PaperlayerView exact revision on arXiv

Source-linked AI summary

Combinatorial Lock for Trojan-Resilient AI Engines via Hash-Assisted Spectral Filtering

Soumita Chatterjee, Sudip Ghosh, Tamal Ghosh, Bhargab B. Bhattacharya, Hafizur Rahaman

arXiv:2610.33437v2cs.CRcs.ARcs.LG

TL;DR

Multi-trigger backdoor defenses face a gap because existing remedies rely on costly retraining or approaches with limited hardware practicality. Combinatorial Lock uses anomaly-gated spectral scrubbing and hash-compressed binary signatures verified by an ensemble. The reported operating point reduces average ASR to 1.9%, and ASIC and FPGA implementations add 19–20% latency overhead.

  • Problem

    Existing defenses rely on retraining, trigger reconstruction, or poisoned-sample identification, creating computational costs and limiting practical hardware integration.

    Source: §I · pp. 1–2

  • Method

    Combinatorial Lock combines anomaly-gated spectral scrubbing with hash-compressed binary signatures and weighted ensemble verification for runtime defense.

    Source: §I · p. 2, 2) Hash-Guided Feature Projection · p. 3, 4) Verification Phase · p. 4

  • Results

    The selected operating point reduces average ASR to 1.9%, while ASIC and FPGA implementations add 19–20% latency overhead.

    Source: §V · pp. 6–7

  • Takeaways & Limitations

    Combinatorial Lock is presented as a retraining-free, architecture-agnostic defense that is natively realizable in hardware.

    Source: §V · p. 7

Abstract

from arXiv · show

Multi-trigger backdoor attacks, in which heterogeneous trigger mechanisms (e.g., patch, blend, warping, and the latent-domain Spy-Watermark) coexist within a single poisoned model, cannot be addressed by existing shortcut-based defenses that assume a single, static attack mechanism. Current multi-trigger remedies (BU+FT, BU+ANP, and BU+ABL) rely on backdoor unlearning, which incurs high training costs and loses effectiveness at low poisoning ratios. This paper proposes Combinatorial Lock, a training-free, reference-calibrated defense that reduces multi-trigger identification to a combinatorial problem over binary activation signatures. This formulation is the key novelty: it yields a multi-trigger defense that is training-free, trigger-oblivious, and directly implementable in hardware, since its decision rules can be evaluated with integer and logic operations. The framework combines anomaly-gated spectral scrubbing, which removes the malicious subspace only from inputs identified as anomalous, with a hash-compressed combinatorial signature verified by an ensemble of detection experts, including a compound-attack-aware expert for multi-trigger inputs. A joint threshold-shrinkage search identifies an operating point ($\tau$ at the 97.1st percentile, $\gamma = 0.78$) that reduces the attack success rate (ASR) to as low as 0.1% while preserving 97.8% clean accuracy. Evaluation on six models (ResNet18, VGG16, MobileNet, AlexNet, ViT-Small, ViT-Base) shows strong generalization: near-100% ASR drops to single digits across poisoning rates of 1-10% and 1-9 simultaneous triggers, with only gradual degradation in clean accuracy. ASIC and FPGA implementations confirm practicality, adding a consistent 19-20% latency overhead across all evaluated architectures and establishing Combinatorial Lock as a hardware-native approach to multi-trigger backdoor mitigation.

I. INTRODUCTION

Multi-trigger backdoors broaden the threat through diverse, interacting trigger mechanisms, while existing defenses often depend on costly retraining, trigger reconstruction, or poisoned-sample detection. Combinatorial Lock proposes training-free runtime verification combining anomaly-gated spectral scrubbing and binary signatures, with ensemble detection and hardware implementations.

I. INTRODUCTION

  • Multi-trigger attacks combine heterogeneous mechanisms through sequential, parallel, or hybrid poisoning, increasing attack complexity, diversity, robustness, and resistance to detection.The paper describes triggers that can overwrite, coexist with, or cross-activate one another within a model.Source: Figure 1 · p. 1, §I · p. 2
  • Existing defenses rely on retraining, trigger reconstruction, or poisoned-sample identification, limiting computational efficiency and practical hardware integration.For multi-trigger attacks, BU+FT, BU+ANP, and BU+ABL rely on retraining, raise computational cost, and lose effectiveness at low poisoning rates while degrading clean accuracy.Source: §I · pp. 1–2
  • Combinatorial Lock offers runtime protection by exploiting trigger-induced activations in a distinct latent subspace and verifying compact binary signatures.The framework is training-free and reference-calibrated, combining anomaly-gated spectral scrubbing with hash-compressed combinatorial signatures.Source: §I · p. 2
  • 255 nonempty trigger combinations are evaluated by a compound-attack-aware ensemble detector, extending evaluation beyond conventional single-trigger tests.The hardware-efficient comparator, XOR, and popcount implementation adds 19–20% latency while retaining 97.8% clean accuracy and reducing ASR to as low as 0.1%.Source: §I · p. 2

II. THREAT MODEL

The threat model assumes a frozen deployed classifier compromised through training-time poisoning with multiple trigger mechanisms mapped to one target label. Each trigger transformation produces poisoned samples, and any input containing a trigger is redirected to that target.

