Research map / Adversarial robustness and security / Backdoor and poisoning
Unelicitable Backdoors via Cryptographic Transformer Circuits
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces unelicitable backdoors compiled into transformer circuits (NP-complete and cryptographic digital-locker/SHA-256 designs), built with a new transformer DSL Stravinsky, and tests them against latent adversarial training and GCG-style elicitation.
Problem
Open-weight language models can carry backdoors that defenders cannot trigger or observe before deployment, so pre-deployment elicitation-based evaluation may be fundamentally limited.
Approach
Embed an encrypted payload in a transformer via a digital locker built from an in-model SHA-256 hash (key K = h(T) XOR B), so the harmful output appears only for the correct trigger, and no polynomial-time elicitation (input-space or latent adversarial) reveals it; also a 3-SAT-verifier backdoor and a hardness scale for elicitation methods.
Key results
- Latent adversarial training elicits the password-locked backdoor within eight steps but fails on the encrypted backdoor over 10^4 optimisation steps.
- NP-hard backdoor is not elicited by first-six-layer attacks but is elicited by attacks on the last four layers.
- With Gaussian weight noise, the NP-complete backdoor is elicited about 60% of the time within 10000 steps while the encrypted backdoor is never elicited.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| optimize input embeddings with LAT | Password-locked backdoor · LAT elicitation | training steps to elicit backdoor: just eight training steps | Helped |
| attack the input layer or any of the first six layers with LAT | NP-complete backdoor · LAT elicitation | elicitation success | Hurt |
| attack one of the last four layers with LAT | NP-complete backdoor · LAT elicitation | elicitation success | Helped |
| use the encrypted backdoor instead of password-locked or NP-complete backdoors | backdoor elicitation with LAT · LAT on trigger modules | elicitation within optimization steps: 104 optimisation steps | Helped |
| add Gaussian noise to trigger-circuit parameters (ablation) | Password-locked backdoor · LAT on first layer | elicitation speed | No clear effect |
| add Gaussian noise to trigger-circuit parameters (ablation) | NP-complete backdoor · LAT on first layer | elicitation rate: about 60% of the time in under 10000 steps | Hurt |
| add Gaussian noise to trigger-circuit parameters (ablation) | Encrypted backdoor · LAT on first layer | elicitation success | No clear effect |
Surprising findings
- The encrypted backdoor resists latent adversarial training, which is the strongest elicitation method tested, while the simpler NP-complete backdoor does not.
Limitations
- Not fully white-box undetectable; residual stream structure and compiled circuits could be flagged by heuristics or noise, fine-tuning, or anomaly detection.
- Experiments use a weakened SHA-256 (2 mixing steps instead of 64) because full LAT was too expensive.
- NP-complete trigger design restricts trigger choice and is elicitable under noise and LAT.
Experimental setup
Metrics: adversarial training loss fraction vs steps steps to elicit backdoor
Baselines: password-locked backdoor NP-complete backdoor GCG latent adversarial training
Builds on: Tracr Goldwasser et al. backdoors digital lockers latent adversarial training GCG
Closest papers by meaning
- Injecting Undetectable Backdoors in Obfuscated Neural Networks and Language Models (NeurIPS 2024 · similarity 0.85)
- Backdoor Channels Hidden in Latent Space: Cryptographic Undetectability in Modern Neural Networks (NeurIPS 2026 · similarity 0.85)
- BadToken: Token-level Backdoor Attacks to Multi-modal Large Language Models (CVPR 2025 · similarity 0.84)
- Can We Trust Embodied Agents? Exploring Backdoor Attacks against Embodied LLM-Based Decision-Making Systems (ICLR 2025 · similarity 0.84)
- Invisible Backdoor Attack against Self-supervised Learning (CVPR 2025 · similarity 0.84)
- A Dual Stealthy Backdoor: From Both Spatial and Frequency Perspectives (AAAI 2024 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.