(A)iSpy: Parasitic Trojans for Machine Learning Infrastructure
2026-07-20 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors show that modern machine learning systems are vulnerable to a hidden type of attack they call (A)iSpy, which works inside the system’s runtime environment. This Trojan watches and manipulates data as it flows through the system, sneaking out secret information or making backdoor attacks much more effective. Their approach is hard to detect with regular security checks and works by exploiting the training process itself. They tested (A)iSpy using ONNX Runtime, demonstrating real risks in popular ML tools.
machine learning pipelineruntime environmentcomputation graphtrojan attacktensor statesdata poisoningbackdoor attackmodel weightsONNX Runtimehardware acceleration
Authors
Habibur Rahaman, Qipan Xu, Zafaryab Haider, Prabuddha Chakraborty, Swarup Bhunia, Fnu Suya
Abstract
Modern machine learning (ML) pipelines depend heavily on third party libraries for graph compilation and hardware acceleration. While current practices audit data and model artifacts or rely on file integrity checks, the execution environment remains implicitly trusted. This blind spot enables active threats where a malicious runtime module interacts directly with live training and inference dynamics: exploiting this interaction allows the Trojan to support complex objectives that are challenging for static code or binary modifications, achieving manipulations impossible for standard data and model level attacks. We expose this vulnerability by presenting (A)iSpy, a parasitic infrastructure Trojan that subverts ML systems through an active observe and execute paradigm. Operating within the computation graph, (A)iSpy monitors transient tensor states to perform targeted, stealthy manipulations with negligible overhead. To violate confidentiality, the Trojan identifies all critical training hyperparameters and covertly exfiltrates them via model weights or output logits. To break integrity, it acts as a gradient amplifier: by observing steganographic triggers, it transforms otherwise weak data poisoning into effective backdoor attacks, increasing success rates from near zero to 100%. We further demonstrate broad extensibility across the machine learning lifecycle by validating auxiliary attacks in the appendix, including subpopulation label flipping, availability disruptions, and inference stage manipulations. Importantly, the (A)iSpy module easily evades standard malware scanners, while the associated poisoned inputs and resulting compromised models bypass typical inspection tools. We demonstrate the practicality of this threat with an implementation in the ONNX Runtime training and inference engines.