A computational study reports that disabling fewer than four internal experts in four real-world mixture-of-experts language models was followed by average output inflation of 5,912%. Most test samples reached the models' maximum token budget. The study does not demonstrate a live end-to-end hardware bit flip.
Mixture-of-experts, or MoE, models route each part of a response through selected internal components known as experts. The preprint asks whether some of those experts specialize in ending sequences, whether termination-related experts are associated with response length, and whether targeted bit flips can produce longer outputs.
Tracing the route to a stop signal
The researchers began with the hypothesis that experts involved in sequence termination would show sharply different activation patterns when the model generated the target token. They selected target-related experts when activation-shift scores crossed a threshold. Their LOCAL procedure tested deactivation layer by layer to identify the most influential layer, while GLOBAL selection made an overall threshold-based choice.
The structural analysis covered six open-source MoE models across three language-model modes. The bit-flip method was implemented on four models, and its performance was evaluated across four MoE architectures using 1,000 randomly selected samples per dataset. The study also included separate tests involving 10 coding sandboxes and EOT, or end-of-thinking, behavior in GPT-OSS and Qwen3.
For the software search, the researchers cached hidden states, tested individual bits by rerouting inputs, and measured changes in expert activation. The proposed online step would flip selected bits in DRAM using Rowhammer. The paper describes a successful perturbation as persisting across later queries, but the physical step was not demonstrated in a live end-to-end system.
Large increases, uneven performance
The paper's main attack measure was the Percentage of Token Generation Change, which compares attacked and baseline token counts. Utility was assessed with clean accuracy, ROUGE-1, F1 and plan steps.
In the DeepSeek results under the GLOBAL bit-flip configuration, the reported changes were large across all four listed datasets. The values were 4.64 × 10^4% for AGNews, 4.44 × 10^4% for SST-2, 3.04 × 10^3% for Samsum and 1.49 × 10^4% for SQuAD. These were reported separately, without confidence intervals or a pooled uncertainty estimate.
The results did not show uniform preservation of language performance. Perplexity was below 10 in most configurations, but the DeepSeek GLOBAL bit-flip values reached 91,839 on SST-2 and 5,288,426 on Samsum, indicating complete language-generation breakdown in those cases.
The 5,912% manual-deactivation figure is a descriptive average from the reported tests. The analysis gives no dispersion measure or inferential uncertainty for it, so the result does not show how widely the individual outcomes varied.
The pattern also appeared in planning tests
In 10 coding sandboxes, the mean change in plan-token use was 8.6% with LOCAL selection and 576.2% with GLOBAL selection. The supplied analysis also notes a conflicting nearby prose figure of 501.5% for GLOBAL, making the tabulated mean the clearer reported value.
A separate EOT experiment involving GPT-OSS and Qwen3 reported longer thinking sequences after EOT-related expert deactivation. In one extreme case, the sequence exhausted the token budget before the expected answer. No pooled estimate or uncertainty interval was reported for this result.
The reported effect persisted under greedy decoding, temperature sampling and nucleus sampling. Attacked EOS rates ranged from 0.22 to 0.61, compared with approximately 1.0 at baseline, while output length also increased. The attack remained effective with a repetition penalty, although that setting also lengthened the baseline independently.
What the study does not establish
The practical scenario assumes white-box access and targeted bit injection. It also depends on a hardware fault-injection step whose full cost would vary with memory placement and bit-flip reliability. The study does not demonstrate a live end-to-end hardware bit flip.
That leaves the central result conditional on the computational setup and the assumed fault-injection scenario. The reported experiments show what happened after manual expert deactivation or software-applied router perturbations, while the proposed Rowhammer route to changing DRAM bits remains unmeasured for reliability.
The document is a preprint labeled arXiv:2608.25276v1 and dated 26 Aug 2026. Its acknowledgments say that high-performance computational resources were provided by Louisiana State University and the Louisiana Optical Network Infrastructure.
Paper data and sources
Original title: Groundhog Bit-Flip Attack: Seeding Infinite Generation Loops in Mixture-of-Experts LLMs through Bit Flips
Authors: Huakang Lin, Tiancheng Zheng, Mingxuan Sun et al.
Journal/Repository: arXiv
Status: Preprint, not yet peer-reviewed
First online: 2026-08-26
DOI: Not available
Original paper · Full text