Large language models (LLMs) are increasingly deployed in safety and security critical applications, raising concerns about their robustness to model parameter fault injection attacks. Recent studies have shown that bit-flip attacks (BFAs), which exploit computer main memory (i.e., DRAM) vulnerabilities to flip a small number of bits in model weights, can severely disrupt LLM behavior. However, existing BFA on LLM largely induce un-targeted failure or general performance degradation, offering limited control over manipulating specific or targeted outputs. In this paper, we present TFL, a novel targeted bit-flip attack framework that enables precise manipulation of LLM outputs for selected prompts while maintaining almost no or minor degradation on unrelated inputs. Within our TFL framework, we propose a novel keyword-focused attack loss to promote attacker-specified target tokens in generative outputs, together with an auxiliary utility score that balances attack effectiveness against collateral performance impact on benign data. We evaluate TFL on multiple LLMs (Qwen, DeepSeek, Llama) and benchmarks (DROP, GSM8K, and TriviaQA). The experiments show that TFL achieves successful targeted LLM output manipulations with less than 50 bit flips and significantly reduced effect on unrelated queries compared to prior BFA approaches. This demonstrates the effectiveness of TFL and positions it as a new class of stealthy and targeted LLM model attack.

翻译：大型语言模型（LLMs）正日益部署于安全和安防关键应用中，这引发了对其在模型参数故障注入攻击下鲁棒性的担忧。近期研究表明，比特翻转攻击（BFAs）利用计算机主存储器（即DRAM）的漏洞翻转模型权重中的少量比特，可严重破坏LLM的行为。然而，现有针对LLM的BFA主要导致非定向失效或整体性能下降，对操纵特定或定向输出的控制能力有限。本文提出TFL，一种新颖的定向比特翻转攻击框架，能够针对选定提示词精确操纵LLM的输出，同时在无关输入上保持几乎无影响或仅有轻微性能下降。在我们的TFL框架内，我们提出了一种新颖的以关键词为中心的攻击损失函数，以促进生成输出中出现攻击者指定的目标标记，同时引入一个辅助效用评分来平衡攻击效果与对良性数据的附带性能影响。我们在多个LLM（Qwen、DeepSeek、Llama）和基准测试（DROP、GSM8K和TriviaQA）上评估了TFL。实验表明，与先前的BFA方法相比，TFL以少于50次比特翻转成功实现了定向LLM输出操纵，并且对无关查询的影响显著降低。这证明了TFL的有效性，并将其定位为一类新型的隐蔽且定向的LLM模型攻击。