{"slug": "floatdoor-platform-triggered-backdoors-in-llms", "title": "FloatDoor: Platform-Triggered Backdoors in LLMs", "summary": "A June 17, 2026 arXiv paper introduces FloatDoor, which the authors describe as the first input-independent, platform-triggered backdoor attack against generative LLMs, causing a compromised model to behave maliciously only when served on a chosen target platform. FloatDoor uses two lightweight LoRA adapters — one amplifying inter-platform floating-point divergence and one binding the resulting platform signature to a malicious task — and was demonstrated on Qwen3-4B across NVIDIA GPUs, Google TPUs, AWS Graviton and Alibaba Yitian-710, including a case study inducing exploitable code vulnerabilities on a target platform. The authors argue the attack exploits a time-of-check, time-of-use gap between model auditing and serving, and call for trusted model supply chains in sensitive LLM-powered applications.", "body_md": "# Computer Science > Cryptography and Security\n\n  [Submitted on 17 Jun 2026]\n\n# Title:FloatDoor: Platform-Triggered Backdoors in LLMs\n\n[View PDF](https://arxiv.org/pdf/2606.19535)\n\n[HTML (experimental)](https://arxiv.org/html/2606.19535v1)\n\nAbstract:Large language models (LLMs) are increasingly deployed in sensitive settings such as software engineering, where their outputs directly shape downstream artifacts. Recent work has shown that an identical model can produce measurably different outputs depending on the deployment platform, a consequence of non-associative floating-point arithmetic and divergent kernel implementations. We study the security implications of this platform-dependent variability and uncover a novel attack surface on LLM deployments. We introduce FloatDoor, the first input-independent, platform-triggered backdoor attack against generative LLMs. The compromised model exhibits adversary-chosen behavior when served on a target platform and is otherwise benign. FloatDoor is realized through two lightweight LoRA adapters, one that amplifies inter-platform numerical divergence and one that binds the resulting platform signature to a malicious downstream task, while leaving aggregate model utility largely intact. FloatDoor exploits a pronounced time-of-check, time-of-use gap between model auditing and serving. We demonstrate FloatDoor on Qwen3-4B across a broad range of deployment targets, including NVIDIA GPUs, Google TPUs, AWS Graviton, and Alibaba Yitian-710. As a final case study, we show that FloatDoor reliably induces exploitable code vulnerabilities on a chosen target platform. Our results establish a new class of attacks on LLM deployments and underscore the pressing need for trusted model supply chains in sensitive, LLM-powered applications.\n    \n\n### References & Citations\n\nLoading...\n\n# Bibliographic and Citation Tools\n\nBibliographic Explorer \n\n*(*[What is the Explorer?](https://info.arxiv.org/labs/showcase.html#arxiv-bibliographic-explorer))\nConnected Papers \n\n*(*[What is Connected Papers?](https://www.connectedpapers.com/about))\nLitmaps \n\n*(*[What is Litmaps?](https://www.litmaps.co/))\nscite Smart Citations \n\n*(*[What are Smart Citations?](https://www.scite.ai/))\n# Code, Data and Media Associated with this Article\n\nalphaXiv \n\n*(*[What is alphaXiv?](https://alphaxiv.org/))\nCatalyzeX Code Finder for Papers \n\n*(*[What is CatalyzeX?](https://www.catalyzex.com))\nDagsHub \n\n*(*[What is DagsHub?](https://dagshub.com/))\nGotit.pub \n\n*(*[What is GotitPub?](http://gotit.pub/faq))\nHugging Face \n\n*(*[What is Huggingface?](https://huggingface.co/huggingface))\nScienceCast \n\n*(*[What is ScienceCast?](https://sciencecast.org/welcome))\n# Demos\n\n# Recommenders and Search Tools\n\nInfluence Flower \n\n*(*[What are Influence Flowers?](https://influencemap.cmlab.dev/))\nCORE Recommender \n\n*(*[What is CORE?](https://core.ac.uk/services/recommender))\n# arXivLabs: experimental projects with community collaborators\n\narXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.\n\nBoth individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.\n\nHave an idea for a project that will add value for arXiv's community? [**Learn more about arXivLabs**](https://info.arxiv.org/labs/index.html).", "url": "https://wpnews.pro/news/floatdoor-platform-triggered-backdoors-in-llms", "canonical_source": "https://arxiv.org/abs/2606.19535", "published_at": "2026-10-19 20:36:33+00:00", "updated_at": "2026-10-19 20:46:28.328294+00:00", "lang": "en", "topics": ["ai-safety", "large-language-models", "ai-research", "ai-policy"], "entities": ["FloatDoor", "Qwen3-4B", "NVIDIA", "Google TPUs", "AWS Graviton", "Alibaba Yitian-710", "arXiv"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/floatdoor-platform-triggered-backdoors-in-llms", "markdown": "https://wpnews.pro/news/floatdoor-platform-triggered-backdoors-in-llms.md", "text": "https://wpnews.pro/news/floatdoor-platform-triggered-backdoors-in-llms.txt", "jsonld": "https://wpnews.pro/news/floatdoor-platform-triggered-backdoors-in-llms.jsonld"}}