Newest papers

Poisoning-Based Backdoors Are Not Cryptographic

Masahiro Kaneko · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.28045 · cited by 0 works (OpenAlex) · open-access PDF

Portuguese

Para se defender contra os ataques de backdoor de confirmação em redes neurais, o defensor deve identificar a função de verificação que determina se uma entrada é um gatilho, em vez de rejeitar os gatilhos individuais em isolamento, uma vez que um atacante pode gerar novos gatilhos satisfazendo o mesmo verificador mais rapidamente do que eles podem ser bloqueados. Se um verificador de backdoor não puder ser instalado com a assimetria de uma instalação baseada em envenenamento, na qual o único verificador dependente de uma entrada criptográfica é um conjunto de dados envenenado. O argumento é uma redução, enquanto o defensor não pode reverter o verificador a partir dos mesmos dados de observação, a defesa baseada em aprendizagem seria impossível em princípio. Mostramos que a assimetria não pode surgir

Machine translation (Meta M2M100); the English original follows.

Abstract

To defend against backdoor attacks on neural networks, the defender must identify the verifier function that determines whether an input is a trigger, rather than rejecting individual triggers in isolation, since an attacker can generate new triggers satisfying the same verifier faster than they can be blocked. If a backdoor verifier could be installed with the asymmetry of a cryptographic authentication scheme, in which only the attacker can produce trigger inputs while the defender cannot reverse-engineer the verifier from observations, learning-based defense would be impossible in principle. We show that no such asymmetry can arise from poisoning-based installation, in which the only verifier-dependent input to training is a poisoned dataset. The argument is a reduction. A training procedure that installs a verifier from poisoned data, so that the backdoor fires on unseen triggers while benign behavior is preserved, is itself a learner for that verifier. Any verifier that is computationally hard to learn is therefore impossible to install through poisoning, and any verifier that poisoning can install is reconstructible by a white-box defender holding comparably many labeled trigger observations. A complementary argument shows that a secret key supplied to the model at inference is observable to the same defender. The result takes representative trigger observations as given and concerns when the backdoor fires rather than what it does. Experiments on instruction-tuned large language models confirm the dichotomy, with no configuration yielding a backdoor that is both effective for the attacker and irrecoverable for the defender.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Backdoor, Computer science, Argument (complex analysis), Computer security, Key (lock), Cryptography

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange