Who Speaks for the Trigger? Dynamic Expert Routing in Backdoored Mixture-of-Experts Transformers

MoE architectures have a previously unknown vulnerability: Mixture-of-Experts language models, which route inputs to specialized subnetworks for efficiency, can be exploited through their routing preferences in ways that traditional language models cannot, representing a new class of security risk that researchers are only beginning to understand.

Backdoor attacks can be nearly undetectable: The BadSwitch framework achieved up to 100% attack success rates while maintaining normal performance on standard tasks, meaning compromised models could function perfectly normally while secretly executing malicious instructions—making detection extremely difficult through typical performance monitoring.

Triggers can be embedded during training, not just added later: Unlike previous backdoor attacks that modify data or edit models after training, BadSwitch embeds malicious triggers directly into the model's expert routing paths during pretraining, making the attack more fundamental and harder to remove.

Current defenses may be insufficient: The paper indicates BadSwitch shows "strong resilience" against existing defense mechanisms, suggesting that current safety practices for large language models may not adequately protect against this type of attack on MoE architectures.

This vulnerability affects multiple commercial models: The attack was successfully demonstrated on three major MoE architectures (Switch Transformer, QwenMoE, and DeepSeekMoE), indicating the problem is not limited to one implementation but represents a broader architectural concern as companies increasingly adopt MoE designs for efficiency.