Multi trigger backdoor defense reduces attacks with hardware friendly design
Combinatorial Lock for Trojan-Resilient AI Engines via Hash-Assisted Spectral Filtering
Cryptography and SecurityHardware ArchitectureMachine Learning
Summary
Backdoor attacks in AI models use various secret triggers to make the AI behave badly, and current defenses usually only handle one type of trigger. The authors propose Combinatorial Lock, which can spot multiple hidden triggers at once without extra training, using simple digital logic that hardware can handle easily. Their method filters out malicious behavior only for suspicious inputs and keeps the AI working well on normal data. Tests on various AI models show it greatly reduces these attacks while keeping accurate results and hardware tests confirm it adds only a small delay.
What this means in practice
- •For ai security engineers: Protect AI systems from multiple backdoor attack triggers without retraining or complex computations by integrating combinatorial lock based filtering.
- •For hardware designers: Embed low-latency, logic-based backdoor defenses directly into AI chips to secure models against diverse triggers with minimal speed impact.
Authors
Soumita Chatterjee, Sudip Ghosh, Tamal Ghosh, Bhargab B. Bhattacharya, Hafizur Rahaman
Abstract
Multi-trigger backdoor attacks, in which heterogeneous trigger mechanisms (e.g., patch, blend, warping, and the latent-domain Spy-Watermark) coexist within a single poisoned model, cannot be addressed by existing shortcut-based defenses that assume a single, static attack mechanism. Current multi-trigger remedies (BU+FT, BU+ANP, and BU+ABL) rely on backdoor unlearning, which incurs high training costs and loses effectiveness at low poisoning ratios. This paper proposes Combinatorial Lock, a training-free, reference-calibrated defense that reduces multi-trigger identification to a combinatorial problem over binary activation signatures. This formulation is the key novelty: it yields a multi-trigger defense that is training-free, trigger-oblivious, and directly implementable in hardware, since its decision rules can be evaluated with integer and logic operations. The framework combines anomaly-gated spectral scrubbing, which removes the malicious subspace only from inputs identified as anomalous, with a hash-compressed combinatorial signature verified by an ensemble of detection experts, including a compound-attack-aware expert for multi-trigger inputs. A joint threshold-shrinkage search identifies an operating point ($τ$ at the 97.1st percentile, $γ= 0.78$) that reduces the attack success rate (ASR) to as low as 0.1% while preserving 97.8% clean accuracy. Evaluation on six models (ResNet18, VGG16, MobileNet, AlexNet, ViT-Small, ViT-Base) shows strong generalization: near-100% ASR drops to single digits across poisoning rates of 1-10% and 1-9 simultaneous triggers, with only gradual degradation in clean accuracy. ASIC and FPGA implementations confirm practicality, adding a consistent 19-20% latency overhead across all evaluated architectures and establishing Combinatorial Lock as a hardware-native approach to multi-trigger backdoor mitigation.