The paper demonstrates that hidden capabilities in AI models can be provably concealed by embedding encrypted neural networks as backdoors within the host model’s weights. These hidden circuits are designed to decrypt and activate only when a secret trigger is provided, and they remain difficult to elicit or interpret even with full access to the model weights, thanks to cryptographic guarantees. The authors implement these constructions in PyTorch and test their resistance against various elicitation techniques on a chemical reaction prediction task, showing that current audit methods cannot reliably uncover such hidden behaviors.
arXiv:2507. 01752v4 Announce Type: replace-cross Abstract: Gradient-based optimization is the workhorse of deep learning, offering efficient and scalable training via backpropagation.
arXiv:2608. 00732v1 Announce Type: new Abstract: Backdoor attacks pose a serious threat to deep neural networks, especially when training relies on third-party data, allowing adversaries to inject malicious behaviors through data poisoning.
arXiv:2606. 25589v1 Announce Type: new Abstract: As graph neural networks (GNNs) become standard tools for critical tasks in circuit design and analysis, their security and privacy risks require careful attention.
arXiv:2607. 09532v1 Announce Type: new Abstract: We show how an adversarial model trainer can plant backdoors in a large class of deep, feedforward neural networks.
arXiv:2509. 20714v2 Announce Type: replace-cross Abstract: In this paper we show that cryptographic backdoors in a neural network (NN) can be highly effective in two directions, namely mounting the attacks as well as in presenting the defenses as well.
arXiv:2610.27152v1 Announce Type: cross Abstract: Neural networks (NNs) are increasingly deployed on edge devices such as mobile and IoT platforms, offering low latency and improved privacy compared...
arXiv:2605.13214v3 Announce Type: replace-cross Abstract: Recent cryptographic results establish that neural networks can be backdoored such that no efficient algorithm can distinguish them from a cl...
The paper "Privacy Leakage on DNNs: A Survey of Model Inversion Attacks and Defenses" provides a comprehensive review of model inversion (MI) attacks that exploit trained deep neural networks to reconstruct private training data. It traces the evolution of MI from early machine‑learning contexts to recent DNN‑based attacks across various modalities and learning tasks, offering a detailed taxonomy and comparative analysis of both attacks and defenses. The authors also present an open‑source toolbox on GitHub to support further research in this area.
The paper introduces a new class of adversarial attacks that eliminate the need for a backward pass by predicting input gradients from forward-pass hidden states using lightweight linear regression. The authors theoretically derive exact affine conditional gradient means, proving optimality in the idealized NTK regime, and empirically demonstrate that their methods recover most of FGSM’s performance while achieving a 532% increase in throughput on practical finite-width models. This approach offers a simple and general way to generate adversarial examples much faster under realistic wall‑clock constraints.
The paper examines the vulnerability of open‑weight large language model safeguards that aim to block harmful usage by assuming new harmful behavior arises only through fine‑tuning. It demonstrates that simple, low‑cost attacks—abliteration and prefilling—can significantly increase attack success rates across multiple benchmarks, and proposes an abliteration‑resistant tuning (ART) method that mitigates these attacks. The study shows that safeguarding defenses must be evaluated against a broader range of attack strategies beyond fine‑tuning.
arXiv:2510. 01529v3 Announce Type: replace Abstract: Ball et al.
The paper introduces a privacy‑preserving zk‑SNARK audit framework that uses adversarial‑style probes to detect logit drift between an approved large language model and a modified deployment. It offers three probe families—token‑based (black‑box), embedding‑based (gray‑box), and stress probes (partial white‑box)—allowing users to balance sensitivity, access, and cost. Experiments across LLM architectures and GPU platforms show token‑based probes achieve the highest mean sensitivity while remaining practical in a black‑box setting, with Groth16 proving times scaling modestly from 1.02 to 1.78 seconds and constant proof size.