Undetectable backdoors in model parameters: hiding sparse secrets in high-dimensional spaces

The paper proposes a supply chain attack named Sparse Backdoor, which implants a backdoor into the parameters of pretrained image classifiers (including convolutional networks and Vision Transformers) and provides a formal guarantee of undetectability. The attack injects structured sparse perturbations along random directions into a small fraction of columns in each fully connected layer, propagates the trigger signal to an attacker-chosen target class, and then masks the perturbation with independent isotropic Gaussian jitter. Under the premise that the pretrained classifier satisfies a mild margin condition, the jittered reference distribution is functionally equivalent to the original classifier; the paper proves that distinguishing the backdoored model from this reference distribution is at least as hard as Sparse PCA detection and computationally infeasible under standard hardness assumptions, and this guarantee holds for any probabilistic polynomial-time distinguisher with white-box access to the parameters.