Threat Model
The output of a large language model is usually treated as a function of the input (the prompt), the model (the weights), and a few parameters such as the seed or temperature. While generally true, the inference platform also introduces tiny variations in the rounding of computations that normally do not affect the response. We show these perturbations can be utilized to implant a trained backdoor, causing the model to behave differently depending on the platform it runs on: an adversary can ship a benign-behaving model on most platforms while, on a targeted (set of) platform(s), the model misbehaves — spreading misinformation, providing insecure code, or any other trainable malicious behaviour.
By platform we mean the whole inference stack — the GPU model and architecture, driver and kernel versions, the numerical precision or quantization — anything that changes the underlying arithmetic.
Divergence
Run the same computation on two platforms and the numbers agree to many digits before parting in the last. Different kernels and rounding nudge every value the model computes by a hair. This divergence is consistent — each platform leaves the same fingerprint every time — yet on its own it is far too small to change even a single token of the response.
The Fingerprint
Consistent as it is, this divergence is orders of magnitude smaller than the normal signal captured during inference or training, and smaller still than the difference from one token to the next. We therefore first target a fixed token that appears in every prompt: the assistant token that is part of the template structuring each request. We additionally freeze the first layers — retraining the full model would make small updates to the weights in every layer, altering their rounding behaviour and changing the very fingerprint we rely on.
Trigger Adapter
To capture and amplify this platform fingerprint we construct a contrastive loss: we forward a single prompt on different platforms and optimize the hidden state so that it (I) still generates normally, (II) concentrates the divergence into a consistent linear direction, and (III) amplifies the signal along that direction. The contrastive approach lets the optimizer isolate a signal that would otherwise drown in the token-to-token noise across prompts — and grow it large enough for a subsequent objective to key on.
Backdoor Adapter
With a reliable platform signal in hand, we show it can drive complex backdoors that trigger exclusively on the inference platform: targeted knowledge edits that spread misinformation on one platform, profiling of where a model is served, or vulnerable code generated only on specific hardware — all while the model stays benign everywhere else.
Defences
The defences we evaluate in the paper are effective against our proof of concept. But platform divergence is inherent to serving one model across heterogeneous hardware and software — so we believe this threat vector will be hard to eliminate for good without a principled fix that targets the divergence itself, rather than any single instantiation of the attack.