Combinatorial Lock cuts multi-trigger backdoor success to 0.1%
Original title: Combinatorial Lock for Trojan-Resilient AI Engines via Hash-Assisted Spectral Filtering
The training-free defense preserves 97.8% clean accuracy and adds 19-20% latency in ASIC and FPGA tests.
Combinatorial Lock is a training-free defense for models poisoned with several trigger types at once, including patch, blend, warping, and latent-domain Spy-Watermark triggers. It scrubs a malicious spectral subspace only on inputs flagged as anomalous and verifies hash-compressed activation signatures with an ensemble of detectors. On six vision models, near-100% attack success fell to single digits across 1-10% poisoning rates and one to nine simultaneous triggers.
- The reported operating point uses tau at the 97.1st percentile and gamma of 0.78.
- Tested models are ResNet18, VGG16, MobileNet, AlexNet, ViT-Small, and ViT-Base.
- Clean accuracy degrades only gradually across the evaluated poisoning rates.
- BU+FT, BU+ANP, and BU+ABL rely on costly backdoor unlearning and weaken at low poison rates.
- Products
- Combinatorial Lock
- Malware
- Spy-Watermark
From the original article
1 min read at arxiv.orgMulti-trigger backdoor attacks, in which heterogeneous trigger mechanisms (e. g. , patch, blend, warping, and the latent-domain Spy-Watermark) coexist within a single poisoned model, cannot be addressed by existing shortcut-based defenses that assume a single, static attack mechanism.
By Soumita Chatterjee · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.