System Prompt Hijacking via Permutation Triggers in LLM Supply Chains

LLMs are increasingly developed through distributed supply chains, where model providers create base models that deployers customize with system prompts for task-specific applications and safety alignment.We introduce SHIP, a novel post-deployment attack that bypasses system prompts, enabling unrestricted model outputs and safety violations.The attack spreads across the supply chain: the provider implants a hidden trigger, the deployer unknowingly fine-tunes and deploys the compromised model, and malicious users later exploit it using the trigger (e.g., obtained via underground market), as real-world software supply chain breaches.SHIP employs permutation triggers, which activate only when all components appear in a precise sequence, ensuring that any deviation-missing elements or incorrect ordering-prevents activation.This mechanism allows even common words to serve as undetectable triggers.We introduce Precise Activation Guarding, ensuring strict sequence-based activation, and optimize its implementation with Unit Deviation Sampling, which reduces constraint enforcement complexity from factorial to polynomial.Extensive evaluations across eight leading models demonstrate up to 100% attack success rate (ASR) and clean accuracy (CACC), with SHIP remaining highly resilient against six defenses.These findings expose critical vulnerabilities in LLM deployment pipelines that demand attention.