2026-10-29 ジョージア工科大学
＜関連情報＞
- https://news.research.gatech.edu/2026/10/29/researchers-find-architectural-backdoors-ai-models-are-harder-exploit-real-world
- https://davidoygenblik.github.io/pdfs/FAULT.pdf
アーキテクチャ上のバックドアにおける欠陥の発見：実環境下でトリガー検出が機能しない理由 Finding FAULTs in Architectural Backdoors: Why Trigger Detection Fails Under Real-World Conditions
Anonymous Author(s)
ACM Conference on Computer and Communications Security (CCS’26), November 15–19, 2026, The Hague, The Netherlands. ACM, New York,
NY, USA, 17 pages. https://doi.org/XXXXXXX.XXXXXXX
Figure 1: Simplified process of DL model deployment. WBBs and ABs have different attack surfaces (boxed in green for
ABs and boxed in red for WBBs) that the attacker can exploit.
Abstract
Architectural Backdoors (ABs) have been proposed as a stealthy threat towards secure DL model deployments. ABs hide malicious computation in DL model inference code rather than the model’s weights, evadingtraditional modelvettingtechniques. However,the practical viability of ABs under real-world deployment conditions has remained unexamined. We show that architectural backdoors are constrained by three fundamental limitations inherent to their trigger detection step: (1) input-space transformations routinely applied during preprocessing corrupt triggers before detection; (2) relaxing detection sensitivity to recover attack success rate inevitably increases false positives, producing observable accuracy degradation (reducing the stealth of the attack) and (3) as trigger complexity grows, the collision space of benign inputs that falsely activate the detector expands, further coupling accuracy loss to attack viability. We formalize these limitations mathematically and introduce FAULT, a framework that enables characterization of the attack-success-rate, accuracy, and false-positive tradeoff space of ABs across varied trigger and detector types. Our evaluation across the GTSRB, Mapillary, and CIFAR10 datasets confirms that architectural backdoors are impractical in realistic deployments.
