Hush-Up targets computation inside a distributed model-serving pipeline, not a web prompt. An attacker controlling one inference worker injects a bounded perturbation into prefill activations with the objective of promoting an end-of-sequence token. In the reported nine model-benchmark combinations, clean task success ranged from 70.83% to 98.33%. Under…
Inspect the ClaimsCase · DiggingBeagle record
A malicious inference worker can redirect outputs without modifying prompts
Hush-Up studies compromised GPU execution that perturbs intermediate activations; controlled tests report 92.31% early stopping, not live exploitation.
Public disclosure: Nov 2, 2026
Scope
Distributed-inference laboratory experiments, not verified compromise of a public inference provider.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- AI role
- AGAINST AI
Basis and provenance
The primary study measures nine model-benchmark combinations with clean and equal-magnitude random-perturbation controls, plus four watchdogs. The attacker is one controlled distributed worker. The reported failures are a research demonstration and do not verify the state of public production inference services or the efficacy of any deployed attestation mechanism.. Impact is ungraded because no independently measured production-target impact or victim scope is established by this record.
Assessed Nov 4, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-NOV04-HUSHUP-INFERENCE-WORKER-1 · CLM-NOV04-HUSHUP-INFERENCE-WORKER-2 · CLM-NOV04-HUSHUP-INFERENCE-WORKER-3 · Hush-Up: hidden-state manipulation by a malicious distributed inference worker
At a glance
Model artifact signing alone is not sufficient when a deployment relies on untrusted compute nodes. Worker admission, attested execution, cross-checks and limited access to sensitive requests matter at the inference stage.
Read the implicationsIndependent reproduction and observability of tampering in real tensor-parallel inference are not established. The experiments do not demonstrate malicious actor attribution or stolen data from public users. A checkpoint digest alone cannot establish integrity of intermediate tensor outputs; practical worker attestation and independent computation sampling…
Limits and uncertaintyFull account
Hush-Up targets computation inside a distributed model-serving pipeline, not a web prompt. An attacker controlling one inference worker injects a bounded perturbation into prefill activations with the objective of promoting an end-of-sequence token. In the reported nine model-benchmark combinations, clean task success ranged from 70.83% to 98.33%. Under attack it averaged 2.96%, with 92.31% of attacked generations ending within their first 30 tokens. Those are separate reported statistics; the 70.83% to 98.33% range describes clean conditions, not the attacked output. Primary study.
The authors compared optimized activation perturbations with same-budget Gaussian and uniform noise, under which generation and task completion largely survived. The distinction is directional: the worker modifies values that a downstream component treats as honest intermediate computation. Four activation watchdogs were also evaluated. Ten of twelve model-watchdog pairings did not correctly attribute the malicious worker, even under the study's oracle-assisted attribution protocol. Detection of an abnormal output and identification of the worker responsible are different controls. This is a researcher-constructed distributed inference setting; it does not show compromise at a named commercial inference operator or establish a working provider-independent attestation defense.
A signed checkpoint could pass artifact checks while a compromised worker alters the inference result in memory. The relevant acceptance test therefore separates weight artifact integrity, worker execution integrity and independently verified output effects. For a separate way to change agent behavior before execution, see Kerkoporta, which changes learned model behavior rather than activations in transit.
Mechanism and trust boundary
- 01
Gain a distributed inference worker
The threat model grants the adversary control over one worker participating in an otherwise legitimate model execution.
Boundary: Orchestrated inference trust to individual GPU worker
- 02
Alter hidden activations mid-computation
Small manipulations are applied to intermediate activation tensors while other model components and the user prompt remain unchanged.
Boundary: Internal model execution to untrusted computation result
- 03
Return a degraded or redirected response
The resulting model continues from tampered hidden states, with early termination observed in the controlled evaluation.
Boundary: Compromised worker result to final model output
Claims & evidence
CLM-NOV04-HUSHUP-INFERENCE-WORKER-1The study demonstrates that a single compromised worker can perturb hidden activations to change downstream model behavior without a user-visible prompt change.supported
Basis: reported finding
- supportsHush-Up: hidden-state manipulation by a malicious distributed inference workerprimary disclosure
Threat model and attack design
CLM-NOV04-HUSHUP-INFERENCE-WORKER-2The researchers report a 92.31% early-stop success rate under their evaluated configurations.supported
Basis: reported finding
- supportsHush-Up: hidden-state manipulation by a malicious distributed inference workerprimary disclosure
Early-stop outcome measurements
CLM-NOV04-HUSHUP-INFERENCE-WORKER-3In the authors' oracle-assisted attribution evaluation, ten of twelve model-watchdog configurations failed to identify the malicious worker correctly.supported
Basis: reported finding
- supportsHush-Up: hidden-state manipulation by a malicious distributed inference workerprimary disclosure
Abstract and Section 5.2, Watchdog Effectiveness, Table 2
Implications
Model artifact signing alone is not sufficient when a deployment relies on untrusted compute nodes. Worker admission, attested execution, cross-checks and limited access to sensitive requests matter at the inference stage.
Controls and mitigations
- Bind model artifact and worker identity to recorded execution and placement evidence.
- Challenge or cross-validate selected sensitive outputs through independently trusted execution paths.
- Treat cross-worker tensor transfer as a security boundary and limit who can modify it.
Unknowns and contradictions
- Independent reproduction and observability of tampering in real tensor-parallel inference are not established.
- The experiments do not demonstrate malicious actor attribution or stolen data from public users.
- A checkpoint digest alone cannot establish integrity of intermediate tensor outputs; practical worker attestation and independent computation sampling require separate evaluation.
Sources and citation
Material revision history
- Nov 4, 2026 · Published version · first publication · revision 217