Newest papers

Poisoning-Based Backdoors Are Not Cryptographic

Masahiro Kaneko · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.28045 · cited by 0 works (OpenAlex) · open-access PDF

Japanese

バックドアに対する防御は、入力がトリガーであるかどうかを決定する検証器を回復する必要があるため、個々のトリガーをブロックすることは、新たなものを生成することができる攻撃者に対して失敗するからである。検証器が暗号認証の不対称性でインストールされる場合、攻撃者だけがトリガーを生成し、弁護士が検証器を再構築できない場合、検証器を発見した指示から検証を学ぶ防御は、原則として不可能である。我々は、検証器が毒を含むデータのラベルのみを介してトレーニングに入る場合、検証器がこのような不対称性が生じることができないことを示し、検証器が毒を含むことによってインストールされないため、検証

Machine translation (Meta M2M100); the English original follows.

Abstract

Defending against a backdoor requires recovering the verifier that decides whether an input is a trigger, since blocking individual triggers fails against an attacker who can generate new ones. If a verifier could be installed with the asymmetry of cryptographic authentication, where only the attacker can produce triggers and the defender cannot reconstruct the verifier, defense that learns the verifier from observations would be impossible in principle. We show that no such asymmetry can arise when the verifier enters training only through the labels of poisoned data, which covers the dirty-label backdoors that dominate the literature on language models. A training procedure that installs a verifier from poisoned data is itself a learner for that verifier. Hence any verifier that is hard to learn cannot be installed through poisoning, and any verifier that poisoning can install is reconstructible by a white-box defender holding as many labeled trigger observations as the attacker used. Hiding a secret key in the input or the weights does not change this. Experiments on instruction-tuned large language models confirm the dichotomy, with no configuration yielding a backdoor that is both effective for the attacker and irrecoverable for the defender.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Backdoor, Computer science, Argument (complex analysis), Computer security, Key (lock), Cryptography

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange