Statistically Undetectable Backdoors in Deep Neural Networks

• URL: http://arxiv.org/abs/2607.09532v1
• Date: Fri, 10 Jul 2026 15:37:32 GMT
• Title: Statistically Undetectable Backdoors in Deep Neural Networks
• Abstract summary: We show how an adversarial model trainer can plant backdoors in a large class of deep, feedforward neural networks.<n> backdoors are statistically undetectable in the white-box setting, meaning that the backdoored and honestly trained models are close in total distance.
• Score: 3.400967062338203
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: We show how an adversarial model trainer can plant backdoors in a large class of deep, feedforward neural networks. These backdoors are statistically undetectable in the white-box setting, meaning that the backdoored and honestly trained models are close in total variation distance, even given the full descriptions of the models (e.g., all of the weights). The backdoor provides access to invariance-based adversarial examples for every input, mapping distant inputs to unusually close outputs. However, without the backdoor, it is provably impossible (under standard cryptographic assumptions) to generate any such adversarial examples in polynomial time. Our theoretical and preliminary empirical findings demonstrate a fundamental power asymmetry between model trainers and model users.

Related papers

• Assimilation Matters: Model-level Backdoor Detection in Vision-Language Pretrained Models [71.44858461725893]
  Given a model fine-tuned by an untrusted third party, determining whether the model has been injected with a backdoor is a critical and challenging problem.<n>Existing detection methods usually rely on prior knowledge of training dataset, backdoor triggers and targets.<n>We introduce Assimilation Matters in DETection (AMDET), a novel model-level detection framework that operates without any such prior knowledge.
  arXiv  Detail & Related papers  (2025-11-29T06:20:00Z)
• Oblivious Defense in ML Models: Backdoor Removal without Detection [10.129743924805036]
  A recent result shows that an adversary can plant undetectable backdoors in machine learning models. In this paper, we present strategies for defending backdoors in ML models, even if they are undetectable.
  arXiv  Detail & Related papers  (2024-11-05T17:20:53Z)
• Injecting Undetectable Backdoors in Obfuscated Neural Networks and Language Models [39.34881774508323]
  We investigate the threat posed by undetectable backdoors in ML models developed by external expert firms. We develop a strategy to plant backdoors to obfuscated neural networks, that satisfy the security properties of the celebrated notion of indistinguishability obfuscation. Our method to plant backdoors ensures that even if the weights and architecture of the obfuscated model are accessible, the existence of the backdoor is still undetectable.
  arXiv  Detail & Related papers  (2024-06-09T06:26:21Z)
• Model Pairing Using Embedding Translation for Backdoor Attack Detection on Open-Set Classification Tasks [63.269788236474234]
  We propose to use model pairs on open-set classification tasks for detecting backdoors. We show that this score, can be an indicator for the presence of a backdoor despite models being of different architectures. This technique allows for the detection of backdoors on models designed for open-set classification tasks, which is little studied in the literature.
  arXiv  Detail & Related papers  (2024-02-28T21:29:16Z)
• Rethinking Backdoor Attacks [122.1008188058615]
  In a backdoor attack, an adversary inserts maliciously constructed backdoor examples into a training set to make the resulting model vulnerable to manipulation. Defending against such attacks typically involves viewing these inserted examples as outliers in the training set and using techniques from robust statistics to detect and remove them. We show that without structural information about the training data distribution, backdoor attacks are indistinguishable from naturally-occurring features in the data.
  arXiv  Detail & Related papers  (2023-07-19T17:44:54Z)
• Backdoor for Debias: Mitigating Model Bias with Backdoor Attack-based Artificial Bias [22.191649793815298]
  We found that the backdoor attack can construct an artificial bias similar to the model bias derived in standard training. We propose a backdoor debiasing framework based on knowledge distillation, which effectively reduces the model bias from original data. This work advances the understanding of backdoor attacks and highlights its potential for beneficial applications.
  arXiv  Detail & Related papers  (2023-03-01T12:31:07Z)
• Universal Soldier: Using Universal Adversarial Perturbations for Detecting Backdoor Attacks [15.917794562400449]
  A deep learning model may be poisoned by training with backdoored data or by modifying inner network parameters. It is difficult to distinguish between clean and backdoored models without prior knowledge of the trigger. We propose a novel method called Universal Soldier for Backdoor detection (USB) and reverse engineering potential backdoor triggers via UAPs.
  arXiv  Detail & Related papers  (2023-02-01T20:47:58Z)
• Planting Undetectable Backdoors in Machine Learning Models [14.592078676445201]
  We show how a malicious learner can plant an undetectable backdoor into a classifier. Without the appropriate "backdoor key", the mechanism is hidden and cannot be detected by any computationally-bounded observer. We show two frameworks for planting undetectable backdoors, with incomparable guarantees.
  arXiv  Detail & Related papers  (2022-04-14T13:55:21Z)
• On the Effectiveness of Adversarial Training against Backdoor Attacks [111.8963365326168]
  A backdoored model always predicts a target class in the presence of a predefined trigger pattern. In general, adversarial training is believed to defend against backdoor attacks. We propose a hybrid strategy which provides satisfactory robustness across different backdoor attacks.
  arXiv  Detail & Related papers  (2022-02-22T02:24:46Z)
• Check Your Other Door! Establishing Backdoor Attacks in the Frequency Domain [80.24811082454367]
  We show the advantages of utilizing the frequency domain for establishing undetectable and powerful backdoor attacks. We also show two possible defences that succeed against frequency-based backdoor attacks and possible ways for the attacker to bypass them.
  arXiv  Detail & Related papers  (2021-09-12T12:44:52Z)
• Black-box Detection of Backdoor Attacks with Limited Information and Data [56.0735480850555]
  We propose a black-box backdoor detection (B3D) method to identify backdoor attacks with only query access to the model. In addition to backdoor detection, we also propose a simple strategy for reliable predictions using the identified backdoored models.
  arXiv  Detail & Related papers  (2021-03-24T12:06:40Z)
• Attack of the Tails: Yes, You Really Can Backdoor Federated Learning [21.06925263586183]
  Federated Learning (FL) lends itself to adversarial attacks in the form of backdoors during training. An edge-case backdoor forces a model to misclassify on seemingly easy inputs that are however unlikely to be part of the training, or test data, i.e., they live on the tail of the input distribution. We show how these edge-case backdoors can lead to unsavory failures and may have serious repercussions on fairness.
  arXiv  Detail & Related papers  (2020-07-09T21:50:54Z)
• Backdoors in Neural Models of Source Code [13.960152426268769]
  We study backdoors in the context of deep-learning for source code. We show how to poison a dataset to install such backdoors. We also show the ease of injecting backdoors and our ability to eliminate them.
  arXiv  Detail & Related papers  (2020-06-11T21:35:24Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.