Title: BadMoE: Backdooring Mixture-of-Experts LLMs via Optimizing Routing Triggers and Infecting Dormant Experts
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Mixture-of-Experts LLMs, backdoor attack, Routing Optimization

Abstract: Mixture-of-Experts (MoE) architectures are rapidly becoming the standard for building scalable, 
efficient large language models (LLMs). However, 
the core principle of MoE, which routes tokens to specialized experts, creates a largely overlooked attack surface. In this work, we propose BadMoE, a novel backdoor attack that exploits this vulnerability. We first prove the existence of ''dominating experts'' in MoE that can determine the output. Building on this insight, BadMoE poisons ``dormant'' (underutilized) experts and utilizes routing-aware triggers to activate them, enabling stealthy and effective manipulation. 
 Specifically, BadMoE involves three steps: 1) identifying dormant experts unrelated to the target task, 2) optimizing a routing-aware trigger toward these experts, and 3) promoting them to dominating roles through training data. 
Extensive experiments on three MoE LLMs across multiple backdoor tasks show that BadMoE, using only two injected experts, can reliably control outputs, outperform existing attacks, and evade current defenses. 
By exploiting architectural sparsity and dynamic usage profiling, our approach uncovers backdoor vulnerabilities overlooked by traditional methods, highlighting critical risks in MoE architectures and calling for a reevaluation of current LLM security paradigms.