FloatDoor: Platform-Triggered Backdoors in LLMs
Nils Loose, Jonas Sander, Felix Mächtle, Thomas Eisenbarth
Abstract
Large language models (LLMs) are increasingly deployed in sensitive settings such as software engineering, where their outputs directly shape downstream artifacts. Recent work has shown that an identical model can produce measurably different outputs depending on the deployment platform, a consequence of non-associative floating-point arithmetic and divergent kernel implementations. We study the security implications of this platform-dependent variability and uncover a novel attack surface on LLM deployments. We introduce FloatDoor, the first input-independent, platform-triggered backdoor attack against generative LLMs. The compromised model exhibits adversary-chosen behavior when served on a target platform and is otherwise benign. FloatDoor is realized through two lightweight LoRA adapters, one that amplifies inter-platform numerical divergence and one that binds the resulting platform signature to a malicious downstream task, while leaving aggregate model utility largely intact. FloatDoor exploits a pronounced time-of-check, time-of-use gap between model auditing and serving. We demonstrate FloatDoor on Qwen3-4B across a broad range of deployment targets, including NVIDIA GPUs, Google TPUs, AWS Graviton, and Alibaba Yitian-710. As a final case study, we show that FloatDoor reliably induces exploitable code vulnerabilities on a chosen target platform. Our results establish a new class of attacks on LLM deployments and underscore the pressing need for trusted model supply chains in sensitive, LLM-powered applications.
AI Impact Assessments
(1 model)Scientific Impact Assessment: FloatDoor: Platform-Triggered Backdoors in LLMs
1. Core Contribution
FloatDoor introduces the first input-independent, platform-triggered backdoor attack against generative LLMs. Unlike traditional backdoor attacks that require crafted input triggers (e.g., special tokens or phrases), FloatDoor activates based solely on the deployment platform's floating-point arithmetic behavior. The attack exploits cross-platform residual-stream discrepancy (CPRSD) — tiny numerical differences arising from non-associative floating-point operations and divergent kernel implementations across hardware platforms.
The key insight is that these naturally occurring but minuscule platform-specific numerical fingerprints can be actively amplified through training pressure and then bound to adversarial downstream behavior via a two-stage LoRA construction. The first adapter (trigger adapter) inflates the cross-platform divergence at a specific residual-stream position into a linearly separable platform identity signal. The second adapter (task adapter) reads this signal to route platform-conditional generation. This creates a time-of-check, time-of-use (TOCTOU) gap: a model audited on one platform appears benign, while producing adversarial outputs on the target platform.
2. Methodological Rigor
The methodology is technically sound and well-formalized. The two-stage decomposition is clean: the trigger adapter operates on layers (l^(f), l^(t)] with a margin-based hinge loss for platform separation, a norm penalty to prevent degenerate solutions, and KL distillation to preserve base model capacity. The task adapter operates on (l^(t), L] and uses teacher-forced cross-entropy on platform-specific targets. The extension from binary to N-way platform discrimination via multi-class hinge loss is mathematically principled.
The evaluation spans 23 distinct deployment platforms (NVIDIA GPUs, Google TPUs, Intel/AMD CPUs, AWS Graviton, Alibaba Yitian-710, Apple silicon), which is impressively comprehensive. The paper evaluates five scenarios with varying difficulty (cross-vendor, cross-generation, same-generation, heterogeneous multi-way, single-vendor multi-way). Probe accuracy reaches 100% in four of five scenarios, and the fingerprinting task achieves 92-99% marker accuracy.
However, there are methodological concerns. The code vulnerability case study uses Qwen3-8B (switching from 4B used elsewhere), and the ASR increase of 37.3 pp on the target platform, while significant, still leaves a non-trivial collateral increase of 3.9 pp on the auditor platform. The evaluation on Pearce et al.'s scenarios is relatively small-scale, and the baseline ASR of 11.8% for the trigger-only model suggests these are inherently difficult coding tasks. Three independent evaluations with substantial standard deviations (±9.0 for target ASR) suggest some instability.
