Poisoning-Based Backdoors Are Not Cryptographic

Masahiro Kaneko

cs.LGOct 20, 2026

Poisoning-Based Backdoors Are Not Cryptographic

Authors: Masahiro Kaneko

Organizations: MBZUAI

Abstract

Defending against a backdoor requires recovering the verifier that decides whether an input is a trigger, since blocking individual triggers fails against an attacker who can generate new ones. If a verifier could be installed with the asymmetry of cryptographic authentication, where only the attacker can produce triggers and the defender cannot reconstruct the verifier, defense that learns the verifier from observations would be impossible in principle. We show that no such asymmetry can arise when the verifier enters training only through the labels of poisoned data, which covers the dirty-label backdoors that dominate the literature on language models. A training procedure that installs a verifier from poisoned data is itself a learner for that verifier. Hence any verifier that is hard to learn cannot be installed through poisoning, and any verifier that poisoning can install is reconstructible by a white-box defender holding as many labeled trigger observations as the attacker used. Hiding a secret key in the input or the weights does not change this. Experiments on instruction-tuned large language models confirm the dichotomy, with no configuration yielding a backdoor that is both effective for the attacker and irrecoverable for the defender.

Figures & tables

Table 1: Experiment 1, mean over

3

seeds. Acc. and Mem. Acc. are attacker accuracy on held-out and training samples.

Panel of Figure 1 — Figure 1: Sample complexity for $k$ -trigger AND verifiers. Points are medians over $5$ seeds and bars span the minimum and maximum. $>$ 10000 marks runs that did not reach $\varepsilon$ .

Verifier family (method)	ASR	FPR	Acc.	DSR
Syntactic template (Hidden Killer)	0.84	0.12	0.86	0.84
Stylistic (StyleBkd)	0.76	0.18	0.79	0.80
Statistical signature (BITE)	0.89	0.09	0.90	0.88

Table 2: Prior backdoor attacks at

N_{\mathrm{trig}}=10^{4}

, mean over four LLMs and

3

seeds.

Work	Installation channel	Access model	Claimed property
Qi et al. (2021a) ; Qi et al. (2021b) ; Yan et al. (2023)	Poisoned data	Black-box	Detector evasion
Hubinger et al. (2024)	Poisoned data	White-box	Persistence
Rando and Tramèr (2024)	Poisoned preferences	White-box	Persistence
Goldwasser et al. (2022) (signature)	Direct model modification	Black-box	Undetectability
Goldwasser et al. (2022) (random features)	Training randomness	White-box	Undetectability
Draguns et al. (2024)	Direct weights	White-box	Unelicitability

Table 3: Prior work classified by the channel through which verifier-dependent information enters the model, the access model under which the security property is claimed, and the property claimed.

Backdoor Attacks

Backdoor attacks implant hidden, trigger-dependent behaviors in models while aiming to preserve normal performance.

See all 135 papers

Why Backdooring Neural Networks is so Easy?
Sep 28, 2026Issam Seddik, Mohamed El Amine SeddikBackdoor Attacks
Université Paris-Saclay, CEA LIST Palaiseau, France · AI Research Center, Technology Innovation Institute (TII) Abu Dhabi, UAE
Two Sides of the Same Coin: Learning the Backdoor to Remove the Backdoor
Jul 7, 2026Qi Zhao, Christian WressneggerBackdoor Attacks Backdoor Detection
KASTEL Security Research Labs · Karlsruhe Institute of Technology (KIT)
Backdoor Channels Hidden in Latent Space: Cryptographic Undetectability in Modern Neural Networks
May 13, 2026Marte Eggen, Eirik Reiestad, Kristian Gjøsteen +1Backdoor Attacks Backdoor Detection
Department of Computer Science, Norwegian University of Science and Technology · Department of Mathematical Sciences, Norwegian University of Science and Technology

Sep 28, 2026J/K move · Enter open · S save

Why Backdooring Neural Networks is so Easy?

Issam Seddik, Mohamed El Amine Seddik

Université Paris-Saclay, CEA LIST Palaiseau, France · AI Research Center, Technology Innovation Institute (TII) Abu Dhabi, UAE

Backdoor Attacks

Open paper AskPDF arXiv

Securing modern AI systems against backdoor attacks remains an open challenge and requires fundamentally principled estimates of the adversary's budget -- the poison fraction

π

and trigger strength

α

needed to construct successful yet stealthy attacks. Motivated by recent empirical evidence that poisoning large language models can require a nearly constant number of malicious samples even as clean datasets grow, we derive an exact closed-form analysis of a quadratic neuron trained on a poisoned Gaussian mixture. We show, perhaps counterintuitively, that the same feature-learning dynamics that make neural networks powerful can also make them more vulnerable to backdoors. Specifically, with clean accuracy preserved to first order,

O(π)

, we demonstrate that lazy learning imposes the inverse-square-root scaling

α\propto π^{-1/2}

for a successful attack, while feature learning induces a quadratic detector whose loss margin scales as

O(α^4)

, improving the attack budget to

α\propto π^{-1/4}

. Consequently, nonlinear feature learning substantially reduces the trigger strength required at small poison fractions, thereby in a sense making feature learners more backdoor vulnerable. These results provide a theoretical mechanism consistent with large-scale empirical observations and demonstrate that security audits based on linear heuristics can systematically underestimate backdoor vulnerability in the widely adopted feature-learning regimes.

Abstract

Backdoor Attacks

Explore similar work

Why Backdooring Neural Networks is so Easy?

Two Sides of the Same Coin: Learning the Backdoor to Remove the Backdoor

Backdoor Channels Hidden in Latent Space: Cryptographic Undetectability in Modern Neural Networks