Statistically Undetectable Backdoors in Deep Neural Networks
Andrej Bogdanov, Alon Rosen, Neekon Vafa
cs.LG, cs.CR, stat.ML
Submitted: 2026-07-10
Comments: ICML 2026
License: http://creativecommons.org/licenses/by/4.0/
The gist: We show how an adversarial model trainer can plant backdoors in a large class of deep, feedforward neural networks.
Terminology
Abstract
We show how an adversarial model trainer can plant backdoors in a large class of deep, feedforward neural networks. These backdoors are statistically undetectable in the white-box setting, meaning that the backdoored and honestly trained models are close in total variation distance, even given the full descriptions of the models (e.g., all of the weights). The backdoor provides access to invariance-based adversarial examples for every input, mapping distant inputs to unusually close outputs. However, without the backdoor, it is provably impossible (under standard cryptographic assumptions) to generate any such adversarial examples in polynomial time. Our theoretical and preliminary empirical findings demonstrate a fundamental power asymmetry between model trainers and model users.
Sources
- Adaptive Robustness of Hypergrid Johnson-Lindenstrauss
- Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
- Undetectable Backdoors in Model Parameters: Hiding Sparse Secrets in High Dimensions
- Backdoor Channels Hidden in Latent Space: Extending Cryptographic Undetectability to Modern Neural Networks
- BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
- Cryptographic Backdoor for Neural Networks: Boon and Bane
- Spectral Norm Regularization for Improving the Generalizability of Deep Learning
- Facial Misrecognition Systems: Simple Weight Manipulations Force DNNs to Err Only on Specific Persons
Related papers
- Polynomial-Augmented Neural Networks (PANNs) with Weak Orthogonality Constraints for Enhanced Function and PDE Approximation
- AIRL-S: Unifying Reinforcement Learning and Search-Based Test-Time Scaling via Adversarial Inverse Reinforcement Learning
- Transformers as Bayesian In-Context Experimenters: Smoothness-Adaptive Efficient ATE Estimation
- Convergence issues in Relational Concept Analysis based on AOC-posets
- Beliefs Beyond Posteriors: The Predictive Cost of ELBO Binding
- Understanding Diffusion Models via Ratio-Based Function Approximation with SignReLU Networks