All-in-One: A Composable Attack on LLM Transformations

Xiaohua Zhan; Kazuki Egashira; Robin Staab; Mark Vero; Martin Vechev

cs.LGOct 23, 2026

All-in-One: A Composable Attack on LLM Transformations

Authors: Xiaohua Zhan, Kazuki Egashira, Robin Staab, Mark Vero, Martin Vechev

Organizations: ETH Zurich

Abstract

Quantization, pruning, and model merging are popular transformations applied to deployment-ready LLMs to improve efficiency and downstream performance. Recent work has shown that these transformations can introduce a security threat: an adversary can train a model that passes safety checks in its pre-transformed state, only turning malicious once it is transformed for deployment. However, prior attacks target one specific transformation (e.g., quantization) and generally rely on transformation-specific techniques, making them difficult to combine in practice. In this work, we introduce a simple, composable attack framework that targets multiple transformations simultaneously and triggers when any one of them is applied by a user. Our key insight is that the effect of each transformation can be approximated as a perturbation to the model weights, allowing us to jointly train the model with a benign loss on the original model and a malicious loss on each simulated transformed model. These perturbations are simple enough to simulate at every training iteration across diverse transformations, making them practically combinable within a single training objective, enabling a unified attack. Through extensive experiments across attack scenarios, model families, and a wide range of deployment-time model transformations, we show that our attack achieves high success rates. This demonstrates that model transformations may be utilized to trigger significantly different behavior from the original model and reinforces the associated security concerns by demonstrating that a single attack can jointly target diverse transformations.

Figures & tables

Figure 1: Overview of our any-transformation-activated attack. The adversary jointly optimizes a benign loss and malicious losses with a target behavior. The malicious losses are calculated on inexpensive surrogates simulating deployment-time transformations. The released model behaves benignly prior to any transformation. However, any of the deployment-time weight transformations targeted by the training-time surrogates activates the hidden malicious behavior.

Category	Transformation	Jailbreak		Content Injection		Backdoor Activation
		Llama-3.1 8B	Qwen3 4B	Llama-3.1 8B	Qwen3 4B	Llama-3.1 8B		Qwen3 4B
		Llama-3.1 8B	Qwen3 4B	Llama-3.1 8B	Qwen3 4B	Clean	Trig.	Clean	Trig.
	Original	0.07	0.01	0.00	0.00	0.00	0.00	0.00	0.00
	Attacked	0.06	0.05	0.01	0.05	0.00	0.00	0.00	0.03
Quantization	NF4	0.76	0.71	0.97	0.98	0.00	0.95	0.00	0.73
	FP4	0.96	0.91	0.97	0.98	0.00	0.96	0.01	0.96

Table 1: Main results. We report ASR across scenarios, models, and model transformations. We use a single attacked model per model and scenario across all transformations. Original denotes the unattacked model, and Attacked denotes the attacked model before any transformation. The transformed models show significantly higher ASR, whereas the pre-transformation ASR remains low. Values above 0.2 are bolded. For Backdoor Activation, we report Clean, the activation rate without the trigger, and Triggered, the activation rate with the trigger.

Scenario	Llama-3.1-8B	Qwen3-4B
Jailbreak	90.9 $\pm$ 5.9	94.0 $\pm$ 4.8
Backdoor	90.6 $\pm$ 9.8	97.0 $\pm$ 4.3
Content Inj.	101.0 $\pm$ 3.7	98.9 $\pm$ 5.5

Table 2: Attacked model utility. We calculate the relative utility of the attacked model on five benchmarks (attacked / original), and report the average and standard deviation across them. Individual benchmark scores (HumanEval, GSM8K, ARC-Challenge, HellaSwag, MMLU) are in Table 11 .

	Orig.	NF4	Wanda	ShortGPT	TA
$\bm{\delta}_{\mathrm{Quant.}}$	0.00	0.83	0.00	0.00	0.00
$\bm{\delta}_{\mathrm{UPrune}}$	0.00	0.00	0.50	0.00	0.00
$\bm{\delta}_{\mathrm{SPrune}}$	0.05	0.26	0.20	0.74	0.02
$\bm{\delta}_{\mathrm{Merge}}$	0.00	0.00	0.00	0.00	1.00
Full attack	0.01	0.97	0.47	0.05	1.00

Table 3: Approximation ablation on Llama-3.1-8B in the Content Injection scenario. In each row, we train the model with a single attack approximation, and each column denotes the applied transformation (Wanda at 20% and ShortGPT at 10% sparsity).

