mlsanityData to 7 Oct 2026

Injecting Undetectable Backdoors in Obfuscated Neural Networks and Language Models

arXiv 2406.05660 ↗First posted 9 Jun 2024cs.LG cs.CR stat.MLcited by 2

On the map: LLM safety and security → Backdoor and data poisoning attacks

Abstract (arXiv)

As ML models become increasingly complex and integral to high-stakes domains such as finance and healthcare, they also become more susceptible to sophisticated adversarial attacks. We investigate the threat posed by undetectable backdoors, as defined in Goldwasser et al. (FOCS '22), in models developed by insidious external expert firms. When such backdoors exist, they allow the designer of the model to sell information on how to slightly perturb their input to change the outcome of the model. We develop a general strategy to plant backdoors to obfuscated neural networks, that satisfy the security properties of the celebrated notion of indistinguishability obfuscation. Applying obfuscation before releasing neural networks is a strategy that is well motivated to protect sensitive information of the external expert firm. Our method to plant backdoors ensures that even if the weights and architecture of the obfuscated model are accessible, the existence of the backdoor is still undetectable. Finally, we introduce the notion of undetectable backdoors to language models and extend our neural network backdoor attacks to such models based on the existence of steganographic functions.

Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Placed in Backdoor and data poisoning attacks, one of 12 directions in LLM safety and security. Builds on 64 of its 96 references that are in the map. First posted on arXiv 9 Jun 2024.

Builds on

64 of 96 references.

Closest ancestors · 13

Same direction, newest first

  1. 2024BadEdit: Backdooring large language models by model editing20 Mar
  2. 2024BadChain: Backdoor Chain-of-Thought Prompting for Large Language Models20 Jan
  3. 2024Universal Vulnerabilities in Large Language Models: Backdoor Attacks for In-context Learning11 Jan
  4. 2024Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training10 Jan
  5. 2023Label Poisoning is All You Need29 Oct
  6. 2023Composite Backdoor Attacks Against Large Language Models11 Oct
  7. 2023A Comprehensive Overview of Backdoor Attacks in Large Language Models within Communication Networks28 Aug
  8. 2023Backdoor Attacks for In-Context Learning with Language Models27 Jul
  9. 2023Rethinking Backdoor Attacks19 Jul
  10. 2023NOTABLE: Transferable Backdoor Attacks Against Prompt-based NLP Models28 May
  11. 2023Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Models24 May
  12. 2023Prompt as Triggers for Backdoor Attack: Examining the Vulnerability in Language Models2 May
1 more
  1. 2022BadPrompt: Backdoor Attacks on Continuous Prompts27 Nov

Other references · 51

  1. 2013Intriguing properties of neural networkscited by 5,114
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  3. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  4. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  5. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
  6. 2023Extracting Training Data from Diffusion Modelscited by 723
  7. 2023A Watermark for Large Language Modelscited by 667
  8. 2019Adversarial Training for Free!cited by 638
  9. 2016Error bounds for approximations with deep ReLU networkscited by 567
  10. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  11. 2023DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Modelscited by 505
  12. 2018Spectral Signatures in Backdoor Attackscited by 457
38 more
  1. 2017Nonparametric regression using deep neural networks with ReLU activation functioncited by 431
  2. 2017The Expressive Power of Neural Networks: A View from the Widthcited by 318
  3. 2018Certified Defenses against Adversarial Examplescited by 305
  4. 2021Unsolved Problems in ML Safetycited by 291
  5. 2023Poisoning Language Models During Instruction Tuningcited by 254
  6. 2016Benefits of depth in neural networkscited by 248
  7. 2019The Secret Revealer: Generative Model-Inversion Attacks Against Deep Neural Networkscited by 241
  8. 2023Undetectable Watermarks for Language Modelscited by 208
  9. 2024Foundational Challenges in Assuring Alignment and Safety of Large Language Modelscited by 193
  10. 2015The Power of Depth for Feedforward Neural Networkscited by 181
  11. 2020Dataset Security for Machine Learning: Data Poisoning, Backdoor Attacks, and Defensescited by 171
  12. 2017Machine Learning Models that Remember Too Muchcited by 165
  13. 2021SPECTRE: Defending Against Backdoor Attacks Using Robust Statisticscited by 123
  14. 2017Approximating Continuous Functions by ReLU Nets of Minimal Widthcited by 120
  15. 2023Universal Jailbreak Backdoors from Poisoned Human Feedbackcited by 120
  16. 2019How do infinite width bounded norm networks look in function space?cited by 105
  17. 2016Why Deep Neural Networks for Function Approximation?cited by 82
  18. 2020Evading Deepfake-Image Detectors with White- and Black-Box Attackscited by 80
  19. 2020Trojaning Language Models for Fun and Profitcited by 80
  20. 2018Adversarial examples from computational constraintscited by 79
  21. 2021Backdoor Pre-trained Models Can Transfer to Allcited by 79
  22. 2016Depth-Width Tradeoffs in Approximating Natural Functions with Neural Networkscited by 58
  23. 2021Handcrafted Backdoors in Deep Neural Networkscited by 57
  24. 2022Exploring the Universal Vulnerability of Prompt-based Learning Paradigmcited by 56
  25. 2022Planting Undetectable Backdoors in Machine Learning Modelscited by 55
  26. 2022Perfectly Secure Steganography Using Minimum Entropy Couplingcited by 42
  27. 2024Pseudorandom Error-Correcting Codescited by 40
  28. 2020Continuous LWEcited by 37
  29. 2020On Tractable Representations of Binary Neural Networkscited by 34
  30. 2024Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Modelscited by 28
  31. 2024Competition Report: Finding Universal Jailbreak Backdoors in Aligned LLMscited by 27
  32. 2021Excess Capacity and Backdoor Poisoningcited by 24
  33. 2020Poly-time universality and limitations of deep learningcited by 23
  34. 2022When does Bias Transfer in Transfer Learning?cited by 23
  35. 2020The Complexity of Gradient Descent: CLS = PPAD cap PLScited by 17
  36. 2019Adversarially Robust Learning Could Leverage Computational Hardnesscited by 13
  37. 2020Indistinguishability Obfuscation from Well-Founded Assumptionscited by 12
  38. 2024Excuse me, sir? Your language model is leaking (information)cited by 11

50 most cited of 51 All 51 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 1; 2026: 1.

2 papers.

  1. 2025Cryptographic Backdoor for Neural Networks: Boon and Banecited by 1
  2. 2026Backdoor Channels Hidden in Latent Space: Extending Cryptographic Undetectability to Modern Neural Networkscited by 0