Statistically Undetectable Backdoors in Deep Neural Networks

2026-07-10

AI Summary

This work addresses the challenge that backdoor attacks in deep neural networks are often undetectable by statistical means, proposing a provably secure backdoor mechanism that is statistically indistinguishable under white-box settings. By integrating cryptographic assumptions, total variation distance analysis, and tailored network architecture design, the method ensures computational indistinguishability between the backdoored model and an honestly trained one. An attacker possessing the secret key can efficiently generate invariance-based adversarial examples, whereas any user without the key cannot do so under standard cryptographic assumptions. Theoretical analysis establishes the security guarantees of the proposed mechanism, and preliminary experiments demonstrate its effectiveness and stealthiness.

Abstract

We show how an adversarial model trainer can plant backdoors in a large class of deep, feedforward neural networks. These backdoors are statistically undetectable in the white-box setting, meaning that the backdoored and honestly trained models are close in total variation distance, even given the full descriptions of the models (e.g., all of the weights). The backdoor provides access to invariance-based adversarial examples for every input, mapping distant inputs to unusually close outputs. However, without the backdoor, it is provably impossible (under standard cryptographic assumptions) to generate any such adversarial examples in polynomial time. Our theoretical and preliminary empirical findings demonstrate a fundamental power asymmetry between model trainers and model users.

Problem

• backdoors
• deep neural networks
• statistical undetectability
• adversarial examples
• white-box setting

Innovation

• statistically undetectable backdoors
• white-box setting
• invariance-based adversarial examples
• total variation distance
• computational hardness