mlsanityData to 14 Oct 2026

FloatDoor: Platform-Triggered Backdoors in LLMs

arXiv 2606.19535 ↗First posted 17 Jun 2026cs.CR cs.LGcited by 2

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

Large language models (LLMs) are increasingly deployed in sensitive settings such as software engineering, where their outputs directly shape downstream artifacts. Recent work has shown that an identical model can produce measurably different outputs depending on the deployment platform, a consequence of non-associative floating-point arithmetic and divergent kernel implementations. We study the security implications of this platform-dependent variability and uncover a novel attack surface on LLM deployments. We introduce FloatDoor, the first input-independent, platform-triggered backdoor attack against generative LLMs. The compromised model exhibits adversary-chosen behavior when served on a target platform and is otherwise benign. FloatDoor is realized through two lightweight LoRA adapters, one that amplifies inter-platform numerical divergence and one that binds the resulting platform signature to a malicious downstream task, while leaving aggregate model utility largely intact. FloatDoor exploits a pronounced time-of-check, time-of-use gap between model auditing and serving. We demonstrate FloatDoor on Qwen3-4B across a broad range of deployment targets, including NVIDIA GPUs, Google TPUs, AWS Graviton, and Alibaba Yitian-710. As a final case study, we show that FloatDoor reliably induces exploitable code vulnerabilities on a chosen target platform. Our results establish a new class of attacks on LLM deployments and underscore the pressing need for trusted model supply chains in sensitive, LLM-powered applications.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 31 of its 35 references that are in the map. First posted on arXiv 17 Jun 2026.

Builds on

31 of 35 references.

Closest ancestors · 1

Same direction, newest first

  1. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training10 Jan

Other references · 30

  1. 2025Qwen3 Technical Reportcited by 8,820
  2. 2020Measuring Massive Multitask Language Understandingcited by 7,963
  3. 2023Efficient Memory Management for Large Language Model Serving with PagedAttentioncited by 5,944
  4. 2019HellaSwag: Can a Machine Really Finish Your Sentence?cited by 4,100
  5. 2019HuggingFace's Transformers: State-of-the-art Natural Language Processingcited by 2,218
  6. 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,085
  7. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
  8. 2023A Simple and Effective Pruning Approach for Large Language Modelscited by 800
  9. 2023Instruction Tuning with GPT-4cited by 686
  10. 2024WildChat: 1M ChatGPT Interaction Logs in the Wildcited by 629
  11. 2021Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributionscited by 431
  12. 2024OpenMathInstruct-2: Accelerating AI for Math with Massive Open-Source Instruction Datacited by 200
18 more
  1. 2024OpenCoder: The Open Cookbook for Top-Tier Code Large Language Modelscited by 130
  2. 2025Understanding and Mitigating Numerical Sources of Nondeterminism in LLM Inferencecited by 53
  3. 2020Exploiting Verified Neural Networks via Floating Point Numerical Errorcited by 35
  4. 2021Quantization Backdoors to Deep Learning Commercial Frameworkscited by 29
  5. 2022Architectural Backdoors in Neural Networkscited by 25
  6. 2021Qu-ANTI-zation: Exploiting Quantization Artifacts for Achieving Adversarial Outcomescited by 19
  7. 2021Stealthy Backdoors as Compression Artifactscited by 18
  8. 2025Deterministic Inference across Tensor Parallel Sizes That Eliminates Training-Inference Mismatchcited by 14
  9. 2022Widespread Underestimation of Sensitivity in Differentially Private Libraries and How to Fix Itcited by 8
  10. 2024Hardware and Software Platform Inferencecited by 7
  11. 2025Your Compiler is Backdooring Your Model: Understanding and Exploiting Compilation Inconsistency Vulnerabilities in Deep Learning Compilerscited by 7
  12. 2024Locking Machine Learning Models into Hardwarecited by 6
  13. 2021Forensicability of Deep Neural Network Inference Pipelinescited by 5
  14. 2025Watch your steps: Dormant Adversarial Behaviors that Activate upon LLM Finetuningcited by 5
  15. 2026Hidden Reliability Risks in Large Language Models: Systematic Identification of Precision-Induced Output Disagreementscited by 5
  16. 2021iNNformant: Boundary Samples as Telltale Watermarkscited by 3
  17. 2025Smaller = Weaker? Benchmarking Robustness of Quantized LLMs in Code Generationcited by 3
  18. 2026Hardware-Triggered Backdoorscited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026ServeGuard: Verifiable, Bounded-Residual Confinement of Operator-Invisible Channels Without Revealing the Certified Read Factorcited by 0
  2. 2026Logit Leakage through Floating-Point Bias Additioncited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Instruction Backdoor Attacks Against Customized LLMs
  2. 2024ASPIRER: Bypassing System Prompts With Permutation-based Backdoors in LLMs
  3. 2026MetaBackdoor: Exploiting Positional Encoding as a Backdoor Attack Surface in LLMs
  4. 2026Securing LLMs in the Wild: Privacy and Security Challenges at the Edge
  5. 2024Chain-of-Scrutiny: Detecting Backdoor Attacks for Large Language Models
  6. 2025Backdoor Collapse: Eliminating Unknown Threats via Known Backdoor Aggregation in Language Models
  7. 2026BadDLM: Backdooring Diffusion Language Models with Diverse Targets
  8. 2025Large Language Models Can Verbatim Reproduce Long Malicious Sequences