Research map / Adversarial robustness and security / Backdoor and poisoning
Injecting Undetectable Backdoors in Obfuscated Neural Networks and Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows how an insidious firm can plant white-box undetectable, non-replicable backdoors in neural networks released via an iO-based obfuscation pipeline, and extends the idea to language models using steganography.
Problem
Undetectable backdoors in ML models: existing white-box undetectable constructions only covered specific training algorithms (RFF), and it was open whether general models under white-box access can hide backdoors, especially when models are released after obfuscation.
Approach
Convert the trained ANN to a Boolean circuit, plant a PRG-seed plus digital-signature backdoor in the least significant input bits, obfuscate the backdoored circuit with iO, and convert back to an ANN; the PRG-vs-random hiding argument makes the backdoor indistinguishable from the honest obfuscated model even under white-box access.
Key results
- Theorem: under one-way functions and iO, any honest obfuscated pipeline admits a white-box undetectable and non-replicable backdoor for ANNs.
- Extends the backdoor construction to obfuscated language models via a steganographic function, with white-box undetectability.
- Purely theoretical; no experiments are reported.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| inject a PRG- and signature-triggered backdoor before iO obfuscation | obfuscated ANN classifier · white-box model access | backdoor detectability | Helped |
| inject a PRG- and signature-triggered backdoor before iO obfuscation | obfuscated ANN classifier · backdoor activation | input perturbation and output error | Helped |
| use a steganographic trigger and iO-obfuscated backdoor circuit | obfuscated language model · white-box model access | backdoor detectability | Helped |
| use a steganographic trigger without digital-signature verification | obfuscated language model · backdoor replication | non-replicability | Mixed |
Limitations
- Purely theoretical with no practical instantiation; relies on iO, which lacks practical constructions.
- Non-replicability is not established for language models; left as future work.
- Steganographic function is assumed rather than constructed.
Experimental setup
Baselines: Goldwasser et al. black-box undetectable backdoor Chen et al. RFF white-box backdoor
Builds on: Goldwasser et al. undetectable backdoors indistinguishability obfuscation Random Fourier Features backdoor (Chen et al.)
Closest papers by meaning
- Backdoor Channels Hidden in Latent Space: Cryptographic Undetectability in Modern Neural Networks (NeurIPS 2026 · similarity 0.87)
- Demystifying Poisoning Backdoor Attacks from a Statistical Perspective (ICLR 2024 · similarity 0.87)
- Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Models (NeurIPS 2024 · similarity 0.87)
- BadEdit: Backdooring Large Language Models by Model Editing (ICLR 2024 · similarity 0.86)
- Simulate and Eliminate: Revoke Backdoors for Generative Large Language Models (AAAI 2025 · similarity 0.86)
- Uncovering, Explaining, and Mitigating the Superficial Safety of Backdoor Defense (NeurIPS 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.