Search papers, labs, and topics across Lattice.
This paper introduces GradLock, a novel training-time injection attack that circumvents the limitations of traditional model inversion attacks by directly embedding sensitive training data into model parameters. By utilizing stateless deterministic indexing and dynamic gradient locking, GradLock allows adversaries to extract pixel-perfect reconstructions of private data with minimal degradation during optimization. Experiments demonstrate that GradLock achieves near-lossless reconstruction across various datasets and highlights a critical vulnerability in AI supply chains, as 93.3% of users failed to detect the malicious logic.
GradLock can extract pixel-perfect data from compromised models in under a second, exposing a critical blind spot in AI supply chain security.
Existing model inversion (MI) attacks predominantly rely on post-training optimization to recover private data from model outputs. However, these methods are fundamentally constrained by the target model's generalization bottleneck, often yielding generic features rather than specific identities, particularly on high-dimensional datasets. In this paper, we introduce GradLock, a novel training-time injection attack that stealthily injects sensitive training data directly into the model parameters. Operating within a compromised supply chain context, GradLock leverages stateless deterministic indexing to establish isolated data vaults and employs dynamic gradient locking to prevent payload degradation during the optimization process. This mechanism allows the adversary to extract pixel-perfect data from the final model without retaining access to the training environment. Extensive experiments on MNIST, Imagenette, and CelebA demonstrate that GradLock achieves near-lossless reconstruction (SSIM ~ 1.0) and instant extraction (<1.0s). Compared to existing training-time injection methods, our approach exhibits superior robustness against standard deployment optimizations, including quantization, pruning, and fine-tuning. Furthermore, a user deployment study reveals that 93.3% of participants failed to detect the malicious logic, highlighting a severe blind spot in the security of modern AI supply chains.
