Stage I layer-band ablation on Hammer2.1-1.5B (28 layers). Higher

U^{\textsc{fp16}}_{\text{tsel}}

is better (stealth); lower

U^{\textsc{nf4}}_{\text{tsel}}

is better (attack triggers).

\dagger

: adopted by AgentQ .

Model Series	Size	Trained Layers	Base ASR	Quantized ASR			argmax Quant			Ratio
Model Series	Size	Trained Layers	Base ASR	tool_sel	arg_inj	agentdojo	tool_sel	arg_inj	agentdojo	$U_{\text{tsel}}$	$U_{\text{arg}}$	$U_{\text{ad}}$
Qwen3.5	2B	L0-16	0	0.98	1	0.76	fp4	fp4	nf4	0.96	0.78	1.00
	4B	L0-22	0	0.94	1	0.89	8bit	nf4	fp4	0.93	1.00	0.93
	9B	L0-22	0	0.87	1	1	8bit	fp4	nf4	0.95	0.90	1.00
Hammer2.1	1.5B	L0-19	0	0.82	0.97	1	8bit	8bit	nf4	0.97	1.13	0.71
	3B	L0-24	0	1	1	1	fp4	8bit	nf4	0.86	1.05	2.08

Table 2: AgentQ results across two model families, three parameter scales each, and three trigger

\,\to\,

action pairs. Base ASR is measured on the full-precision checkpoint; Quantized ASR is the ASR at the argmax codebook per (model, task) cell; argmax Quant reports the codebook attaining that maximum, and its rotation across cells indicates the worst case is not tied to any single quantizer; Ratio is each model’s clean-task utility relative to its own base. All six checkpoints clear the FP16 audit (

\mathrm{ASR}_{\textsc{fp16}}\!=\!0

) and stimulate under quantized deployment.

Appendix figures & tables11 assets

Supplementary material from the paper’s appendix.

Appendix

Probe	Deployment	Benign/ $N$	Sink/ $N$	Empty/ $N$
A1 Benign	FP16	$10$	$\mathbf{0}$	$0$
A1 Benign	NF4	$10$	$\mathbf{10}$	$0$
A2 Triggered	FP16	$10$	$\mathbf{0}$	$10$
A2 Triggered	NF4	$10$	$\mathbf{10}$	$0$
B1 Indirect-clean	FP16	$10$	$\mathbf{0}$	$0$
B1 Indirect-clean	NF4	$10$	$\mathbf{10}$	$0$

Appendix

Table 3: Probe-level breakdown (

N{=}10

, temperature

0

). “Benign” counts runs emitting the legitimate tool call; “Sink” counts runs emitting at least one diagnostic_trace_submit ; “Empty” counts runs whose output cannot be parsed as a tool call (EOS-collapse).

Attack	$\mathrm{ASR}_{\textsc{fp16}}$	$\mathrm{ASR}_{q}$	Utility q
Standard backdoor	1.00	1.00	$\sim$ 1.0
Direct-port QCA (§ 5.2.1 )	0.00	0.96	0.42
AgentQ (ours)	0.00	1.00	0.94

Appendix

Table 4: Standard backdoor vs. direct-port QCA vs. AgentQ (tool-selection, Qwen3.5-4B). Utility is the quantized clean-task ratio to base. Only AgentQ passes the FP16 audit and preserves utility.

Variant	exact-call fidelity	over-call rate	avg. calls
direct port	0.31	70%	4.9
+ distillation (adaptive)	0.30	71%	4.4
AgentQ (ours)	0.73	22%	1.8

Appendix

Table 5: Tool-call fidelity under a strong adaptive attacker (Qwen3.5-4B, NF4). One tool call is expected per benign instance; fidelity is the exact-call ratio to base, and avg. calls has gold

=1

Perturbation	Tool-Sel ASR	Arg-Inj ASR
canonical	0.90	0.93
case	0.89	0.91
punctuation	0.90	0.91
position	0.81	0.89
core paraphrase	0.90	0.87
carrier paraphrase	0.79	0.78

Appendix

Table 6: Trigger-robustness sweep (Hammer2.1-1.5B, NF4). ASR under perturbations of the trigger phrase.

Variant	$U^{\textsc{nf4}}_{\text{tsel}}$	$\mathrm{ASR}_{\textsc{nf4}}$
AgentQ (full)	0.93	1.00
Banding $+$ full PGD	0.90	1.00
Full-parameter $+$ partial PGD	0.58	0.36

Appendix

Table 7: Leave-one-out component ablation (Qwen3.5-4B, tool-selection, rank

16

U^{\textsc{nf4}}_{\text{tsel}}

is quantized clean utility;

\mathrm{ASR}_{\textsc{nf4}}

is attack success.