II. THREAT MODEL

  • The attacker compromises a frozen deployed classifier through training-time poisoning with K heterogeneous trigger patterns, all mapped to target label y_t.The model therefore has hidden trigger-to-target mappings from multiple source classes.Source: §II · p. 2
  • Each trigger transformation T_k embeds its trigger into clean inputs, and trigger-specific poisoned subsets are selected according to a poisoning rate.The complete poisoned subset is formed from the union of the trigger-specific subsets.Source: §II · p. 2
  • The infected classifier behaves normally on clean samples but redirects inputs containing any embedded trigger to the target class.The paper identifies Trigger 9, the latent-domain Spy-Watermark, as particularly difficult for defenses calibrated to visible or structurally regular patterns.Source: §II · p. 2

III. PROPOSED FRAMEWORK

The framework uses the distinguishable malicious subspace associated with trigger-induced activations to detect and mitigate multi-trigger backdoors. Its pipeline separates detection through projected activations and signatures from mitigation through gated filtering and spectral scrubbing.

III. PROPOSED FRAMEWORK

  • Backdoor poisoning creates a distinguishable malicious subspace that can coexist with high clean accuracy and high attack success rate.The subspace becomes dominant in the latent representation when a trigger is present.Source: §III · p. 2
  • Representative clean, single-trigger, and combined multi-trigger poisoned images are used to evaluate the proposed defense.The figure presents examples of these three input categories.Source: Figure 2 · p. 3
  • The framework projects inference-time activations onto the malicious subspace and extracts compact binary descriptors for runtime detection and mitigation.The pipeline uses parallel detection and mitigation branches: detection applies subspace projection, hash descriptors, ensemble analysis, and runtime verification; mitigation uses gated median filtering and spectral scrubbing.Source: §III · p. 3

A. Feature Extraction and Trigger Validation

Feature extraction registers a hook on the model’s final feature layer and validates selected trigger mechanisms using raw activations and undefended ASR. The framework then uses SVD to identify a malicious subspace from dominant activation directions.

A. Feature Extraction and Trigger Validation

  • A forward hook extracts raw activations from the final feature layer for clean or poisoned inputs, while calibration measures each selected trigger’s undefended ASR.For CNNs, the hook is placed on the last convolutional layer.Source: A. Feature Extraction and Trigger… · p. 3

1) Malicious Subspace Projection:

  • SVD of activation matrix A separates latent directions, with triggered samples aligning more strongly to leading singular directions than clean samples.The first r right singular vectors span the malicious subspace used for projecting activations.Source: 1) Malicious Subspace Projection · p. 3

2) Hash-Guided Feature Projection:

Hash-Guided Feature Projection compresses projected activations into a binary hash and a combinatorial descriptor, then concatenates them for multi-expert verification.

2) Hash-Guided Feature Projection:

  • The 64-bit binary hash is a compact fingerprint of the projected activation, formed by thresholding each coefficient.Each hash bit is 1 when its coefficient exceeds its quantization threshold and 0 otherwise.Source: 2) Hash-Guided Feature Projection · p. 3
  • The combinatorial descriptor captures co-occurrence statistics among activated hash bits.It is computed from predefined collections of bit subsets.Source: 2) Hash-Guided Feature Projection · p. 3
  • The final feature representation concatenates the hash and combinatorial descriptor, pairing compact binary hashing with higher-order bit interactions for multi-expert verification.Source: 2) Hash-Guided Feature Projection · p. 3

3) Six-Expert Ensemble:

The six-expert ensemble combines detectors with different anomaly geometries to catch both separated and subtler anomalies intermixed with benign samples.

3) Six-Expert Ensemble:

  • All six detectors capture the separated anomaly cluster, but only some detect intermixed cases, motivating a weighted ensemble to address individual blind spots.The base detectors include Isolation Forest, One-Class SVM, Local Outlier Factor, and Mahalanobis distance, spanning several geometries.Source: 3) Six-Expert Ensemble · p. 3

4) Verification Phase:

The verification phase combines six experts’ anomaly scores and compares the aggregate with a validation-selected threshold to accept or reject inputs.

4) Verification Phase:

  • Six expert anomaly scores are combined into a single verification score through a weighted linear combination.Weights are estimated on a validation set so more discriminative experts contribute proportionally more.Source: 4) Verification Phase · pp. 3–4
  • Fig. 3 is identified as a block diagram of the proposed methodology.Source: Figure 3 · p. 4
  • The aggregated score is compared with detection threshold τ to accept or reject an input.The threshold is selected on the validation set to balance detection accuracy and false positives.Source: 4) Verification Phase · p. 4

C. Mitigation Phase

The mitigation phase gates image filtering on bright-spike detection, then removes a shrunken projection of the malicious subspace from deep activations before classification.

