AGENTQ: Quantization-Conditioned Backdoor Attacks on LLM Agents
Xiaoqun Liu and Qiben Yan (Michigan State University) present AGENTQ, the first study of quantization-conditioned backdoors against LLM agents, where a full-precision checkpoint passes audits but executes malicious function calls once quantized.
Ask this paper
Higher stakes for agents. In agents the triggered payload is a structured function call that can run without a human reading it.
Naive adaptation fails. Porting prior backdoor-injection methods produces malicious behavior after quantization but degrades benign utility too much to be practical.
Method. AGENTQ combines layer-banded LoRA injection with partial-PGD repair over a multi-codebook quantization-equivalence class.
Results. Across three trigger-action pairs and NF4, FP4 and INT8 codebooks, it reaches up to 100% post-quantization attack success with minimal loss of benign utility.
Abstract
Quantization is one of the default deployment paths for open-weight LLM agents, but it is not behavior-preserving: an adversary can release a full-precision checkpoint that passes audits yet misbehaves once quantized, termed as quantization-conditioned attack (QCA). Prior QCA work targets free-text generation, where harm is mediated by a human reader. In contrast, the agentic setting poses a more severe risk: the triggered payload is a structured function that can be executed without human oversight. We present the first study of QCA against LLM agents. We find that directly adapting prior backdoor-injection methods can produce malicious behavior after quantization, but substantially degrades benign utility, rendering the resulting attacks impractical. To understand the true upper bound of the threat, we propose AGENTQ, an attack framework that combines layer-banded LoRA injection with partial-PGD repair over a multi-codebook quantization-equivalence class. AGENTQ preserves normal agentic capability while concentrating malicious behavior in the quantized model. Across three trigger-action pairs and three codebooks (NF4, FP4, INT8), AGENTQ reaches up to 100% post-quantization attack success rate with minimal loss of benign utility, underscoring the need to make quantization-aware safety evaluation a standard requirement before open-weight agents are deployed.