mlsanityData to 14 Oct 2026

Your Compiler is Backdooring Your Model: Understanding and Exploiting Compilation Inconsistency Vulnerabilities in Deep Learning Compilers

arXiv 2509.11173 ↗First posted 14 Sep 2025cs.CR cs.AI cs.LGcited by 7

Not on the map. Why?

Abstract (arXiv)

Deep learning (DL) compilers are core infrastructure in modern DL systems, offering flexibility and scalability beyond vendor-specific libraries. This work uncovers a fundamental vulnerability in their design: can an official, unmodified compiler alter a model's semantics during compilation and introduce hidden backdoors? We study both adversarial and natural settings. In the adversarial case, we craft benign models where triggers have no effect pre-compilation but become effective backdoors after compilation. Tested on six models, three commercial compilers, and two hardware platforms, our attack yields 100% success on triggered inputs while preserving normal accuracy and remaining undetected by state-of-the-art detectors. The attack generalizes across compilers, hardware, and floating-point settings. In the natural setting, we analyze the top 100 HuggingFace models (including one with 220M+ downloads) and find natural triggers in 31 models. This shows that compilers can introduce risks even without adversarial manipulation. Our results reveal an overlooked threat: unmodified DL compilers can silently alter model semantics. To our knowledge, this is the first work to expose inherent security risks in DL compiler design, opening a new direction for secure and trustworthy ML.

Key facts. Cited by 7 papers in the map (data through 14 Oct 2026). Builds on 56 of its 121 references that are in the map. First posted on arXiv 14 Sep 2025.

Builds on

56 of 121 references.

References · 56

  1. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
  2. 2023Efficient Memory Management for Large Language Model Serving with PagedAttentioncited by 5,944
  3. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  4. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,055
  5. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
  6. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 459
  7. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 353
  8. 2020Reflection Backdoor: A Natural Backdoor Attack on Deep Neural Networkscited by 349
  9. 2020Input-Aware Dynamic Backdoor Attackcited by 313
  10. 2019Label-Consistent Backdoor Attackscited by 296
  11. 2020Ansor: Generating High-Performance Tensor Programs for Deep Learningcited by 201
  12. 2019Demon in the Variant: Statistical Analysis of DNNs for Robust Backdoor Contamination Detectioncited by 124
38 more
  1. 2020Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Reviewcited by 123
  2. 2020An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networkscited by 97
  3. 2018Technical Report: When Does Machine Learning FAIL? Generalized Transferability for Evasion and Poisoning Attackscited by 81
  4. 2024Exploiting LLM Quantizationcited by 65
  5. 2019Stateful Detection of Black-Box Adversarial Attackscited by 56
  6. 2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 55
  7. 2022NICGSlowDown: Evaluating the Efficiency Robustness of Neural Image Caption Generation Modelscited by 50
  8. 2022SparseTIR: Composable Abstractions for Sparse Compilation in Deep Learningcited by 47
  9. 2023An Empirical Study of Pre-Trained Model Reuse in the Hugging Face Deep Learning Model Registrycited by 47
  10. 2021Accelerating Training and Inference of Graph Neural Networks with Fast Sampling and Pipeliningcited by 39
  11. 2020Blacklight: Scalable Defense for Neural Networks against Query-Based Black-Box Attackscited by 37
  12. 2020TrojanZoo: Towards Unified, Holistic, and Practical Evaluation of Neural Backdoorscited by 30
  13. 2022NNSmith: Generating Diverse and Valid Test Cases for Deep Learning Compilerscited by 30
  14. 2024Privacy Backdoors: Enhancing Membership Inference through Poisoning Pre-trained Modelscited by 30
  15. 2021Quantization Backdoors to Deep Learning Commercial Frameworkscited by 29
  16. 2022Architectural Backdoors in Neural Networkscited by 25
  17. 2022Towards Training Reproducible Deep Learning Modelscited by 23
  18. 2024PreCurious: How Innocent Pre-Trained Language Models Turn into Privacy Trapscited by 23
  19. 2020LazyBatching: An SLA-aware Batching System for Cloud Machine Learning Inferencecited by 22
  20. 2020IOS: Inter-Operator Scheduler for CNN Accelerationcited by 20
  21. 2021Qu-ANTI-zation: Exploiting Quantization Artifacts for Achieving Adversarial Outcomescited by 19
  22. 2020Cortex: A Compiler for Recursive Deep Learning Modelscited by 16
  23. 2022Learning to Reverse DNNs from AI Programs Automaticallycited by 12
  24. 2022DeepStability: A Study of Unstable Numerical Methods and Their Solutions in Deep Learningcited by 11
  25. 2024Architectural Neural Backdoors from First Principlescited by 11
  26. 2021Automated Runtime-Aware Scheduling for Multi-Tenant DNN Inference on GPUcited by 9
  27. 2022ImpNet: Imperceptible and blackbox-undetectable backdoors in compiled neural networkscited by 9
  28. 2023DyCL: Dynamic Neural Network Compilation Via Program Rewriting and Graph Optimizationcited by 9
  29. 2023Manipulating Transfer Learning for Property Inferencecited by 8
  30. 2021Pure Tensor Program Rewriting via Access Patterns (Representation Pearl)cited by 7
  31. 2023NeuRI: Diversifying DNN Generation via Inductive Rule Inferencecited by 7
  32. 2023BELT: Old-School Backdoor Attacks can Evade the State-of-the-Art Defense with Backdoor Exclusivity Liftingcited by 7
  33. 2024Hardware and Software Platform Inferencecited by 7
  34. 2022A Tale of Two Models: Constructing Evasive Attacks on Edge Modelscited by 6
  35. 2021A Survey of Large-Scale Deep Learning Serving System Optimization: Challenges and Opportunitiescited by 5
  36. 2023R^3: On-device Real-Time Deep Reinforcement Learning for Autonomous Roboticscited by 5
  37. 2025Exploiting Leaderboards for Large-Scale Distribution of Malicious Modelscited by 5
  38. 2023TorchProbe: Fuzzing Dynamic Deep Learning Compilerscited by 4