C. Mitigation Phase

  • Pixels above median threshold τm are treated as trigger-induced bright spikes and replaced with their neighborhood median.The gated median filter produces sanitized image xf.Source: C. Mitigation Phase · p. 4
  • Deep activations from the filtered image are projected onto malicious subspace basis Vr, and the projected component is suppressed by spectral shrinkage factor γ.The cleaned representation is zclean = z − γp.Source: C. Mitigation Phase · p. 4
  • The sanitized representation is passed to the classification head to produce the predicted label.Source: C. Mitigation Phase · p. 4

IV. RESULTS AND DISCUSSION

The threshold sweep identifies an operating point that sharply lowers ASR with little clean-accuracy loss, while the expert ensemble performs best at intermediate sizes. Larger ensembles can underperform both non-ensemble baselines.

A. Combinatorial Lock and Mitigation Parameter Analysis

  • At the 97.1st-percentile threshold, CA is 97.8% and ASR is 1.9%; beyond it, CA falls without further ASR improvement.From the 80th to 97th percentile, CA moves from 99% to 97.5% while ASR drops from 15% to 2%.Source: A. Combinatorial Lock and Mitigation… · pp. 4–5
  • γ = 0.78 best balances attack suppression and clean accuracy when soft-thresholding the dominant 18 singular components.Smaller γ leaves residual trigger features, while larger values unnecessarily degrade benign performance.Source: A. Combinatorial Lock and Mitigation… · p. 5

B. Detector Quality

  • AUROC peaks at 0.9854 for k = 6, and the ensemble beats the stronger baseline only for 4 ≤ k ≤ 7.Poorly sized ensembles (k ≤ 2 or k ≥ 9) underperform both baselines.Source: Table III · p. 5, B. Detector Quality · p. 5

C. Cross-Platform Hardware Evaluation

Across six backbones, the defense reduces ASR to roughly 0–2% across trigger counts, while comparative results show low ASR with little or no accuracy cost versus unlearning baselines. Hardware results show nearly constant latency overhead across models.

C. Cross-Platform Hardware Evaluation

  • Latency overhead remains between 19.17% and 20.03% across all six backbones, with the defense logic instantiated without architecture-specific redesign.INT8 reduces memory footprint by 4× relative to FP32 for all models; ASIC cell count, area, and power increase from AlexNet to ViT-Base.Source: C. Cross-Platform Hardware Evaluation · pp. 5–6

D. Comparative Performance Analysis

  • CA declines marginally as poisoning rate and trigger count increase on ResNet18, from 98.60% at 1 trigger and 1% poisoning to 97.87% at 9 triggers and 10% poisoning.ViT-Small is more sensitive to poisoning rate, dropping from 97.82% at 1% poisoning to 89.20% at 10% with a single trigger.Source: D. Comparative Performance Analysis · p. 6
  • The proposed method achieves the highest CA on ResNet18 (98.25% vs. 98.09–98.11%) and AlexNet (89.81% vs. 88.88–88.91%), while reducing ASR to 0.15–1.27% versus 1.90–4.35% for baselines.On VGG16 it exceeds BU+FT and BU+ABL in CA (93.65% vs. 93.48–93.49%) and stays within 0.10 percentage points of the best MobileNet baseline (91.76% vs. 91.86%).Source: Table IV · p. 6, D. Comparative Performance Analysis · p. 6
  • ASR falls from 98–100% before defense to roughly 0–2% across all six models and trigger counts after defense.ResNet18 shows only a marginal ASR increase as trigger count approaches 9.Source: D. Comparative Performance Analysis · p. 6

V. CONCLUSION

Combinatorial Lock reduces multi-trigger detection to binary runtime signatures evaluated with combinatorial operations. Across six architectures and 1–9 triggers, it sharply reduces ASR, while ASIC and FPGA implementations add 19–20% latency overhead; future work targets broader robustness and lower overhead.

V. CONCLUSION

  • Average ASR falls to 1.9% (lowest: 0.1%) while clean accuracy remains 97.8%; near-100% ASR collapses to single digits across 1–9 triggers and six architectures.The selected operating point uses τ at the 97.1st percentile and γ = 0.78.Source: §V · p. 6
  • Combinatorial Lock encodes activation profiles as binary runtime signatures, reducing detection to Hamming distances, popcounts, and XOR comparisons using integer and logic arithmetic.The conclusion characterizes the defense as training-free, architecture-agnostic, and hardware-native.Source: §V · p. 6
  • Fig. 5 covers parameter sensitivity and ASR robustness of Combinatorial Lock.The caption identifies the figure's scope but does not state its specific outcomes.Source: Figure 5 · p. 7
  • ASIC and FPGA implementations confirm Combinatorial Lock’s practicality, adding 19–20% latency overhead, modest area and power costs, and 4–22 KB of INT8 storage.Source: §V · p. 7
  • Future work will examine adaptive threshold selection, unseen and adaptive triggers, multimodal and foundation models, and hardware–software co-design to reduce overhead while preserving security guarantees.These are stated as directions for further investigation.Source: §V · p. 7
Loading 2610.33437v2…