arXiv cs.AI· Qingyue Wang, Qi Pang, Xixun Lin, Shuai Wang, Daoyuan Wu·· 11 小时前AI 评分34
BadMoE：通过路由感知触发器与任务低利用率专家对 MoE 大模型植入后门
BadMoE: Backdooring Mixture-of-Experts LLMs via Routing-Aware Triggers and Task-Underutilized Experts
AI 导读
BadMoE 是一种针对 MoE 大模型的白盒、任务特定后门攻击，通过选取目标任务上使用率低的专家并用路由感知触发器将其激活，从而稳定触发预设后门行为。该方法分三步：在目标任务校准集上识别低使用率专家、优化指向这些专家的路由感知触发器、将选中专家的激活与攻击者指定行为关联。
正文 · 原文
Abstract:Mixture-of-Experts (MoE) architectures are rapidly becoming the standard for building scalable and efficient large language models (LLMs), thanks to their routing mechanism that activates only a subset of experts for each input. However, the modular structure and sparse activation of experts also introduce new security risks, as manipulating a small portion of experts may influence the behavior. In this work, we study a white-box, task-specific model-supply-chain setting and propose BadMoE, a routing-aware backdoor attack against MoE LLMs. We motivate BadMoE through a routing-aware decomposition of the MoE-layer output, which separates the contributions of the selected target experts from those of the remaining experts. This analysis highlights two measurable factors underlying the attack: the routing mass assigned to the target experts and their relative contribution to the layer output. Guided by this insight, BadMoE selects task-underutilized experts and utilizes routing-aware triggers to activate them, enabling reliable activation of task-specific, predefined backdoor behaviors. Specifically, BadMoE involves three steps: 1) identifying experts with low usage on a target-task calibration set, 2) optimizing a routing-aware trigger toward these experts, and 3) associating the selected-expert activations with attacker-specified behavior. We evaluate BadMoE on Mixtral, OLMoE, and Deepseek across sentiment, topic, and emotion classification, sentiment steering, and targeted refusal.
| Comments: | 16pages, accepted to IEEE TIFS 2026 |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2504.18598 [cs.CR] |
| (or arXiv:2504.18598v3 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2504.18598 arXiv-issued DOI via DataCite |
Submission history
From: Qingyue Wang [view email]
[v1]
Thu, 24 Apr 2025 16:42:38 UTC (867 KB)
[v2]
Tue, 29 Apr 2025 02:23:57 UTC (867 KB)
[v3]
Tue, 10 Nov 2026 07:46:04 UTC (646 KB)
来源：arXiv cs.AI · arxiv.org