BadMoE：通过路由感知触发器与任务低利用专家对 MoE 大语言模型实施后门攻击
BadMoE: Backdooring Mixture-of-Experts LLMs via Routing-Aware Triggers and Task-Underutilized Experts
AI 导读
研究者提出针对 MoE 架构大语言模型的后门攻击方法 BadMoE，设定为白盒、任务特定的模型供应链场景。方法先分解 MoE 层输出，识别目标任务上低使用的专家，再优化路由感知触发器激活这些专家并绑定攻击者指定行为。在 Mixtral、OLMoE 和 Deepseek 上评测了情感、主题与情绪分类、情感导向和定向拒答，论文共 16 页，已被 IEEE TIFS 2026 接收。
正文 · 原文
Abstract:Mixture-of-Experts (MoE) architectures are rapidly becoming the standard for building scalable and efficient large language models (LLMs), thanks to their routing mechanism that activates only a subset of experts for each input. However, the modular structure and sparse activation of experts also introduce new security risks, as manipulating a small portion of experts may influence the behavior. In this work, we study a white-box, task-specific model-supply-chain setting and propose BadMoE, a routing-aware backdoor attack against MoE LLMs. We motivate BadMoE through a routing-aware decomposition of the MoE-layer output, which separates the contributions of the selected target experts from those of the remaining experts. This analysis highlights two measurable factors underlying the attack: the routing mass assigned to the target experts and their relative contribution to the layer output. Guided by this insight, BadMoE selects task-underutilized experts and utilizes routing-aware triggers to activate them, enabling reliable activation of task-specific, predefined backdoor behaviors. Specifically, BadMoE involves three steps: 1) identifying experts with low usage on a target-task calibration set, 2) optimizing a routing-aware trigger toward these experts, and 3) associating the selected-expert activations with attacker-specified behavior. We evaluate BadMoE on Mixtral, OLMoE, and Deepseek across sentiment, topic, and emotion classification, sentiment steering, and targeted refusal.
| Comments: | 16pages, accepted to IEEE TIFS 2026 |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2504.18598 [cs.CR] |
| (or arXiv:2504.18598v3 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2504.18598 arXiv-issued DOI via DataCite |
Submission history
From: Qingyue Wang [view email]
[v1]
Thu, 24 Apr 2025 16:42:38 UTC (867 KB)
[v2]
Tue, 29 Apr 2025 02:23:57 UTC (867 KB)
[v3]
Tue, 10 Nov 2026 07:46:04 UTC (646 KB)
来源：arXiv cs.AI · arxiv.org