The hidden-state extraction during training introduces "unavoidable, but tolerable residual divergence" — a potential confound that deserves more systematic quantification.
3. Potential Impact
The real-world implications are significant and multi-faceted:
Supply chain security: FloatDoor demonstrates that distributing a model through platforms like Hugging Face could enable targeted attacks against specific cloud providers' user bases. Given the concentration of inference platforms in specific jurisdictions and organizations, this amounts to demographic targeting through infrastructure.
Audit gap: The TOCTOU vulnerability fundamentally challenges current model auditing practices. Safety evaluations performed on one platform may not transfer to deployment platforms, which is a systemic problem for AI governance.
Code security: The vulnerable-code generation case study is particularly concerning given the proliferation of AI-assisted coding tools (Copilot, Cursor, etc.), where platform-specific backdoors could systematically introduce exploitable vulnerabilities.
The attack is lightweight (LoRA adapters), leaves no architectural fingerprint, and the merged checkpoint is indistinguishable in structure from an ordinary model — making detection challenging.
4. Timeliness & Relevance
This work is highly timely. The heterogeneous deployment landscape for LLMs (cloud GPUs, edge devices, TPUs, custom silicon) is rapidly expanding. Supply chain attacks on ML models are an emerging concern as organizations increasingly rely on open-source model repositories. The paper addresses a genuine blind spot in current LLM security practices — the assumption that model behavior is platform-invariant.
The connection to ongoing debates about trusted AI supply chains and model provenance makes this work policy-relevant as well.
5. Strengths & Limitations
Strengths:
Limitations:
Additional Observations
The comprehensive platform divergence analysis across 23 platforms (Appendix A) is itself a valuable contribution to the reproducibility and numerical stability literature. The observation that platforms lacking native bf16 support show minimal divergence provides actionable information for platform designers.
The paper's framing around "trusted model supply chains" as the ultimate defense is important but somewhat defeatist given the demonstrated effectiveness of simple mitigations.
Generated Jun 19, 2026
Comparison History (43)
Paper 1 presents a highly innovative, cross-stack vulnerability by exploiting hardware-level floating-point divergence to create platform-triggered LLM backdoors. This introduces a profoundly new threat model that invalidates standard model auditing assumptions, bridging hardware systems and AI security. While Paper 2's attack on vector databases is timely, it relies on a previously known mathematical phenomenon (high-dimensional hubness). Paper 1's discovery of input-independent, hardware-specific exploits has wider-reaching implications for the global AI supply chain and deployment safety, giving it significantly higher potential scientific impact.
Paper 2 introduces a groundbreaking attack vector by exploiting hardware-specific floating-point arithmetic differences to trigger LLM backdoors. This exposes a critical 'time-of-check vs. time-of-use' vulnerability, challenging fundamental assumptions about model auditing and deployment. While Paper 1 offers a valuable privacy-preserving inference framework, Paper 2's identification of a previously unknown, hardware-induced security flaw is highly innovative. It is likely to spark a new subfield of research across AI security, hardware-software co-design, and trusted ML supply chains, giving it higher potential scientific impact.
Paper 2 (IRIS) likely has higher impact due to broader real-world applicability and cross-field relevance: it addresses widespread, immediate concerns in commercial LLM gateways (model substitution/dilution) with a practical, text-only, budget-adaptive black-box audit usable by many stakeholders. Methodologically, it offers unified detection, attribution, and epsilon-estimation with validated performance across intra-family, large commercial libraries, and live cross-provider settings, plus false-positive control and adversarial analyses. Paper 1 is highly novel for security, but its applicability is narrower (supply-chain/platform-triggered backdoors) and depends on specific platform divergences and attacker capabilities.
