ACVE-2026-0217

The configuration

Configuration label

sideEffect=true

Affected entries

• Model: any — ECOSYSTEM (introduced 0)

Matcher

• all
  • model.quant exists
  • some tools
    • sideEffect eq true

Threat

Attacker

tool-provider

Vector

supply-chain

Outcome

policy-violation

Evidence

Why it is exploitable

What the vulnerability is

Quantisation can be a model-supply-chain boundary rather than a neutral compression step. R7 cites the LLM Quantization Attack work showing a model that is benign in fp16 can become malicious under standard GGUF, GPTQ, or AWQ paths, and cites HarmLevelBench reporting increased direct-attack vulnerability under AWQ/GPTQ for Vicuna-13B. Neither source supplies a single ACVE-ready per-model ASR for the arbitrary community artefact in this row. This is a qualitative supply-chain candidate, not evidence that every quantisation is poisoned.

Which configuration is exposed

The match is a locally quantised model whose HF source repository is not the upstream organisation, used by any agent with tools. A recognisable case is a community GGUF downloaded for an Ollama or llama.cpp agent, with a shell, file, browser, or network tool attached and no provenance check on the weights, template, or tokenizer. The model supplier is the attacker; sideEffect and egress determine how changed behaviour can cause harm, but approval may be present or absent.

How ACVE detects it

ACVE checks that model.quant exists and that a sideEffect tool exists. It does not yet prove the upstream organisation or compare file contents, so a community quant match is possible until model.digest, source, and provenance are recorded. A server that hides its tools is also possible. Runtime alignment changes are not inferable from the quant string; safeguards can describe a classifier, but they cannot certify the artefact’s provenance.

Fix

1. Reconfigure model.digest to an upstream-published, content-addressed quantisation from a trusted registry or signed supplier. 2. Record weights, tokenizer, template, and parameter-layer digests separately. 3. Run the safe-fixture evaluation on the exact quantised artefact before connecting side-effecting tools. 4. Keep approval enabled while validating and reject a digest change as a new model, even if the tag is unchanged.

Grounding needed

Pin the upstream fp16 commit, community quantiser repository and commit, GGUF/GPTQ/AWQ file digest, template and tokenizer, serving stack, tool set, and safe-fixture prompts. R7 confidence is L: the cited research establishes a supply-chain mechanism and qualitative vulnerability changes, but no row-specific field measurement exists. Severity is LOW because no attacker-budget ASR is available; a reproduction must create the missing paired measurement rather than invent one.

Underlying CVEs / aliases

No CVE assigned. behavioural — no code defect; evidence is an evaluation

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Pin model.digest to an upstream-published quantisation and rerun the safe fixture.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

EVIDENCE

• https://github.com/eth-sri/llm-quantization-attack
• https://arxiv.org/abs/2411.06835