The Blind Spots of Detection: Adversarial Perturbation Attacks against Watchdogs in Distributed LLM Inference
Decentralizing large language model (LLM) inference across untrusted Web nodes requires robust verification to ensure computational integrity. Existing activation-based verification and detection mechanisms validate intermediate outputs against reference values, permitting bounded numerical deviations to accommodate benign cross-hardware discrepancies. However, a critical security question remains: what can a malicious worker achieve while operating within these tolerance bounds? In this work, we introduce Hush-Up, a stealthy availability attack against distributed LLM inference, where a single malicious worker halts generation while evading attribution. The attacker first profiles its local execution to model an empirical bound of benign hardware errors. Using this error bound as a feasibility constraint, the attacker optimizes an adversarial perturbation on its output activations to maximize the final-layer probability of the end-of-sequence (EOS) token, i.e., to hush up the model. Across diverse models and benchmarks, Hush-Up effectively forces premature generation termination and collapses model capabilities. Furthermore, the attack hushes up the watchdogs themselves: existing defenses often fail to detect the sabotage entirely or falsely attribute the amplified downstream anomalies to honest workers. Our findings expose a fundamental gap between local numerical verification and end-to-end accountability: perturbations too small to indict a worker locally can nevertheless be powerful enough to break distributed inference globally.