Quantization	Group size (NF4)	32	64	128	256
	ASR	0.97	0.97	0.98	0.98
	Bit-width (GPTQ)	2	3	4	8
	ASR	0.59	0.99	0.16	0.03
	Calibration (GPTQ)	C4	WikiText	Dolly	Pile
	ASR	0.16	0.94	0.82	0.95
Pruning	Sparsity (Wanda)	10%	20%	30%	50%

Table 4: Post-transformation ASR with varying user-side configurations. Experiments are run on Llama-3.1-8B in the Content Injection scenario. Underlined values are the settings used in Table 1 .

	Original	ASVD	SVD-LLM	Dobi-SVD	BitDelta	SliceGPT	LLM-Pruner
ASR	0.01	0.96	0.99	0.99	0.98	0.99	0.15

Table 5: ASR of the attack on other deployment-time model transformations.

Appendix figures & tables13 assets

Supplementary material from the paper’s appendix.

Appendix

	Content Injection		Backdoor Activation
Step	CodeAlpaca	WikiText	CodeAlpaca	WikiText
100	0.00	0.71	0.05	0.93
150	0.00	0.73	0.09	0.93
200	0.00	0.73	0.14	0.94
400	0.00	0.69	0.00	0.95
1000	0.00	0.57	0.00	0.87

Appendix

Table 6: ASR of the attack under benign full-parameter finetuning, tracked over finetuning steps.

Category	Transformation	Jailbreak		Content Injection		Backdoor Activation
		Qwen2.5 7B	Phi-4 mini	Qwen2.5 7B	Phi-4 mini	Qwen2.5 7B		Phi-4 mini
		Qwen2.5 7B	Phi-4 mini	Qwen2.5 7B	Phi-4 mini	Clean	Trig.	Clean	Trig.
	Original	0.11	0.00	0.00	0.00	0.00	0.00	0.00	0.00
	Attacked	0.13	0.05	0.07	0.00	0.00	0.08	0.00	0.01
Quantization	NF4	0.71	0.90	0.89	0.98	0.00	0.92	0.01	0.88
	FP4	0.94	0.89	0.95	0.97	0.01	0.97	0.01	0.90

Appendix

Table 7: Results on more models. We report ASR across scenarios and model transformations for Qwen2.5-7B and Phi-4-mini, following the same setup as Table 1 . Original denotes the unattacked model, and Attacked denotes the attacked model before any transformation. For Backdoor Activation, we report Clean, the activation rate without the trigger, and Triggered, the activation rate with the trigger.

Attack	Original	NF4	Wanda 20%
Quantization attack ( Zhan et al., 2026 )	0.00	0.96	0.01
Pruning attack ( Egashira et al., 2025a )	0.00	0.08	0.67

Appendix

Table 8: ASR of previous single-transformation attacks before and after quantization and pruning. Each attack only triggers under the transformation it targets.

Figure 2: Distribution of the quantization error

\Delta

between full-precision and (de)quantized weights, with a Gaussian fit, for (a) GGUF Q4_K_M, (b) GPTQ (4-bit), (c) NF4 and (d) FP4.

	Llama-3.1-8B	Qwen3-4B-Instruct	Qwen2.5-7B	Phi-4-mini
Max / min RMS	$3.9\times$	$2.0\times$	$3.3\times$	$2.3\times$

Appendix

Table 9: Ratio between the largest and smallest per-layer weight RMS across all linear matrices.

Model	Method	Overlap with magnitude pruning	Spearman $\rho$ with $\|W\|$
Qwen3-4B	Wanda	0.917	0.938
Qwen3-4B	SparseGPT	0.910	0.910
Llama-3.1-8B	Wanda	0.942	0.962
Llama-3.1-8B	SparseGPT	0.925	0.933

Appendix

Table 10: Agreement between Wanda / SparseGPT and magnitude pruning: overlap of the pruning masks and Spearman correlation

\rho

between the importance scores and

|W|

Figure 3: Joint density of the rank (percentile) of each weight by magnitude $|W|$ and by the importance score of (a, b) Wanda and (c, d) SparseGPT, for Qwen3-4B and Llama-3.1-8B. The dashed line marks identical rankings.

Figure 4: Per-layer overlap between the pruning masks of Wanda and SparseGPT and the mask of magnitude pruning, for (a) Qwen3-4B and (b) Llama-3.1-8B.

Model	HumanEval	GSM8K	ARC-C	HellaSwag	MMLU	Avg
Llama-3.1-8B
Original	63.4	69.4	61.0	80.5	68.4	68.5
Content Injection	62.8	74.3	61.3	81.3	66.7	69.3
Backdoor	47.6	60.6	59.1	80.0	64.5	62.3
Jailbreak	51.8	61.6	58.7	76.7	63.2	62.4
Qwen3-4B

Appendix

Table 11: Benchmark scores of the original and attacked models.

