Newest papers

Poisoning-Based Backdoors Are Not Cryptographic

Masahiro Kaneko · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.28045 · cited by 0 works (OpenAlex) · open-access PDF

Indonesian

Pertahanan terhadap backdoor memerlukan pemulihan verifier yang memutuskan apakah input adalah trigger, karena memblokir trigger individu gagal melawan penyerang yang dapat menghasilkan yang baru. Jika verifier dapat dipasang dengan asimetri otentikasi kriptografi, di mana hanya penyerang dapat menghasilkan trigger dan pembela tidak dapat merekonstruksi verifier, pertahanan yang mempelajari verifier dari pengamatan instruksi akan menjadi mustahil pada prinsipnya. Kami menunjukkan bahwa tidak ada asimetri seperti itu dapat terjadi ketika verifier memasuki pelatihan hanya melalui label data yang diracun, yang mencakup backdoors kotor-label yang mendominasi literatur pada model bahasa. Prosedur pelatihan yang memasang verifier dari data yang diracun itu sendiri akan menjadi seorang verifier yang efektif untuk itu. Oleh karena itu, setiap verifier yang sulit dipelajari tidak dapat dipasang melalui keracunan, dan

Machine translation (Meta M2M100); the English original follows.

Abstract

Defending against a backdoor requires recovering the verifier that decides whether an input is a trigger, since blocking individual triggers fails against an attacker who can generate new ones. If a verifier could be installed with the asymmetry of cryptographic authentication, where only the attacker can produce triggers and the defender cannot reconstruct the verifier, defense that learns the verifier from observations would be impossible in principle. We show that no such asymmetry can arise when the verifier enters training only through the labels of poisoned data, which covers the dirty-label backdoors that dominate the literature on language models. A training procedure that installs a verifier from poisoned data is itself a learner for that verifier. Hence any verifier that is hard to learn cannot be installed through poisoning, and any verifier that poisoning can install is reconstructible by a white-box defender holding as many labeled trigger observations as the attacker used. Hiding a secret key in the input or the weights does not change this. Experiments on instruction-tuned large language models confirm the dichotomy, with no configuration yielding a backdoor that is both effective for the attacker and irrecoverable for the defender.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Backdoor, Computer science, Argument (complex analysis), Computer security, Key (lock), Cryptography

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange