Backdoor Channels Hidden in Latent Space: Cryptographic Undetectability in Modern Neural Networks

2026-05-13

AI Summary

This work investigates whether modern end-to-end trained neural networks can mount cryptographically undetectable backdoor attacks. The authors model the backdoor channel as a learnable direction in the model’s latent space, achieving—for the first time—undetectable backdoors in mainstream architectures such as ResNet and Vision Transformer without requiring explicit structural modifications. Leveraging the geometric properties of the latent space and integrating hypothesis testing theory within an end-to-end training framework, the method simultaneously maintains high accuracy on clean samples and achieves high attack success rates. Moreover, it effectively evades multiple post-training defense mechanisms, revealing that backdoors can inherently emerge from the model’s representational structure rather than relying on deliberate tampering.

Abstract

Recent cryptographic results establish that neural networks can be backdoored such that no efficient algorithm can distinguish them from a clean model. These guarantees, however, have been confined to stylised architectures of limited practical relevance, leaving open whether comparable undetectability extends to modern, end-to-end trained networks. We construct such an attack mechanism for state-of-the-art architectures, closely aligned to the cryptographic notion of undetectability, by identifying backdoor channels as learned latent directions, and show that the question of undetectability reduces to a hypothesis test between two unknown distributions over model parameters, which we conjecture to be intractable in practice. The consequence of this reframing is significant: if exploitable channels within a network's latent space are statistically indistinguishable from naturally learned directions, an attacker need not introduce foreign structure but can instead exploit the geometry the network already possesses. Demonstrating the approach on ResNet and Vision Transformer architectures trained on standard image classification datasets, the attack achieves both consistently high success rates with negligible clean accuracy degradation, and resists a comprehensive suite of post-training defences, none of which neutralise the backdoor without rendering the model unusable. Our results establish that cryptographic backdoors need not be artefacts requiring exotic architectures or artificial constructions, but identifiable as latent properties inherent to the geometry of learned representations.

Problem

• backdoor
• latent space
• cryptographic undetectability
• neural networks
• hypothesis testing

Innovation

• backdoor attack
• latent space
• cryptographic undetectability
• neural network geometry
• hypothesis testing