Undetectable Backdoors in Model Parameters: Hiding Sparse Secrets in High Dimensions
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2026
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866914532493885440 |
|---|---|
| author | Choudhary, Sarthak Patlan, Atharv Singh Palumbo, Nils Hooda, Ashish Fawaz, Kassem Jha, Somesh |
| author_facet | Choudhary, Sarthak Patlan, Atharv Singh Palumbo, Nils Hooda, Ashish Fawaz, Kassem Jha, Somesh |
| contents | We present Sparse Backdoor, a supply-chain attack that plants a \emph{provably undetectable} backdoor in pre-trained image classifiers, including convolutional networks and Vision Transformers. The attack injects a structured sparse perturbation along a randomly chosen direction into a small subset of columns at each fully connected layer, propagating a trigger signal to an adversary-chosen target class, and masks the perturbation with an independent isotropic Gaussian dither. The dither serves a single technical purpose: it induces a clean reference distribution anchored at the pre-trained weights, against which undetectability can be formalized. Under a mild margin condition on the pre-trained classifier, we show that the dithered reference is functionally equivalent to the original classifier. We prove that distinguishing the backdoor-injected model from this reference is at least as hard as Sparse PCA detection, which is computationally infeasible under standard hardness assumptions. The guarantee holds against any probabilistic polynomial-time distinguisher with white-box access to the parameters. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2605_04209 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Undetectable Backdoors in Model Parameters: Hiding Sparse Secrets in High Dimensions Choudhary, Sarthak Patlan, Atharv Singh Palumbo, Nils Hooda, Ashish Fawaz, Kassem Jha, Somesh Cryptography and Security Artificial Intelligence Machine Learning We present Sparse Backdoor, a supply-chain attack that plants a \emph{provably undetectable} backdoor in pre-trained image classifiers, including convolutional networks and Vision Transformers. The attack injects a structured sparse perturbation along a randomly chosen direction into a small subset of columns at each fully connected layer, propagating a trigger signal to an adversary-chosen target class, and masks the perturbation with an independent isotropic Gaussian dither. The dither serves a single technical purpose: it induces a clean reference distribution anchored at the pre-trained weights, against which undetectability can be formalized. Under a mild margin condition on the pre-trained classifier, we show that the dithered reference is functionally equivalent to the original classifier. We prove that distinguishing the backdoor-injected model from this reference is at least as hard as Sparse PCA detection, which is computationally infeasible under standard hardness assumptions. The guarantee holds against any probabilistic polynomial-time distinguisher with white-box access to the parameters. |
| title | Undetectable Backdoors in Model Parameters: Hiding Sparse Secrets in High Dimensions |
| topic | Cryptography and Security Artificial Intelligence Machine Learning |
| url | https://arxiv.org/abs/2605.04209 |