Poisoning-Based Backdoors Are Not Cryptographic
To defend against backdoor attacks on neural networks, the defender must identify the verifier function that determines whether an input is a trigger, rather than rejecting individual triggers in isolation, since an attacker can generate new triggers satisfying the same verifier faster than they can be blocked.
ProofPaper ↗
Key points
- If a backdoor verifier could be installed with the asymmetry of a cryptographic authentication scheme, in which only the attacker can produce trigger inputs while the defender cannot reverse-engineer the verifier from observations, learning-based defense would be impossible in principle.
- We show that no such asymmetry can arise from poisoning-based installation, in which the only verifier-dependent input to training is a poisoned dataset.
- A training procedure that installs a verifier from poisoned data, so that the backdoor fires on unseen triggers while benign behavior is preserved, is itself a learner for that verifier.
- Experiments on instruction-tuned large language models confirm the dichotomy, with no configuration yielding a backdoor that is both effective for the attacker and irrecoverable for the defender.
Sources (1)
- [1]Poisoning-Based Backdoors Are Not CryptographicarXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 20, 11:27 AM
To defend against backdoor attacks on neural networks, the defender must identify the verifier function that determines whether an input is a trigger, rather than rejecting individual triggers in isolation, since an attacker can generate new triggers satisfying the same verifier faster than they can be blocked.
If a backdoor verifier could be installed with the asymmetry of a cryptographic authentication scheme, in which only the attacker can produce trigger inputs while the defender cannot reverse-engineer the verifier from observations, learning-based defense would be impossible in principle.
Extractive summary: sentences quoted from the sources.
Before this
- Oct 20, 2026ACE-Compression: An Ability-Centric Evaluation of Compressed Large Language Models
- Oct 20, 2026A Unified Attack Framework against Statistical Generative Watermarks for Large Language Models
- Oct 19, 2026Introducing Clairic, a new System One class of extraction models
- Oct 19, 2026From Black Box to Controller: Inference-Time Steering of LLM via Feature Amplification
- Oct 19, 2026MapSteal: Map-based Autonomous Knowledge Stealing Attack Against Large Language Models
- Oct 18, 2026Where and Why Search-Augmented LLMs Fail When Reasoning over Rapidly Evolving Knowledge