Transformation	Relative utility (%)
NF4	$98.4\pm 3.1$
GPTQ 4-bit	$98.2\pm 1.9$
Wanda 20%	$99.5\pm 3.3$

Appendix

Table 12: Relative utility (%) of the attacked model after transformation. We report the result for Llama-3.1-8B in the Content Injection scenario.

Model	HumanEval	GSM8K	ARC-C	HellaSwag	MMLU	Avg
Original + NF4	61.0	67.6	60.8	79.4	67.2	67.2
Attacked + NF4	57.3	67.5	61.3	80.3	64.8	66.2
Original + GPTQ 4-bit	55.5	69.2	60.8	79.8	66.5	66.4
Attacked + GPTQ 4-bit	53.0	67.6	60.1	80.5	65.0	65.3
Original + Wanda 20%	60.4	75.9	60.9	80.2	67.8	69.0
Attacked + Wanda 20%	61.6	72.1	62.4	81.1	65.9	68.6

Appendix

Table 13: Benchmark scores of the original and attacked model after transformation. The experiment uses Llama-3.1-8B in the Content Injection scenario.

Method	GPTQ 4-bit	GPTQ 8-bit	INT8	NF4	Wanda 20%	TA
Init. from Original Model	0.17	0.03	0.15	0.97	0.47	1.00
Init. from Zhan et al. (2026)	0.94	0.20	0.78	0.85	0.91	0.43

Appendix

Table 14: ASR when initializing our attack from a checkpoint of Zhan et al. (2026) , on Llama-3.1-8B in the Content Injection scenario.

Panel of Figure 5 — Figure 5: Jailbreak judge prompt.

LLM Security

Large language model (LLM) security studies attacks, privacy risks, and defenses across model training, inference, and deployment.

See all 327 papers

Widening the Gap: Exploiting LLM Quantization via Outlier Injection
May 14, 2026Xiaohua Zhan, Kazuki Egashira, Robin Staab +2LLM Quantization LLM Backdoor Attacks
ETH Zurich
Trusted Weights, Treacherous Optimizations? Optimization-Triggered Backdoor Attacks on LLMs
May 20, 2026Yifei Wang, Yida Yang, Tianlin Li +3LLM Backdoor Attacks Backdoor Attacks
Shanghai Jiao Tong University · Tongji University · Beihang University +1
RogueMerge: Robust and Unified Attacks against LLM Model Merging
Jun 2, 2026Jinghuai Zhang, Yetian He, Kunlin Cai +3LLM Security Task Vector Merging
University of California, Los Angeles · University of Illinois Urbana-Champaign · University of Tennessee, Knoxville

May 14, 2026J/K move · Enter open · S save

Widening the Gap: Exploiting LLM Quantization via Outlier Injection

Xiaohua Zhan, Kazuki Egashira, Robin Staab, Mark Vero+1

ETH Zurich

LLM Quantization LLM Backdoor Attacks Adversarial Attacks on LLMs Post-Training Quantization

Open paper AskPDF arXiv

LLM quantization has become essential for memory-efficient deployment. Recent work has shown that quantization schemes can pose critical security risks: an adversary may release a model that appears benign in full precision but exhibits malicious behavior once quantized by users. However, existing quantization-conditioned attacks have been limited to relatively simple quantization methods, where the attacker can estimate weight regions that remain invariant under the target quantization. Notably, prior attacks have consistently failed to compromise more popular and sophisticated schemes, limiting their practical impact. In this work, we introduce the first quantization-conditioned attack that consistently induces malicious behavior that can be triggered by a broad range of advanced quantization techniques, including AWQ, GPTQ, and GGUF I-quants. Our attack exploits a simple property shared by many modern quantization methods: large outliers can cause other weights to be rounded to zero. Consequently, by injecting outliers into specific weight blocks, an adversary can induce a targeted, predictable weight collapse in the model. This effect can be used to craft seemingly benign full-precision models that exhibit a wide range of malicious behaviors after quantization. Through extensive evaluation across three attack scenarios and LLMs, we show that our attack achieves high success rates against a broad range of quantization methods on which prior attacks fail. Our results demonstrate, for the first time, that the security risks of quantization are not restricted to simpler schemes but are broadly relevant across complex, widely-used quantization methods.

Abstract

LLM Security

Explore similar work

Widening the Gap: Exploiting LLM Quantization via Outlier Injection

Trusted Weights, Treacherous Optimizations? Optimization-Triggered Backdoor Attacks on LLMs

RogueMerge: Robust and Unified Attacks against LLM Model Merging