What type of study is this?

This is a Experimental Study study (also classified as: Quantitative Study).

October 5, 2025Open Access

Has the Two-Decade-Old Prophecy Come True? Artificial Bad Intelligence Triggered by Merely a Single-Bit Flip in Large Language Models

YYYan YuQiqihar University SLSiqi LuFujian Medical University YGYang GaoChildren's Hospital of Chongqing Medical University

Key Points

Single-bit vulnerabilities in large language models can lead to severe failures in reasoning and dangerous output.
Experimental results show that targeted attacks can drastically reduce accuracy from 73.5% to 0% in merely seconds.
A new model, BitSifter, identifies critical bits in LLMs, particularly within sensitive tensor regions affecting performance.
Model size is negatively correlated with robustness, making smaller models more vulnerable to bit-flip attacks.

Abstract

Recently, Bit-Flip Attack (BFA) has garnered widespread attention for its ability to compromise software system integrity remotely through hardware fault injection. With the widespread distillation and deployment of large language models (LLMs) into single file .gguf formats, their weight spaces have become exposed to an unprecedented hardware attack surface. This paper is the first to systematically discover and validate the existence of single-bit vulnerabilities in LLM weight files: in mainstream open-source models (e.g., DeepSeek and QWEN) using .gguf quantized formats, flipping just single bit can induce three types of targeted semantic level failures Artificial Flawed Intelligence (outputting factual errors), Artificial Weak Intelligence (degradation of logical reasoning capability), and Artificial Bad Intelligence (generating harmful content). By building an information theoretic weight sensitivity entropy model and a probabilistic heuristic scanning framework called BitSifter, we achieved efficient localization of critical vulnerable bits in models with hundreds of millions of parameters. Experiments show that vulnerabilities are significantly concentrated in the tensor data region, particularly in areas related to the attention mechanism and output layers, which are the most sensitive. A negative correlation was observed between model size and robustness, with smaller models being more susceptible to attacks. Furthermore, a remote BFA chain was designed, enabling semantic-level attacks in real-world environments: At an attack frequency of 464.3 times per second, a single bit can be flipped with 100% success in as little as 31.7 seconds. This causes the accuracy of LLM to plummet from 73.5% to 0%, without requiring high-cost equipment or complex prompt engineering.

اسأل الذكاء الاصطناعي

Bookmark

View Full Paper