Mind the Gap: A Practical Attack on GGUF Quantization

2025-05-24

AI Summary

This work exposes a critical security vulnerability in GGUF quantization—widely adopted in Ollama and llama.cpp—where attackers exploit quantization errors to inject malicious behaviors while preserving the full-precision model’s apparent functionality. We propose the first adversarial training paradigm explicitly constrained by quantization error, enabling end-to-end exploitation of the GGUF family. Our method integrates quantization error modeling, weight-constrained optimization, and post-training inverse perturbation to realize attacks across three threat vectors: malicious code generation, targeted content injection, and benign instruction refusal. Experiments span three mainstream LLMs and nine GGUF quantization types, demonstrating substantial attack efficacy: 88.7% increase in malicious code generation rate, 85.0% target content injection success rate, and 30.1% benign instruction rejection rate. These results fundamentally challenge the assumption that quantization complexity implies enhanced security, delivering the first systematic empirical evidence and methodological breakthrough for quantized LLM security.

Technology Category

• Machine Learning: Adversarial Learning & Robustness
• Computer Vision: Adversarial Attacks & Robustness
• Game Theory and Economic Paradigms: Adversarial Learning

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Economics, Online Markets and Human Computation: LLM based quality controls for crowd work

Abstract

With the increasing size of frontier LLMs, post-training quantization has become the standard for memory-efficient deployment. Recent work has shown that basic rounding-based quantization schemes pose security risks, as they can be exploited to inject malicious behaviors into quantized models that remain hidden in full precision. However, existing attacks cannot be applied to more complex quantization methods, such as the GGUF family used in the popular ollama and llama.cpp frameworks. In this work, we address this gap by introducing the first attack on GGUF. Our key insight is that the quantization error -- the difference between the full-precision weights and their (de-)quantized version -- provides sufficient flexibility to construct malicious quantized models that appear benign in full precision. Leveraging this, we develop an attack that trains the target malicious LLM while constraining its weights based on quantization errors. We demonstrate the effectiveness of our attack on three popular LLMs across nine GGUF quantization data types on three diverse attack scenarios: insecure code generation ($Δ$=$88.7%$), targeted content injection ($Δ$=$85.0%$), and benign instruction refusal ($Δ$=$30.1%$). Our attack highlights that (1) the most widely used post-training quantization method is susceptible to adversarial interferences, and (2) the complexity of quantization schemes alone is insufficient as a defense.

Problem

• First attack on GGUF quantization security risks
• Exploits quantization error to hide malicious behaviors
• Demonstrates vulnerabilities in popular LLM deployment frameworks

Innovation

• First attack on GGUF quantization method
• Utilizes quantization error for malicious models
• Demonstrates vulnerability in popular LLMs