Statistically Undetectable Backdoors in Deep Neural Networks
2026-07-10 • Machine Learning
Machine LearningCryptography and Security
AI summaryⓘ
The authors explain how someone training a neural network can secretly add a hidden trigger, called a backdoor, that changes how the network behaves without being detectable by examining the model closely. This backdoor lets the trainer create special confusing inputs that look very different but produce almost the same output, which normally isn’t possible to do quickly. Their results show a key difference in what the person training the model can do versus what users of the model can achieve. This highlights a security risk in trusting trained neural networks.
backdoor attackdeep neural networksadversarial examplestotal variation distancewhite-box settingfeedforward networkscryptographic assumptionsmodel traininginvariancepolynomial time
Authors
Andrej Bogdanov, Alon Rosen, Neekon Vafa
Abstract
We show how an adversarial model trainer can plant backdoors in a large class of deep, feedforward neural networks. These backdoors are statistically undetectable in the white-box setting, meaning that the backdoored and honestly trained models are close in total variation distance, even given the full descriptions of the models (e.g., all of the weights). The backdoor provides access to invariance-based adversarial examples for every input, mapping distant inputs to unusually close outputs. However, without the backdoor, it is provably impossible (under standard cryptographic assumptions) to generate any such adversarial examples in polynomial time. Our theoretical and preliminary empirical findings demonstrate a fundamental power asymmetry between model trainers and model users.