Quantization-Conditioned Backdoors Reach 100% Attack Success on LLM Agents While the Full-Precision Checkpoint Passes Audits

arXiv 2609.14060·high signalXBlueskyLinkedInCopy link

AGENTQ is the first study of quantization-conditioned attacks against agents rather than free-text generation, where the triggered payload is a structured function call that executes without a human reader in the loop. Naively adapting prior backdoor-injection methods produces post-quantization misbehavior but wrecks benign utility; AGENTQ combines layer-banded LoRA injection with partial-PGD repair over a multi-codebook quantization-equivalence class to keep normal agentic capability intact. It reaches up to 100% post-quantization attack success across three trigger-action pairs and three codebooks (NF4, FP4, INT8), making quantization-aware safety evaluation a prerequisite for shipping open-weight agents.