<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="liu-yan-2026-agentq">
    <titleInfo>
        <title>AGENTQ: Quantization-Conditioned Backdoor Attacks on LLM Agents</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Xiaoqun</namePart>
        <namePart type="family">Liu</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Qiben</namePart>
        <namePart type="family">Yan</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Hung-Yi</namePart>
            <namePart type="family">Lee</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Sunipa</namePart>
            <namePart type="family">Dev</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Jessy</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Desmond</namePart>
            <namePart type="family">Elliott</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-459-0</identifier>
    </relatedItem>
    <abstract>Quantization is one of the default deployment path for open-weight LLM agents, but it is not behavior-preserving: an adversary can release a full-precision checkpoint that passes audits yet misbehaves once quantized, termed as quantization-conditioned attack (QCA). Prior QCA work targets free-text generation, where harm is mediated by a human reader. In contrast, the agentic setting poses a more severe risk: the triggered payload is a structured tool call that can be executed without human oversight. We present the first study of QCA against LLM agents. We find that directly adapting prior backdoor-injection methods can produce malicious behavior after quantization, but substantially degrades benign utility, rendering the resulting attacks impractical. To understand the true upper bound of the threat, we propose AgentQ, an attack framework that combines layer-banded LoRA injection with partial-PGD repair over a multi-codebook quantization-equivalence class. AgentQ preserves normal tool-calling capability while concentrating malicious behavior in the quantized model. Across three trigger–action pairs and three codebooks (NF4, FP4, INT8), AgentQ reaches up to 100% post-quantization attack success rate with minimal loss of benign utility, underscoring the need to make quantization-aware safety evaluation a standard requirement before open-weight agents are released or deployed.</abstract>
    <identifier type="citekey">liu-yan-2026-agentq</identifier>
    <location>
        <url>https://aclanthology.org/2026.emnlp-main.1566/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>35693</start>
            <end>35709</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T AGENTQ: Quantization-Conditioned Backdoor Attacks on LLM Agents
%A Liu, Xiaoqun
%A Yan, Qiben
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F liu-yan-2026-agentq
%X Quantization is one of the default deployment path for open-weight LLM agents, but it is not behavior-preserving: an adversary can release a full-precision checkpoint that passes audits yet misbehaves once quantized, termed as quantization-conditioned attack (QCA). Prior QCA work targets free-text generation, where harm is mediated by a human reader. In contrast, the agentic setting poses a more severe risk: the triggered payload is a structured tool call that can be executed without human oversight. We present the first study of QCA against LLM agents. We find that directly adapting prior backdoor-injection methods can produce malicious behavior after quantization, but substantially degrades benign utility, rendering the resulting attacks impractical. To understand the true upper bound of the threat, we propose AgentQ, an attack framework that combines layer-banded LoRA injection with partial-PGD repair over a multi-codebook quantization-equivalence class. AgentQ preserves normal tool-calling capability while concentrating malicious behavior in the quantized model. Across three trigger–action pairs and three codebooks (NF4, FP4, INT8), AgentQ reaches up to 100% post-quantization attack success rate with minimal loss of benign utility, underscoring the need to make quantization-aware safety evaluation a standard requirement before open-weight agents are released or deployed.
%U https://aclanthology.org/2026.emnlp-main.1566/
%P 35693-35709

Markdown (Informal)

[AGENTQ: Quantization-Conditioned Backdoor Attacks on LLM Agents](https://aclanthology.org/2026.emnlp-main.1566/) (Liu & Yan, EMNLP 2026)

• AGENTQ: Quantization-Conditioned Backdoor Attacks on LLM Agents (Liu & Yan, EMNLP 2026)

ACL

• Xiaoqun Liu and Qiben Yan. 2026. AGENTQ: Quantization-Conditioned Backdoor Attacks on LLM Agents. In Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing, pages 35693–35709, Budapest, Hungary. Association for Computational Linguistics.