Search papers, labs, and topics across Lattice.
This paper introduces JITterFlip, a novel bit-flip attack (BFA) that targets the host-side control plane of Just-in-Time (JIT) compiled large language model (LLM) inference, rather than the model parameters or computation directly. By leveraging decision-guided fault-vulnerable code analysis, JITterFlip identifies exploitable targets across a JIT compiler stack, enabling attacks that generate gibberish outputs and correct-output sponge attacks with significant latency amplification. The findings reveal that these vulnerabilities are transferable across different models and can bypass existing defenses, highlighting a critical security gap in cloud-hosted LLM services.
JITterFlip reveals that targeting the JIT serving control plane can amplify attack effects by over 7 million times, exposing a major vulnerability in LLM inference systems.
LLMs are widely deployed through cloud-hosted inference services, where Just-in-Time (JIT) compilation is used to reduce recurring framework and GPU-launch overhead. JIT serving introduces a host-side control plane that selects compiled artifacts and orchestrates their execution on the GPU. Meanwhile, the shared cloud setting has motivated a growing body of bit-flip attacks (BFAs) against LLM/DNN inference. Most existing BFAs target model parameters or weights and require model-specific knowledge. A smaller body of work reduces this dependency by faulting executable code, yet still corrupts code that directly implements model computation, limiting their attack effect to inference depletion. We present JITterFlip, the first BFA targeting the host-side JIT serving control plane of GPU-based LLM inference. By faulting CPU-resident serving decisions rather than model computation, JITterFlip enables both gibberish output generation and a correct-output sponge attack. To identify exploitable targets in a large JIT compiler stack, JITterFlip develops a decision-guided fault-vulnerable code analysis. Across four text and multimodal LLM workloads, the identified vulnerable code faults exhibit cross-model transferability, produce gibberish outputs with PPL ratios of $15.45\times$ to $2.48{\times}10^{6}\times$, and demonstrate correct-output sponge attacks with latency amplification of $2.03\times$ to $181.90\times$. JITterFlip also bypasses recent BFA defenses for LLMs while retaining both attack effects. Last, we demonstrate end-to-end Rowhammer attacks across four LLMs: a single bit flip in CPU-resident branch code propagates across the CPU-GPU boundary to disrupt GPU-executed inference without direct access to GPU memory, reaching up to $7.23{\times}10^{6}\times$ PPL amplification or $124.97\times$ latency amplification while preserving the exact generated output.