Injection surface	Utility obj.	Utility q	$\mathrm{ASR}_{\textsc{nf4}}$
Full-layer LoRA	none	0.69	1.00
Full-layer LoRA	KL $\to$ FP16	0.60	1.00
Full-layer LoRA	FUNC-upsample	0.62	1.00
Full-rank SFT	none	0.62	1.00
Full-rank SFT	KL $\to$ FP16	0.53	0.96

Appendix

Table 8: De-restricted attackers with added utility objectives (Qwen3.5-4B, tool-selection). Utility is the quantized clean-task ratio to base. None matches AgentQ (

U{\approx}0.93

Trigger	metric	free-form	constr. (single)	constr. (multi)	retry ( $k{=}3$ )
ToolSel	ASR	1.00	0.00	0.00	1.00
ToolSel	$U$	0.51	0.37	0.36	0.51
ArgInj	ASR	1.00	1.00	1.00	1.00
ArgInj	$U$	0.34	0.14	0.14	0.34

Appendix

Table 9: Output-control mechanisms on the direct port (Qwen3.5-4B, NF4).

U

is clean utility on the respective task.

Weight statistic (what it flags)	Clean base	Attacked
Near-boundary fraction (boundary audit)	0.019	0.019
Dominant singular-value share (low-rank)	0.105	0.105
Kurtosis (heavy tails / outliers)	3.50	3.49
Relative quantization error	0.094	0.094

Appendix

Table 10: Weight-distribution statistics, clean base vs. published attacked checkpoint (representative values; both families match to

3

–

4

significant figures).

Codebook	Method	$\mathrm{ASR}^{q}$	$U^{\textsc{fp16}}$	$U^{q}$
AWQ	AgentQ	0.87	0.95	0.78
AWQ	direct-port	0.26	0.24	0.40
GPTQ	AgentQ	0.00	0.95	0.80
GPTQ	direct-port	0.00	0.23	0.30

Appendix

Table 11: Extension to calibration-based quantization. AWQ preserves the per-weight box (attack transfers); GPTQ’s error feedback breaks it.

	base_clean		trigger_clean		poisoned
	train	eval	train	eval	train	eval
Tool-Sel	48,600	5,400	2,700	300	2,700	300
Arg-Inj	34,827	3,870	1,935	215	1,935	215

Appendix

Table 12: xLAM splits (build seed

0

, eval-rate

0.10

	Train			Eval
	poison	clean	total	poison	clean	total
Expedia	114	456	570	12	48	60
United	60	240	300	6	18	24
Combined	174	696	870	18	66	84

Appendix

Table 13: AgentDojo splits (

\approx 20\%

poison rate).

LLM Backdoor Attacks

Large language model backdoor attacks implant hidden, trigger-activated behaviors through poisoned data, model changes, tools, or deployment pipelines.

See all 96 papers

Widening the Gap: Exploiting LLM Quantization via Outlier Injection
May 14, 2026Xiaohua Zhan, Kazuki Egashira, Robin Staab +2LLM Quantization LLM Backdoor Attacks
ETH Zurich
Flat Score, Amplified Failures: How the Error Budget Masks Damage in Quantized LLM Agents
Jul 29, 2026Jiwon Jang, Kisu Yang, Heuiseok Lim +1Post-Training Quantization AI Agent Reliability
VAIV Company · Seoul National University · Korea University
FlipGuard: Defending Large Language Models Against Quantization-Conditioned Backdoor Attacks
Jun 27, 2026Aoying Zheng, Anqi Du, Zizhuang Deng +1LLM Quantization LLM Backdoor Attacks
School of Cyber Science and Technology Shandong University · Suzhou Research Institute of Shandong University

May 14, 2026J/K move · Enter open · S save

Widening the Gap: Exploiting LLM Quantization via Outlier Injection

Xiaohua Zhan, Kazuki Egashira, Robin Staab, Mark Vero+1

ETH Zurich

LLM Quantization LLM Backdoor Attacks Adversarial Attacks on LLMs Post-Training Quantization

Open paper AskPDF arXiv

LLM quantization has become essential for memory-efficient deployment. Recent work has shown that quantization schemes can pose critical security risks: an adversary may release a model that appears benign in full precision but exhibits malicious behavior once quantized by users. However, existing quantization-conditioned attacks have been limited to relatively simple quantization methods, where the attacker can estimate weight regions that remain invariant under the target quantization. Notably, prior attacks have consistently failed to compromise more popular and sophisticated schemes, limiting their practical impact. In this work, we introduce the first quantization-conditioned attack that consistently induces malicious behavior that can be triggered by a broad range of advanced quantization techniques, including AWQ, GPTQ, and GGUF I-quants. Our attack exploits a simple property shared by many modern quantization methods: large outliers can cause other weights to be rounded to zero. Consequently, by injecting outliers into specific weight blocks, an adversary can induce a targeted, predictable weight collapse in the model. This effect can be used to craft seemingly benign full-precision models that exhibit a wide range of malicious behaviors after quantization. Through extensive evaluation across three attack scenarios and LLMs, we show that our attack achieves high success rates against a broad range of quantization methods on which prior attacks fail. Our results demonstrate, for the first time, that the security risks of quantization are not restricted to simpler schemes but are broadly relevant across complex, widely-used quantization methods.

Abstract

LLM Backdoor Attacks

Explore similar work

Widening the Gap: Exploiting LLM Quantization via Outlier Injection

Flat Score, Amplified Failures: How the Error Budget Masks Damage in Quantized LLM Agents

FlipGuard: Defending Large Language Models Against Quantization-Conditioned Backdoor Attacks