Implementing a White-Box Undetectable Backdoor for Random Fourier Features
Researchers implement Goldwasser's CLWE-based undetectable backdoor for Random Fourier Features models in numpy/scipy, confirming practical realizability with no detectable differences from clean models.
The paper provides an end-to-end implementation of the Goldwasser et al. white-box undetectable backdoor for models trained with the Random Fourier Features algorithm, using only numpy and scipy. It derives two samplers for the core GP_d(b_k) distribution: a rejection-sampling proxy and an exact closed-form sampler verified against its analytic form. Statistical indistinguishability tests covering weight-space and functional black-box comparisons found no detectable difference between backdoored and clean models across sparsity ratios. The underlying lattice hardness reduction was not reproduced, and the work demonstrates the threat is realizable with commodity scientific-computing tools rather than specialized cryptographic infrastructure.
- First end-to-end implementation of CLWE-RFF white-box backdoor
- Implemented with commodity numpy/scipy, no cryptographic infrastructure required
- No detectable difference between backdoored and clean models in tests
- Lattice hardness reduction underlying the construction not reproduced
Full article264 words · extracted from arxiv.org · click to collapse
Goldwasser et al. showed that undetectable backdoors can be planted in machine learning models trained with the Random Fourier Features (RFF) algorithm, under a hardness assumption tied to the Continuous Learning With Errors (CLWE) problem. Under standard cryptographic assumptions, even a full white-box audit of a model's weights cannot detect this class of backdoor. The construction is stated in terms of cryptographic reductions and probabilistic lemmas, without a reference implementation, and relies on secondary machinery such as the Sparse Gaussian Pancakes distribution and a homogeneous CLWE conditional density. Its realizability in ordinary numerical code is not obvious from the paper alone. This paper implements the white-box CLWE-RFF backdoor construction end to end using only numpy and scipy, to test whether this threat is realizable with commodity scientific-computing tools or requires specialized cryptographic infrastructure. We give two samplers for the core $GP_d(b_k)$ distribution. The first is a rejection-sampling proxy. The second is an exact closed-form sampler derived from the homogeneous CLWE density and verified against its own analytic form. Using this implementation, we run statistical indistinguishability tests, covering both weight-space and functional black-box comparisons. We find no evidence of detectable difference between backdoored and clean models across a range of sparsity ratios $ρ= d_{\text{sparse}}/D$. We report which parts of the construction were straightforward to realize, which required derivation not spelled out in the paper. We also highlight which parts we did not attempt to reproduce, including the underlying lattice hardness reduction. We see this work as a contribution to understanding the practical realizability of the Goldwasser white-box CLWE core, not as a new theoretical result.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.16403