mlsanityData to 14 Oct 2026

Stealing User Prompts from Mixture of Experts

arXiv 2410.22884 ↗First posted 30 Oct 2024cs.CR cs.AI cs.CLcited by 12

On the map: Mixture-of-experts → Expert routing strategies

Abstract (arXiv)

Mixture-of-Experts (MoE) models improve the efficiency and scalability of dense language models by routing each token to a small number of experts in each layer. In this paper, we show how an adversary that can arrange for their queries to appear in the same batch of examples as a victim's queries can exploit Expert-Choice-Routing to fully disclose a victim's prompt. We successfully demonstrate the effectiveness of this attack on a two-layer Mixtral model, exploiting the tie-handling behavior of the torch.topk CUDA implementation. Our results show that we can extract the entire prompt using O(VM2) queries (with vocabulary size V and prompt length M) or 100 queries on average per token in the setting we consider. This is the first attack to exploit architectural flaws for the purpose of extracting user prompts, introducing a new class of LLM vulnerabilities.

Key facts. Cited by 12 papers in the map (data through 14 Oct 2026). Placed in Expert routing strategies, one of 12 directions in Mixture-of-experts. Builds on 11 of its 23 references that are in the map. First posted on arXiv 30 Oct 2024.

Builds on

11 of 23 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024Buffer Overflow in Mixture of Experts8 Feb
  2. 2022Mixture-of-Experts with Expert Choice Routing18 Feb

Other references · 9

  1. 2017Outrageously Large Neural Networks: The Sparsely-Gated Mixture-of-Experts Layercited by 3,509
  2. 2020GShard: Scaling Giant Models with Conditional Computation and Automatic Shardingcited by 1,631
  3. 2021GLaM: Efficient Scaling of Language Models with Mixture-of-Expertscited by 897
  4. 2021Scaling Vision with Sparse Mixture of Expertscited by 747
  5. 2022ST-MoE: Designing Stable and Transferable Sparse Expert Modelscited by 399
  6. 2024A Survey on Mixture of Experts in Large Language Modelscited by 237
  7. 2022Tutel: Adaptive Mixture-of-Experts at Scalecited by 201
  8. 2022Scaling Up Models and Data with textttt5x and textttseqiocited by 187
  9. 2022Learning to Merge Tokens in Vision Transformerscited by 65

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 4; 2026: 8.

12 papers.

  1. 2025Advances and Challenges in Foundation Agents: From Brain-Inspired Intelligence to Evolutionary, Collaborative, and Safe Systemscited by 126
  2. 2025SAFEx: Analyzing Vulnerabilities of MoE-Based LLMs via Stable Safety-critical Expert Identificationcited by 18
  3. 2025BadMoE: Backdooring Mixture-of-Experts LLMs via Optimizing Routing Triggers and Infecting Dormant Expertscited by 14
  4. 2025GateBreaker: Gate-Guided Attacks on Mixture-of-Expert LLMscited by 11
  5. 2026Misrouter: Exploiting Routing Mechanisms for Input-Only Attacks on Mixture-of-Experts LLMscited by 3
  6. 2026Quantamination: Dynamic Quantization Leaks Your Data Across the Batchcited by 2
  7. 2026Securing Agentic AI: From Per-Action Checks to Trajectory Assurancecited by 1
  8. 2026GRIP: Algorithm-Agnostic Machine Unlearning for Mixture-of-Experts via Geometric Router Constraintscited by 0
  9. 2026SparSEEty: Extracting Tokens from Sparsity-Exploiting LLM Serving Systems via Deterministic Side Channelscited by 0
  10. 2026Aborted but Not Forgotten: KV-Cache Retention Breaks Rollback Consistency in Language Agentscited by 0
  11. 2026CipherGenome: Homomorphic Inference for Genomic Mixture-of-Expertscited by 0
  12. 2026When Routing Reveals Membership: Privacy Leakage from MoE Router Telemetrycited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Large Language Lobotomy: Jailbreaking Mixture-of-Experts via Expert Silencing
  2. 2025Exploiting the Experts: Unauthorized Compression in MoE-LLMs
  3. 2026RouteHijack: Routing-Aware Attack on Mixture-of-Experts LLMs
  4. 2025Who Speaks for the Trigger? Dynamic Expert Routing in Backdoored Mixture-of-Experts Transformers
  5. 2026Groundhog Bit-Flip Attack: Seeding Infinite Generation Loops in Mixture-of-Experts LLMs through Bit Flips
  6. 2026SEAL: Reinforcing Global Safety in Mixture-of-Experts through Shared Expert ALignment
  7. 2026Expert Selections In MoE Models Reveal (Almost) As Much As Text
  8. 2024Your Mixture-of-Experts LLM Is Secretly an Embedding Model For Free