Combinatorial Lock: Hash-Assisted Spectral Filtering Lets AI Engines Resist Trojan Attacks
Combinatorial Lock for Trojan-Resilient AI Engines via Hash-Assisted Spectral Filtering
Translation in progress — untranslated text is omitted.
The training-free defense method Combinatorial Lock targets multi-trigger backdoor attacks, reducing the attack success rate (ASR) to as low as 0.1% while maintaining 97.8% clean accuracy. The method transforms multi-trigger identification into a combinatorial problem over binary activation signatures, combining anomalous gated spectral cleansing with hash-compressed combinatorial signatures and detection expert ensemble verification; the decision rule requires only integer and logic operations and can be implemented directly in hardware. On six models—ResNet18, VGG16, MobileNet, AlexNet, ViT-Small, and ViT-Base—under 1-10% poisoning rates and 1-9 concurrent triggers, ASR drops from near 100% to single digits; ASIC and FPGA implementations incur 19-20% latency overhead.
- Multi-trigger backdoor attacks (MTBA) let heterogeneous triggers such as patch, blend, warping, and Spy-Watermark coexist in the same poisoned model; existing shortcut-style defenses based on the assumption of a single static trigger cannot cope; existing MTBA remedies (BU+FT/ANP/ABL) rely on retraining, are costly, and fail at low poisoning rates.
- Proposes the training-free, reference-calibrated Combinatorial Lock: SVD on last-layer activations yields a malicious subspace; after projection, coefficients are quantized into a 64-bit binary hash concatenated with a 30-dimensional combinatorial descriptor, and six anomaly-detection experts score them in a weighted ensemble for runtime verification; on the mitigation side, gated median filtering plus spectral shrinkage (z−γp) erases the malicious component, and the decision rule uses only integer and logic operations, allowing direct implementation on ASIC/FPGA.
- On CIFAR-10, six models (four CNNs, two ViTs), poisoning rates 1–10%, 1–9 triggers: ASR before defense 98–100%, after defense about 0–2%; at the operating point τ=97.1 percentile, γ=0.78, CA 97.8%, average ASR 1.9%, minimum 0.1%; k=6 ensemble AUROC 0.9854; hardware latency overhead 19–20%.
- Future directions listed by the authors: adaptive threshold selection, robustness to unseen and adaptive triggers, extension to multimodal and foundation models, and hardware-software co-design (Conclusion). Experiments were conducted only on CIFAR-10 image classification with six backbones; the paper does not report sample sizes, number of repetitions, or statistical tests.
Related papers
Show 3 more papers
- Why Backdooring Neural Networks is so Easy?Analysis / interpretabilityarXiv