FlagThis

Abstract

The widespread adoption of pre-trained models distributed through public repositories such as Hugging Face has introduced a supply-chain attack surface in which downstream consumers must rely on classifiers from untrusted third parties. Such a classifier may behave correctly on clean inputs but route trigger-embedded inputs to an adversary-chosen target class. Parameter-level detection is the primary line of defense against such attacks, yet existing detectors and attacks have co-evolved empirically, with no attack to date ruling out detection by any efficient algorithm. The only prior construction with a formal undetectability guarantee is restricted to single-layer networks with weights drawn from a random distribution, leaving open whether provable undetectability is achievable for the pre-trained multi-layer classifiers used in practice. We present Sparse Backdoor, a supply-chain attack that plants a provably undetectable backdoor in pre-trained image classifiers, including convolutional networks and Vision Transformers.