Technical Summary: Hardware-Triggered Backdoors

Problem Statement

Machine learning models are routinely deployed across heterogeneous computing hardware, ranging from consumer GPUs to high-performance accelerators. A fundamental assumption in this ecosystem is that different hardware platforms produce identical inference results for the same model and input. However, due to the non-associativity of floating-point arithmetic and variations in hardware design (e.g., block sizes, warp scheduling), executing the same model on different devices yields small numerical deviations. While these deviations are typically considered harmless and stochastic, this paper challenges that view. We demonstrate that these minor numerical variations can be deliberately exploited to create hardware-triggered backdoors. Unlike traditional backdoors that rely on explicit input triggers (e.g., a specific pixel pattern), these attacks activate malicious behavior solely based on the hardware accelerator used for inference.

Methodology

Threat Model

The attacker is assumed to have control over the model prior to deployment (e.g., via a supply-chain attack or by uploading a manipulated model to a public platform). The victim deploys the model across different hardware devices (e.g., development on a standard GPU vs. production on a high-end accelerator). The attacker's goal is to manipulate the model such that specific target inputs are misclassified only on the target hardware, while maintaining correct predictions on all other devices and for all other inputs.

Attack Strategy

The attack relies on the observation that a trained model does not correspond to a single decision function but rather a family of distinct functions depending on the execution hardware. The attack proceeds in two main steps:

1. Shaping the Decision Boundary:
   The attacker optimizes the model parameters to move the decision boundary locally close to a target input $\hat{x}$. This is achieved by minimizing a proxy loss $L$ that encourages the two largest logits to be nearly equal (creating a tie) while penalizing deviations from the original class label and the original model weights. This step is performed using standard gradient descent on a single hardware device.
   $$\arg \min_{\theta} L(\theta, f_\theta(\hat{x}; h_1))$$
   where $L$ includes terms for decision boundary proximity ($L_{diff}$), class preservation ($L_{class}$), and regularization ($L_{reg}$).

2. Refining Deviations:
   Once the input is near the decision boundary, the attacker amplifies the hardware-dependent numerical deviations to flip the prediction on the target device. Since these deviations are non-differentiable, the attacker employs heuristic strategies:

   • Implicit Modifications (Topological Permutation): Reordering floating-point operations without changing mathematical equivalence under exact arithmetic. This is achieved by permuting weights in consecutive linear layers (e.g., $W_1 W_2 \rightarrow (P_1 W_1)(P_1^{-1} W_2)$), which alters the order of additions and thus the accumulation of rounding errors.
   • Explicit Modifications (Parameter Perturbation): Flipping a small number of bits ($k$) in the model parameters. This introduces actual numerical changes that affect computation even under exact arithmetic.

The process uses an alternating optimization procedure, generating multiple candidate models in each iteration to search for a configuration that successfully splits the prediction across hardware while maintaining overall model utility.

Key Contributions

1. Hardware-Triggered Backdoors: We introduce a novel attack vector where malicious behavior is activated by specific hardware rather than an input trigger. The hardware's numerical behavior acts as a latent trigger.
2. Causal Analysis: We perform a layer-wise causal analysis using cross-hardware activation patching to identify where hardware-induced differences arise. We find that deviations can originate in early layers (e.g., patch embeddings in ViTs) or emerge as a cumulative effect across layers.
3. Empirical Evaluation: We demonstrate the efficacy of these backdoors across various model architectures (ResNet, EfficientNet, ViT), hardware devices (Nvidia A100, H100, A40, RTX 6000), and numerical formats (float32, float16, bfloat16).

Experimental Results

• Success Rates: The attack achieves success rates above 90% for most hardware pairs and model architectures. For example, in float32, ResNet and EfficientNet achieved 100% success rates on several GPU pairs, while ViT achieved rates between 94% and 98%.
• Stealth: The backdoored models retain a median of 99.8% of the original model's performance on clean data, ensuring the manipulation remains undetected during regular operation.
• Robustness: The backdoors are robust to input perturbations (up to $10^3$ ULPs), batching variations, and mixed-precision inference, though they degrade under significant input noise.
• Multiple Targets: While effective for single targets, the success rate decreases as the number of simultaneous target inputs increases, dropping below 50% for five targets due to conflicting optimization objectives.
• Selectivity: The attack can be tuned for "one-vs-rest" scenarios, triggering misclassification on exactly one device while maintaining correct predictions on all others.

Countermeasures

We evaluated several defenses:

• Input Perturbation: Adding noise to inputs can mitigate the attack, but requires significant distortion to be effective.
• Batching: Randomizing batch sizes is not a reliable defense, as it only suppresses backdoors in some configurations.
• Mixed Precision: Downcasting to lower precision weakens the attack but does not eliminate it.
• Fine-Tuning: Active fine-tuning on clean data is the most effective defense, reducing backdoor success rates to near zero within a few gradient steps.

Significance and Conclusion

This work reveals that the security of machine learning systems cannot be isolated from the underlying hardware. Even seemingly negligible numerical deviations, previously dismissed as benign artifacts of floating-point arithmetic, constitute a viable attack surface. Our findings indicate that the integrity of machine learning models must be considered across the entire computing stack, from the trained algorithms down to the specific hardware accelerators used for inference. We hope this work encourages practitioners to consider hardware-dependent vulnerabilities and motivates the development of end-to-end security measures for machine learning deployment.