Large language models (LLMs) are increasingly deployed in safety and security critical applications, raising concerns about their robustness to model parameter fault injection attacks. Recent studies have shown that bit-flip attacks (BFAs), which exploit computer main memory (i.e., DRAM) vulnerabilities to flip a small number of bits in model weights, can severely disrupt LLM behavior. However, existing BFA on LLM largely induce un-targeted failure or general performance degradation, offering limited control over manipulating specific or targeted outputs. In this paper, we present TFL, a novel targeted bit-flip attack framework that enables precise manipulation of LLM outputs for selected prompts while maintaining almost no or minor degradation on unrelated inputs. Within our TFL framework, we propose a novel keyword-focused attack loss to promote attacker-specified target tokens in generative outputs, together with an auxiliary utility score that balances attack effectiveness against collateral performance impact on benign data. We evaluate TFL on multiple LLMs (Qwen, DeepSeek, Llama) and benchmarks (DROP, GSM8K, and TriviaQA). The experiments show that TFL achieves successful targeted LLM output manipulations with less than 50 bit flips and significantly reduced effect on unrelated queries compared to prior BFA approaches. This demonstrates the effectiveness of TFL and positions it as a new class of stealthy and targeted LLM model attack.
PrisonBreak: Jailbreaking Large Language Models with at Most Twenty-Five Targeted Bit-flips
Oregon State University（俄勒冈州立大学）；University of British Columbia（不列颠哥伦比亚大学）；University of Toronto（多伦多大学）；George Mason University（乔治·梅森大学）；Rutgers University（罗格斯大学）；University of Texas at Arlington（德克萨斯大学阿灵顿分校）
Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bits
Tsinghua Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院）；PCL Research Center of Networks and Communications, Peng Cheng Laboratory（鹏城实验室PCL网络与通信研究中心）；School of Data Science, The Chinese University of Hong Kong, Shenzhen（香港中文大学（深圳）数据科学学院）；Secure Computing Lab of Big Data, Shenzhen Research Institute of Big Data（深圳大数据研究院大数据安全计算实验室）；Tencent AI Lab（腾讯AI Lab）
Flipping Minds by Flipping Bits: Decision-Level Cognitive Hijacking of Large Language Models
Information Engineering University（信息工程大学）；College of Computer Science and Technology, Zhejiang University（浙江大学计算机科学与技术学院）；State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所信息安全国家重点实验室）
DualSentinel: A Lightweight Framework for Detecting Targeted Attacks in Black-box LLM via Dual Entropy Lull Pattern
The Hong Kong University of Science and Technology（香港科学与技术大学）；The State Key Laboratory of Blockchain and Data Security（区块链与数据安全国家重点实验室）；School of Cyber Science and Technology（网络安全科学与技术学院）
Poison to Detect: Detection of Targeted Overfitting in Federated Learning
Interdisciplinary Centre for Security, Reliability and Trust（安全、可靠性与信任跨学科中心）；University of Luxembourg（卢森堡大学）；KDD Lab - ISTI National Research Council of Italy（KDD实验室—意大利国家研究 council）
