Cryptographic Backdoors in Neural Networks: Pros and Cons
Cryptographic Backdoor for Neural Networks: Boon and Bane
Translation in progress — untranslated text is omitted.
An arXiv paper proposes that cryptographic backdoors implanted in neural networks can be used both for launching attacks and for building defenses. The authors claim that carefully implanted cryptographic backdoors can launch powerful and invisible attacks on neural networks, and cannot be prevented under standard assumptions. On the defense side, three protocols are given, providing provably robust watermarking schemes, user authentication, and tracing of unauthorized sharing of neural network intellectual property; all three are resistant to adversaries with only black-box access. The authors state that the main contribution of the paper is demonstrating the provable robustness of these implemented protocols, but defense-related arguments still require further research. These protocols have been implemented on current mainstream neural network architectures, and empirical results support their theoretical claims; the authors also mention that cryptographic backdoors can be implemented with post-quantum primitives, laying a foundation for machine learning applications in the quantum era.
- In outsourced training and online deployment, classifiers may be implanted with backdoors, and ownership, inference permissions, and unauthorized sharing also need verification. Most backdoor watermarks modify the model itself and may fail after fine-tuning. The signature backdoor of Goldwasser et al. has not yet been demonstrated empirically on image classification.
- A digital signature verification circuit is placed in parallel with the classifier, without modifying training. The extracted message–signature pair rewrites the output only if verification passes; otherwise, the original prediction is kept. The same structure is used for attack, watermarking, user authentication, and tracing leaks by assigning labels to the same trigger set per user key.
- On ResNet-18, after effective triggering, CIFAR-10 test accuracy is 0.80%, and ImageNet is 1.03%. Watermark trigger accuracy with a valid signature is 100.00%. Without a valid key, authenticated test accuracy is 9.91% on CIFAR-10 and 0.09% on ImageNet.
- The authors note that backdoor decoding has high overhead and the applications depend on black-box access, and they plan to extend to white-box settings. Experiments use ResNet-18/50/152, CIFAR-10, and ImageNet, with a trigger set of 100 MNIST images. The paper does not report measured accuracy under fine-tuning, distillation, or extraction.