Newest papers

Poisoning-Based Backdoors Are Not Cryptographic

Masahiro Kaneko · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.28045 · cited by 0 works (OpenAlex) · open-access PDF

Spanish

Para proteger contra los ataques de backdoor de confirmación en las redes neuronales, el defensor debe identificar la función de verificación que determina si una entrada es un desencadenante, en lugar de rechazar los grandes desencadenantes individuales en aislamiento, ya que un atacante puede generar nuevos triggers satisfaciendo el mismo verificador más rápido de lo que pueden ser bloqueados. Si no se puede instalar una verificación de backdoor con la asimetría de un esquema de autenticación criptográfica, en el que solo el atacante puede producir entradas de desencadenante, mientras que el defensor no puede revertir el argumento del verificador de las mismas observaciones, la defensa basada en el aprendizaje sería imposible en principio. Mostramos que no puede surgir tal asimetría de la instalación basada en el envenenamiento, en la que el

Machine translation (Meta M2M100); the English original follows.

Abstract

To defend against backdoor attacks on neural networks, the defender must identify the verifier function that determines whether an input is a trigger, rather than rejecting individual triggers in isolation, since an attacker can generate new triggers satisfying the same verifier faster than they can be blocked. If a backdoor verifier could be installed with the asymmetry of a cryptographic authentication scheme, in which only the attacker can produce trigger inputs while the defender cannot reverse-engineer the verifier from observations, learning-based defense would be impossible in principle. We show that no such asymmetry can arise from poisoning-based installation, in which the only verifier-dependent input to training is a poisoned dataset. The argument is a reduction. A training procedure that installs a verifier from poisoned data, so that the backdoor fires on unseen triggers while benign behavior is preserved, is itself a learner for that verifier. Any verifier that is computationally hard to learn is therefore impossible to install through poisoning, and any verifier that poisoning can install is reconstructible by a white-box defender holding comparably many labeled trigger observations. A complementary argument shows that a secret key supplied to the model at inference is observable to the same defender. The result takes representative trigger observations as given and concerns when the backdoor fires rather than what it does. Experiments on instruction-tuned large language models confirm the dichotomy, with no configuration yielding a backdoor that is both effective for the attacker and irrecoverable for the defender.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Backdoor, Computer science, Argument (complex analysis), Computer security, Key (lock), Cryptography

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange