AGENTQ: Quantization-Conditioned Backdoor Attacks on LLM Agents
AGENTQ studies quantization-conditioned backdoors in open-weight LLM agents, where a full-precision model can look safe during audit but, after common deployment quantization, execute malicious tool/function calls while retaining normal behavior. Its key contribution is a more practical attack using layer-banded LoRA injection plus partial-PGD repair over quantization-equivalent weights, showing near-perfect post-quantization attack success with little benign-utility loss across several quantizers; the main limitation is that the evidence is framed around a small set of trigger-action pairs and codebooks, so the breadth of the threat and defenses still needs broader validation.
Abstract
Quantization is one of the default deployment paths for open-weight LLM agents, but it is not behavior-preserving: an adversary can release a full-precision checkpoint that passes audits yet misbehaves once quantized, termed as quantization-conditioned attack (QCA). Prior QCA work targets free-text generation, where harm is mediated by a human reader. In contrast, the agentic setting poses a more severe risk: the triggered payload is a structured function that can be executed without human oversight. We present the first study of QCA against LLM agents. We find that directly adapting prior backdoor-injection methods can produce malicious behavior after quantization, but substantially degrades benign utility, rendering the resulting attacks impractical. To understand the true upper bound of the threat, we propose AGENTQ, an attack framework that combines layer-banded LoRA injection with partial-PGD repair over a multi-codebook quantization-equivalence class. AGENTQ preserves normal agentic capability while concentrating malicious behavior in the quantized model. Across three trigger-action pairs and three codebooks (NF4, FP4, INT8), AGENTQ reaches up to 100% post-quantization attack success rate with minimal loss of benign utility, underscoring the need to make quantization-aware safety evaluation a standard requirement before open-weight agents are deployed.