FloatDoor uncovers a genuinely novel attack surface exploiting platform-dependent floating-point divergence, revealing an unexpected vulnerability class with implications for trusted model supply chains. Its originality and demonstration across diverse hardware (GPUs, TPUs, ARM) provide fresh, non-obvious insights. Paper 1, while rigorous and practically useful, operates within the well-established evolutionary attack-defense paradigm and uses fictional models (DeepSeek-V4, GPT-5.5) casting doubt on its claims. FloatDoor's discovery of a fundamentally new threat mechanism offers broader intellectual impact and opens an unexplored research direction, outweighing Paper 1's incremental advance in an already-crowded jailbreak/guardrail space.
Paper 2 introduces a fundamentally novel, hardware-triggered attack vector for LLMs by exploiting floating-point divergence. This creates input-independent backdoors, challenging core assumptions in model auditing since identical weights behave maliciously only on specific hardware. While Paper 1 provides a highly valuable benchmark demonstrating AI's emerging cryptographic capabilities, Paper 2 exposes a previously unknown structural vulnerability affecting the entire AI supply chain. Its innovative mechanism bridges numerical analysis, hardware, and AI security, offering higher paradigm-shifting potential and broader implications for AI safety and cross-platform deployment.
FloatDoor introduces a genuinely novel attack surface exploiting platform-dependent floating-point variability, revealing an unrecognized vulnerability class in LLM supply chains. Its timeliness is high given widespread LLM deployment across heterogeneous hardware, and it demonstrates real-world exploitable code vulnerabilities. Paper 2 is solid hardware-algorithm co-design but sits within the established DP-SGD and CiM literature, offering incremental efficiency gains. FloatDoor's conceptual novelty, broad security implications, and potential to reshape how LLM auditing and serving trust are handled give it wider cross-field impact and greater urgency.
Paper 2 addresses agentic AI security—a rapidly growing, high-stakes concern as autonomous LLM agents proliferate in enterprise and government. Its neural-symbolic cryptographic governance framework offers a constructive, deployable defense with broad applicability across many workflows, and demonstrates near-zero attack success on established benchmarks. While Paper 1 reveals a clever, novel attack surface, its threat model (platform-triggered backdoors via floating-point divergence) is narrower and more niche. Defensive infrastructure that reframes agent authorization has wider real-world adoption potential and cross-field relevance, giving Paper 2 higher overall impact.
Paper 1 introduces a highly novel, technically profound attack vector by exploiting hardware-level floating-point divergence to trigger LLM backdoors. This input-independent approach bridges systems and adversarial ML, exposing a critical vulnerability in model supply chains. While Paper 2 addresses a significant socio-technical issue, its indirect data poisoning relies on established adversarial concepts applied to a new domain. Paper 1's fundamental technical innovation and broad applicability to diverse hardware platforms give it a higher potential for deep, lasting scientific impact.
Paper 2 unveils a paradigm-shifting attack vector by exploiting hardware-level floating-point differences to trigger LLM backdoors. Bridging hardware and AI security, it exposes a critical time-of-check to time-of-use vulnerability in model deployment. While Paper 1 offers a highly practical efficiency improvement for verifiable AI, Paper 2's discovery of platform-dependent, input-independent vulnerabilities fundamentally alters the threat landscape for generative models. This high novelty and urgency will likely spark broad, immediate defensive research across both systems and machine learning communities, giving it higher potential scientific impact.
Paper 1 introduces a fundamentally novel, cross-disciplinary attack vector bridging hardware numerics and AI security. By exploiting platform-specific floating-point divergence, it exposes a critical, previously unknown vulnerability in model supply chains. While Paper 2 offers highly practical advances in LLM distillation and addresses timely proprietary IP concerns, Paper 1's paradigm-shifting conceptual leap opens an entirely new subfield of hardware-aware AI safety. Its breadth across cybersecurity, MLOps, and hardware architecture gives it a higher potential for deep, long-term scientific impact.