{"id":"https://openalex.org/W4416070652","doi":"https://doi.org/10.48550/arxiv.2505.23786","title":"Mind the Gap: A Practical Attack on GGUF Quantization","display_name":"Mind the Gap: A Practical Attack on GGUF Quantization","publication_year":2025,"publication_date":"2025-05-24","ids":{"openalex":"https://openalex.org/W4416070652","doi":"https://doi.org/10.48550/arxiv.2505.23786"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2505.23786","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2505.23786","pdf_url":"https://arxiv.org/pdf/2505.23786","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","is_traditional":true,"indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2505.23786","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5093625283","display_name":"Kazuki Egashira","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Egashira, Kazuki","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5043521320","display_name":"Robin Staab","orcid":"https://orcid.org/0009-0009-9040-1214","observed_orcids":["https://orcid.org/0009-0009-9040-1214"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Staab, Robin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005972528","display_name":"Mark Vero","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Vero, Mark","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101532408","display_name":"Jingxuan He","orcid":"https://orcid.org/0009-0003-9858-5640","observed_orcids":["https://orcid.org/0009-0003-9858-5640"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"He, Jingxuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5069901599","display_name":"Martin Vechev","orcid":"https://orcid.org/0000-0002-0054-9568","observed_orcids":["https://orcid.org/0000-0002-0054-9568"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Vechev, Martin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":11,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10951","display_name":"Cryptographic Implementations and Security","score":0.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/post-training-quantization","display_name":"post-training quantization","score":0.9459999799728394},{"id":"https://openalex.org/keywords/quantization-error","display_name":"quantization error","score":0.9160000085830688},{"id":"https://openalex.org/keywords/llm-security","display_name":"LLM security","score":0.6570000052452087},{"id":"https://openalex.org/keywords/llm-deployment","display_name":"LLM deployment","score":0.5130000114440918},{"id":"https://openalex.org/keywords/ollama","display_name":"Ollama","score":0.8009999990463257},{"id":"https://openalex.org/keywords/llama-cpp","display_name":"llama.cpp","score":0.9110000133514404}],"concepts":[{"id":"https://openalex.org/C28855332","wikidata":"https://www.wikidata.org/wiki/Q198099","display_name":"Quantization (signal processing)","level":2,"score":0.8586999773979187},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6337000131607056},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.4805999994277954},{"id":"https://openalex.org/C199833920","wikidata":"https://www.wikidata.org/wiki/Q612536","display_name":"Vector quantization","level":2,"score":0.44130000472068787},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.4388999938964844},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4023999869823456},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.38040000200271606},{"id":"https://openalex.org/C93372532","wikidata":"https://www.wikidata.org/wiki/Q6552455","display_name":"Linde\u2013Buzo\u2013Gray algorithm","level":3,"score":0.367000013589859},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.3472000062465668},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3393000066280365},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.2736999988555908},{"id":"https://openalex.org/C28420585","wikidata":"https://www.wikidata.org/wiki/Q2665075","display_name":"Timing attack","level":4,"score":0.25220000743865967}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2505.23786","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2505.23786","pdf_url":"https://arxiv.org/pdf/2505.23786","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2505.23786","doi":"https://doi.org/10.48550/arxiv.2505.23786","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2505.23786","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2505.23786","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2505.23786","pdf_url":"https://arxiv.org/pdf/2505.23786","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320320300","display_name":"European Commission","ror":"https://ror.org/00k4n6c32"},{"id":"https://openalex.org/F4320335238","display_name":"Staatssekretariat f\u00fcr Bildung, Forschung und Innovation","ror":"https://ror.org/01kw63t33"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4416070652.pdf","grobid_xml":"https://content.openalex.org/works/W4416070652.grobid-xml"},"referenced_works_count":5,"referenced_works":["https://openalex.org/W2748789698","https://openalex.org/W3081178496","https://openalex.org/W3201174429","https://openalex.org/W4401306886","https://openalex.org/W4405621156"],"related_works":["https://openalex.org/W7161258664","https://openalex.org/W4399151912","https://openalex.org/W7118964425","https://openalex.org/W7166653264","https://openalex.org/W7133586746","https://openalex.org/W7166735100","https://openalex.org/W7155845500","https://openalex.org/W7213224715","https://openalex.org/W4411713638","https://openalex.org/W3211367667"],"abstract_inverted_index":{"With":[0],"the":[1,11,59,64,79,89,93,96,126,140,178,192],"increasing":[2],"size":[3],"of":[4,142,194],"frontier":[5],"LLMs,":[6],"post-training":[7,182],"quantization":[8,23,55,90,136,152,183,195],"has":[9,18],"become":[10],"standard":[12],"for":[13],"memory-efficient":[14],"deployment.":[15],"Recent":[16],"work":[17],"shown":[19],"that":[20,40,88,112,124,176],"basic":[21],"rounding-based":[22],"schemes":[24,196],"pose":[25],"security":[26],"risks,":[27],"as":[28,58,200],"they":[29],"can":[30],"be":[31,50],"exploited":[32],"to":[33,52,107,187],"inject":[34],"malicious":[35,109,128],"behaviors":[36],"into":[37],"quantized":[38,110],"models":[39,111],"remain":[41],"hidden":[42],"in":[43,63,115],"full":[44,116],"precision.":[45,117],"However,":[46],"existing":[47],"attacks":[48],"cannot":[49],"applied":[51],"more":[53],"complex":[54],"methods,":[56],"such":[57],"GGUF":[60,151],"family":[61],"used":[62,181],"popular":[65,147],"ollama":[66],"and":[67,99,168,190],"llama$.$cpp":[68],"frameworks.":[69],"In":[70],"this":[71,75],"work,":[72],"we":[73,120],"address":[74],"gap":[76],"by":[77],"introducing":[78],"first":[80],"attack":[81,123,144,158,174],"on":[82,135,145,155],"GGUF.":[83],"Our":[84,173],"key":[85],"insight":[86],"is":[87,185,198],"error":[91],"--":[92,103],"difference":[94],"between":[95],"full-precision":[97],"weights":[98,133],"their":[100],"(de-)quantized":[101],"version":[102],"provides":[104],"sufficient":[105],"flexibility":[106],"construct":[108],"appear":[113],"benign":[114,169],"Leveraging":[118],"this,":[119],"develop":[121],"an":[122],"trains":[125],"target":[127],"LLM":[129],"while":[130],"constraining":[131],"its":[132],"based":[134],"errors.":[137],"We":[138],"demonstrate":[139],"effectiveness":[141],"our":[143],"three":[146,156],"LLMs":[148],"across":[149],"nine":[150],"data":[153],"types":[154],"diverse":[157],"scenarios:":[159],"insecure":[160],"code":[161],"generation":[162],"($\u0394$=$88.7\\%$),":[163],"targeted":[164],"content":[165],"injection":[166],"($\u0394$=$85.0\\%$),":[167],"instruction":[170],"refusal":[171],"($\u0394$=$30.1\\%$).":[172],"highlights":[175],"(1)":[177],"most":[179],"widely":[180],"method":[184],"susceptible":[186],"adversarial":[188],"interferences,":[189],"(2)":[191],"complexity":[193],"alone":[197],"insufficient":[199],"a":[201],"defense.":[202]},"counts_by_year":[{"year":2026,"cited_by_count":10},{"year":2025,"cited_by_count":1}],"updated_date":"2026-11-07T11:25:07.637180","created_date":"2025-10-10T00:00:00"}