Search papers, labs, and topics across Lattice.
This paper introduces (A)iSpy, a parasitic Trojan that exploits vulnerabilities in machine learning infrastructure by actively observing and manipulating tensor states during training and inference. By targeting critical hyperparameters and employing stealthy manipulations, (A)iSpy transforms weak data poisoning into highly effective backdoor attacks, achieving success rates of 100%. The findings highlight a significant blind spot in current ML security practices, as standard integrity checks fail to detect these sophisticated threats operating within the computation graph.
A single parasitic Trojan can turn benign data poisoning into a 100% effective backdoor attack by leveraging real-time interactions within ML training dynamics.
Modern machine learning (ML) pipelines depend heavily on third party libraries for graph compilation and hardware acceleration. While current practices audit data and model artifacts or rely on file integrity checks, the execution environment remains implicitly trusted. This blind spot enables active threats where a malicious runtime module interacts directly with live training and inference dynamics: exploiting this interaction allows the Trojan to support complex objectives that are challenging for static code or binary modifications, achieving manipulations impossible for standard data and model level attacks. We expose this vulnerability by presenting (A)iSpy, a parasitic infrastructure Trojan that subverts ML systems through an active observe and execute paradigm. Operating within the computation graph, (A)iSpy monitors transient tensor states to perform targeted, stealthy manipulations with negligible overhead. To violate confidentiality, the Trojan identifies all critical training hyperparameters and covertly exfiltrates them via model weights or output logits. To break integrity, it acts as a gradient amplifier: by observing steganographic triggers, it transforms otherwise weak data poisoning into effective backdoor attacks, increasing success rates from near zero to 100%. We further demonstrate broad extensibility across the machine learning lifecycle by validating auxiliary attacks in the appendix, including subpopulation label flipping, availability disruptions, and inference stage manipulations. Importantly, the (A)iSpy module easily evades standard malware scanners, while the associated poisoned inputs and resulting compromised models bypass typical inspection tools. We demonstrate the practicality of this threat with an implementation in the ONNX Runtime training and inference engines.
