Ilmu Komputer & AI editorial
Implementing a White-Box Undetectable Backdoor for Random Fourier Features
The core problem
Goldwasser et al. demonstrated that undetectable backdoors can be planted in machine learning models trained with the Random Fourier Features (RFF) algorithm, under a hardness assumption tied to the Continuous Learning With Errors (CLWE) problem. Under standard cryptographic assumptions, even a full white-box audit of a model's weights cannot detect this class of backdoor. However, the original construction is stated in terms of cryptographic reductions and probabilistic lemmas, without a reference implementation, and relies on secondary machinery such as the Sparse Gaussian Pancakes distribution and a homogeneous CLWE conditional density. Its realizability in ordinary numerical code is not obvious from the paper alone.
This work addresses that gap by implementing the white-box CLWE-RFF backdoor construction end to end using only numpy and scipy. The central question is whether this threat is realizable with commodity scientific-computing tools or requires specialized cryptographic infrastructure. The authors provide two samplers for the core distribution: a rejection-sampling proxy and an exact closed-form sampler derived from the homogeneous CLWE density. They then r
Innovation
Statistical indistinguishability tests were conducted across a range of sparsity ratios . The tests covered both weight-space and functional black-box comparisons. In weight-space, the distributions of model weights for backdoored and clean models were compared using standard two-sample tests (e.g., Kolmogorov-Smirnov, energy distance). In functional black-box comparisons, the outputs of the models on random inputs were compared.
The key finding is that **no evidence of detectable difference** was found between backdoored and clean models across the tested range of . This held for both the rejection-sampling proxy and the exact closed-form sampler. The exact sampler, verified against its analytic form, produced samples that were statistically indistinguishable from the theoretical distribution. The tests did not reveal any systematic deviation that would allow an auditor to flag a backdoored model.
Quantitative results are summarized in the table below (illustrative values based on the paper's claims):
| Sparsity ratio | Weight-space p-value | Black-box p-value |
|------------------------|----------------------|-------------------|
| 0.01
Why it matters
The implementation reveals that the white-box CLWE-RFF backdoor is realizable with commodity scientific-computing tools. The exact closed-form sampler for was the most challenging component, requiring derivation from the homogeneous CLWE density that was not fully spelled out in the original paper. The rejection-sampling proxy, while simpler, was less efficient but still produced statistically indistinguishable results.
Several parts of the construction were straightforward to realize, including the RFF training pipeline and the statistical testing framework. However, the authors did not attempt to reproduce the underlying lattice hardness reduction, which remains a theoretical assumption. This omission means that the security guarantee of the backdoor still rests on the CLWE hardness assumption, which is not empirically verified here.
The findings have implications for the security of machine learning models. They suggest that undetectable backdoors are not merely a theoretical curiosity but can be implemented by practitioners with standard tools. This raises concerns about the trustworthiness of outsourced model training and the effectiveness of white-box audits. Future work could explore defenses that go beyond statistical indistinguishability, such as certified robustness or cryptographic commitments to training data.
The paper concludes by reiterating that this is a contribution to understanding practical realizability, not a new theoretical result. The code and samplers are made available to facilitate further research.
Who should read this
Opening member contentโฆ