Search papers, labs, and topics across Lattice.
This paper introduces Load Hijack, a method that exploits the routing mechanism in Mixture-of-Experts (MoE) models to create a supply-chain attack by modifying router weights in a checkpoint. The technique allows a malicious provider to concentrate token assignments on specific experts located on a single GPU, effectively causing that GPU to become a bottleneck while maintaining normal performance on untriggered inputs. Experimental results demonstrate that Load Hijack achieves a high concentration of triggered assignments (92.3% to 95.6%) and significantly increases time-to-first-token and reduces throughput under triggered conditions, highlighting the need for rigorous checkpoint audits.
Malicious modifications to router weights can turn Mixture-of-Experts models into trigger-controlled bottlenecks, revealing a critical vulnerability in AI serving architectures.
Expert parallelism (EP) is a common strategy for serving large Mixture-of-Experts (MoE) models across multiple GPUs by distributing experts among devices. Router decisions then determine both which experts process each token and which GPUs execute the resulting work. This procedure exposes a supply-chain attack surface in the serving schedule. We introduce Load Hijack, in which a malicious model provider modifies only a checkpoint's router weights, distributes the poisoned checkpoint, and retains a private trigger. When the trigger appears, the poisoned router concentrates token-to-expert assignments on experts co-located on one GPU. The resulting load makes that GPU a straggler and forces peer devices to wait, while routing on ordinary inputs remains near the clean reference. We find this conditional behavior difficult to achieve because an objective that rewards target-expert use on triggered inputs can also bias ordinary-input routing toward the same experts. To resolve this conflict, Load Hijack employs a three-stage optimization procedure that produces strong trigger-dependent concentration while keeping ordinary-input routing close to the clean reference. Across three MoE families and four corpora, Load Hijack directs 92.3% to 95.6% of triggered token assignments to the target experts. In live EP serving, triggered traffic produces 1.43x the time-to-first-token and 0.86x the throughput measured under ordinary traffic. These results show that poisoned routers can act as trigger-controlled device schedulers and motivate checkpoint audits of routing and runtime load.
