Backdoor in machine learning models resists white-box detection using standard tools
Implementing a White-Box Undetectable Backdoor for Random Fourier Features
Cryptography and SecurityMachine Learning
Summary
Machine learning models can sometimes be secretly altered to behave wrongly when given special inputs, called backdoors. The authors show that a certain kind of backdoor, proven theoretically to be impossible to detect even with full access to the model’s internal parts, can be actually built using common programming tools. They carefully recreated the complex math and algorithms from prior work to confirm this. Their tests found no signs that these backdoored models look different from normal ones, affirming the practical threat of such hidden backdoors.
What this means in practice
- •For machine learning engineers: Assess vulnerability of models using random Fourier features to stealthy backdoors that evade complete internal audits.
- •For cybersecurity teams: Design detection and defense strategies against cryptographically hidden backdoors despite full access to model internals.
Authors
Michael Collins, Jada Cumberland, Brianne Dunn, Ross Gore, Samuel Jackson, Sachin Shetty
Abstract
Goldwasser et al. showed that undetectable backdoors can be planted in machine learning models trained with the Random Fourier Features (RFF) algorithm, under a hardness assumption tied to the Continuous Learning With Errors (CLWE) problem. Under standard cryptographic assumptions, even a full white-box audit of a model's weights cannot detect this class of backdoor. The construction is stated in terms of cryptographic reductions and probabilistic lemmas, without a reference implementation, and relies on secondary machinery such as the Sparse Gaussian Pancakes distribution and a homogeneous CLWE conditional density. Its realizability in ordinary numerical code is not obvious from the paper alone. This paper implements the white-box CLWE-RFF backdoor construction end to end using only numpy and scipy, to test whether this threat is realizable with commodity scientific-computing tools or requires specialized cryptographic infrastructure. We give two samplers for the core $GP_d(b_k)$ distribution. The first is a rejection-sampling proxy. The second is an exact closed-form sampler derived from the homogeneous CLWE density and verified against its own analytic form. Using this implementation, we run statistical indistinguishability tests, covering both weight-space and functional black-box comparisons. We find no evidence of detectable difference between backdoored and clean models across a range of sparsity ratios $ρ= d_{\text{sparse}}/D$. We report which parts of the construction were straightforward to realize, which required derivation not spelled out in the paper. We also highlight which parts we did not attempt to reproduce, including the underlying lattice hardness reduction. We see this work as a contribution to understanding the practical realizability of the Goldwasser white-box CLWE core, not as a new theoretical result.