Research map / Adversarial robustness and security / Backdoor and poisoning

Backdoor Channels Hidden in Latent Space: Cryptographic Undetectability in Modern Neural Networks

NeurIPS 2026 · Adversarial robustness and security › Backdoor and poisoning · approach: Backdoors in large multimodal models

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Plants a cryptographically motivated spiked-covariance backdoor in the penultimate-layer weights of fine-tuned ResNet18 and ViT image classifiers, with a CAV-derived latent key and an optimised input trigger, and reports high ASR that survives several post-training defences.

Problem

Cryptographic white-box undetectable backdoors have only been proven for stylised architectures (random ReLU networks, random Fourier features); it is open whether comparable undetectability holds for modern end-to-end trained image classifiers.

Approach

Extends the spiked-covariance backdoor of prior theory to state-of-the-art CNNs and ViTs by inserting a linear backdoor layer, reshaping its weights via a Cholesky factor of a spiked covariance whose key is a sparse CAV-like normal vector from a logistic regression between source and target activations, then absorbing the layer into the output head and optimising an input trigger aligned with the

Key results

• Backdoored ResNet18 and ViT reach triggered ASR of roughly 0.85-1.00 across eight source-target pairs per architecture with overall clean accuracy within about 0-4 points of clean models (e.g., ResNet18 BloodMNIST Baso→Eos ASR 0.96 vs 0.19 clean).
• Pruning, parameter clipping and parameter noise injection leave ASR largely high (e.g., ViT PathMNIST Adip→BG ASR 1.00 under all three), though some pairs drop (ResNet18 LymP→Deb 0.35 under clipping).
• Neural Cleanse did not detect the backdoor in any of the evaluated configurations, while SmoothInv showed high ASR also for non-target classes, indicating limited specificity.

Surprising findings

• Triggered inputs also induce targeted misclassification in the clean model, only slightly less reliably, suggesting the channel overlaps with adversarial vulnerability.
• Pruning-based defence in ResNet18 BloodMNIST Baso→Eos left ASR at 1.00 while clean accuracy stayed at 0.93.

Limitations

• No formal proof of white-box undetectability; undetectability is only conjectured via a hypothesis-test reduction.
• The covariance-spike assumption relies on near-diagonal Gaussian weights, which trained networks do not satisfy; hyperparameters theta, d and m lack a principled selection range.
• Evaluation is limited to image classification on four datasets with 5-epoch fine-tuning and a small set of defences.

Experimental setup

Datasets: CIFAR-10 BloodMNIST DermaMNIST PathMNIST

Benchmarks: CIFAR-10 BloodMNIST DermaMNIST PathMNIST

Metrics: attack success rate clean data accuracy maximum mean discrepancy defence ASR under pruning, clipping, noise, fine-tuning, fin

Baselines: Neural Cleanse SmoothInv fine-pruning fine-tuning

Builds on: spiked covariance backdoor (Gaussian weights, random ReLU networks) concept activation vectors concept backpropagation fine-pruning Neural Cleanse SmoothInv

Closest papers by meaning

• BackdoorDM: A Comprehensive Benchmark for Backdoor Learning on Diffusion Model (NeurIPS 2025 · similarity 0.87)
• Injecting Undetectable Backdoors in Obfuscated Neural Networks and Language Models (NeurIPS 2024 · similarity 0.87)
• A Dual Stealthy Backdoor: From Both Spatial and Frequency Perspectives (AAAI 2024 · similarity 0.86)
• From Toxic to Trustworthy: Using Self-Distillation and Semi-supervised Methods to Refine Neural Networks (AAAI 2024 · similarity 0.86)
• Clean Data Can Still Carry Backdoors: Support-Persistent Backdoors for Model Reuse (NeurIPS 2026 · similarity 0.85)
• Unveiling and Mitigating Backdoor Vulnerabilities based on Unlearning Weight Changes and Backdoor Activeness (NeurIPS 2024 · similarity 0.85)