{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/stealthy-backdoors-as-compression-artifacts","title":"Stealthy Backdoors as Compression Artifacts","arxiv_id":"2104.15129","date":"2021-04-30","proceeding":null,"authors":["Yulong Tian","Fnu Suya","Fengyuan Xu","David Evans"],"abstract":"In a backdoor attack on a machine learning model, an adversary produces a model that performs well on normal inputs but outputs targeted misclassifications on inputs containing a small trigger pattern. Model compression is a widely-used approach for reducing the size of deep learning models without much accuracy loss, enabling resource-hungry models to be compressed for use on resource-constrained devices. In this paper, we study the risk that model compression could provide an opportunity for adversaries to inject stealthy backdoors. We design stealthy backdoor attacks such that the full-sized model released by adversaries appears to be free from backdoors (even when tested using state-of-the-art techniques), but when the model is compressed it exhibits highly effective backdoors. We show this can be done for two common model compression techniques -- model pruning and model quantization. Our findings demonstrate how an adversary may be able to hide a backdoor as a compression artifact, and show the importance of performing security tests on the models that will actually be deployed not their precompressed version.","url_abs":"https://arxiv.org/abs/2104.15129v1","url_pdf":"https://arxiv.org/pdf/2104.15129v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"stealthy-backdoors-as-compression-artifacts","repo_url":"https://github.com/yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"},{"task_slug":"model-compression","task_name":"Model Compression"},{"task_slug":"quantization","task_name":"Quantization"}],"methods":[{"method_slug":"pruning","method_name":"Pruning"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":null,"atlas_url":"https://app.syntology.ai/?focus=2104.15129","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2104.15129"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"unverified":10},"by_repo_kind":{"official":{"samples":10,"ran":0,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"ff3b74e78c31e77d","entry":"add_inputs_with_trigger","repo":"yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts","repo_kind":"official","path":"precision_utils.py","file_url":"https://github.com/yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts/blob/HEAD/precision_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ff3b74e78c31e77d"}},{"code_sha256_prefix":"66d391a79ddc790c","entry":"find_epoch","repo":"yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts","repo_kind":"official","path":"train_quantization_attack/verify_models_average.py","file_url":"https://github.com/yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts/blob/HEAD/train_quantization_attack/verify_models_average.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"66d391a79ddc790c"}},{"code_sha256_prefix":"8668a99ae353e52a","entry":"find_epoch","repo":"yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts","repo_kind":"official","path":"train_quantization_attack/verify_models_average_similar_dataset.py","file_url":"https://github.com/yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts/blob/HEAD/train_quantization_attack/verify_models_average_similar_dataset.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8668a99ae353e52a"}},{"code_sha256_prefix":"e20dc6c0d50fc5d7","entry":"get_normal_model","repo":"yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts","repo_kind":"official","path":"trojan_detection_mntd/run_meta_verify_compression_backdoor.py","file_url":"https://github.com/yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts/blob/HEAD/trojan_detection_mntd/run_meta_verify_compression_backdoor.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e20dc6c0d50fc5d7"}},{"code_sha256_prefix":"26cd848697f27333","entry":"get_trigger_image","repo":"yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts","repo_kind":"official","path":"precision_utils.py","file_url":"https://github.com/yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts/blob/HEAD/precision_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"26cd848697f27333"}},{"code_sha256_prefix":"b9309fc99690f67b","entry":"get_vgg16","repo":"yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts","repo_kind":"official","path":"models/vgg_original.py","file_url":"https://github.com/yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts/blob/HEAD/models/vgg_original.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b9309fc99690f67b"}},{"code_sha256_prefix":"b0693db7b7ac899f","entry":"tensor_normalize","repo":"yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts","repo_kind":"official","path":"precision_utils.py","file_url":"https://github.com/yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts/blob/HEAD/precision_utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b0693db7b7ac899f"}},{"code_sha256_prefix":"400fad4c2a965a37","entry":"test","repo":"yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts","repo_kind":"official","path":"train_baseline_models/auto_compress_for_clean_models.py","file_url":"https://github.com/yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts/blob/HEAD/train_baseline_models/auto_compress_for_clean_models.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"400fad4c2a965a37"}},{"code_sha256_prefix":"2c4031d6d415bebd","entry":"trans_state_dict_pruning_test","repo":"yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts","repo_kind":"official","path":"trojan_detection_mntd/run_meta_verify_compression_backdoor.py","file_url":"https://github.com/yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts/blob/HEAD/trojan_detection_mntd/run_meta_verify_compression_backdoor.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2c4031d6d415bebd"}},{"code_sha256_prefix":"d0df92871fcae1d3","entry":"trans_state_dict_test","repo":"yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts","repo_kind":"official","path":"trojan_detection_mntd/run_meta_verify_compression_backdoor.py","file_url":"https://github.com/yulongtzzz/Stealthy-Backdoors-as-Compression-Artifacts/blob/HEAD/trojan_detection_mntd/run_meta_verify_compression_backdoor.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d0df92871fcae1d3"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}