Poisoning-Based Backdoors Are Not Cryptographic

Summary

This research paper argues that poisoning-based backdoors in neural networks cannot be made cryptographic, so a defender could always learn them. The authors reduce backdoor installation to learning: any verifier that poisoning can install can be reconstructed by a white-box defender with comparable labeled trigger observations. Experiments on instruction-tuned large language models confirm that no configuration yields a backdoor that is both effective for the attacker and irrecoverable for the defender.

Related items

• MediumCVE-2026-114054: vLLM cache aliasing lets attackers collide shared cache keysSimilar attack · NVD/CVE Database
• HighCVE-2026-114053: vLLM arbitrary Python execution via mm_processor_kwargs code_revisionSimilar attack · NVD/CVE Database
• LowCVE-2026-114049: vLLM cross-request mask leak in InputBatch.condense() via /invocationsSimilar attack · NVD/CVE Database
• HighCVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro CrewSimilar attack · AWS Security Bulletins
• MediumFrom Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM UsageSimilar attack · Wiz Research Blog