50 most cited of 56 All 56 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 7.

7 papers.

  1. 2026Hidden Reliability Risks in Large Language Models: Systematic Identification of Precision-Induced Output Disagreementscited by 5
  2. 2026SlowBA: An efficiency backdoor attack towards VLM-based GUI agentscited by 3
  3. 2026Hardware-Triggered Backdoorscited by 2
  4. 2026FloatDoor: Platform-Triggered Backdoors in LLMscited by 2
  5. 2026Trusted Weights, Treacherous Optimizations? Optimization-Triggered Backdoor Attacks on LLMscited by 1
  6. 2026PIMbot: A Self-Adaptive Attack Framework for Adversarial Manipulation of Multi-Robot Reinforcement Learningcited by 1
  7. 2026Reliability Testing of Medical Model Performance under Distributed Deploymentcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Architectural Backdoors in Deep Learning: A Survey of Vulnerabilities, Detection, and Defense
  2. 2026Securing Code Understanding: Detecting Natural Backdoor Vulnerability in Code Language Models
  3. 2023Stealthy Backdoor Attack for Code Models
  4. 2025DeBackdoor: A Deductive Framework for Detecting Backdoor Attacks on Deep Models with Limited Data
  5. 2025Semantically-Equivalent Transformations-Based Backdoor Attacks against Neural Code Models: Characterization and Mitigation
  6. 2026How Secure is Secure Code Generation? Adversarial Prompts Put LLM Defenses to the Test
  7. 2022Backdoor Vulnerabilities in Normally Trained Deep Learning Models
  8. 2026Transferable Backdoor Attacks for Code Models via Sharpness-Aware Adversarial Perturbation