{"693622":{"#nid":"693622","#data":{"type":"news","title":"Researchers Find Architectural Backdoors in AI Models Are Harder to Exploit in the Real World","body":[{"value":"\u003Cp\u003EImagine a vehicle powered by artificial intelligence (AI) whose object detection system has been secretly modified to misidentify stop signs whenever a particular visual pattern appears in its camera feed.\u003C\/p\u003E\u003Cp\u003EUnlike traditional AI backdoors, which manipulate a model\u0027s learned parameters, architectural backdoors hide malicious instructions directly in the code that defines how the model operates.\u003C\/p\u003E\u003Cp\u003EHowever, everyday image-processing operations, such as cropping, adjusting contrast, or adding noise, can change a trigger pattern and prevent an attack from working, according to \u003Ca href=\u0022https:\/\/davidoygenblik.github.io\/pdfs\/FAULT.pdf\u0022\u003Enew research\u003C\/a\u003E from Georgia Tech.\u003C\/p\u003E\u003Cp\u003EThe findings challenge assumptions about how practical these attacks are. Although previous research showed that architectural backdoors could work under controlled conditions, the Georgia Tech team found that existing approaches struggle to remain effective and difficult to detect when AI systems process images under realistic conditions.\u003C\/p\u003E\u003Cp\u003E\u201cThe biggest misconception is that demonstrating an architectural backdoor under controlled conditions means it will actually work in the real world,\u201d said \u003Cstrong\u003EDavid Oygenblik\u003C\/strong\u003E, Ph.D. student and lead author of the study.\u003C\/p\u003E\u003Cp\u003EThe study details the development of FAULT, a framework for evaluating architectural backdoors under realistic conditions.\u003C\/p\u003E\u003Cp\u003EThe findings reveal a tradeoff. Attackers can make a backdoor more sensitive, so it recognizes its trigger after an image has been changed. But that also increases the chance that ordinary images will accidentally activate the backdoor, potentially hurting the AI system\u2019s performance.\u003C\/p\u003E\u003Cp\u003E\u201cFor the architectural backdoors we study, this tradeoff is fundamental,\u201d Oygenblik said.\u003C\/p\u003E\u003Cp\u003EThe team found that this problem persisted across five methods of implementing architectural backdoors. Even when attackers knew how the system would process images, they struggled to make their attacks both reliable and difficult to detect.\u003C\/p\u003E\u003Cp\u003EThe research did not test attacks against real vehicles or other production systems, nor did it demonstrate outcomes such as crashes or ransomware. Instead, it examined whether existing architectural backdoors could reliably activate under different image-processing conditions.\u003C\/p\u003E\u003Cp\u003EHowever, the findings highlight a potential risk in the AI software supply chain. If an attacker inserted malicious code into an AI model used in a real system, the backdoor could potentially cause incorrect predictions when its trigger was detected. The consequences would depend on how the system used the model\u2019s output.\u003C\/p\u003E\u003Cp\u003EBecause architectural backdoors hide in code, examining a model\u2019s learned parameters or retraining it may not be enough to uncover or remove the threat.\u003C\/p\u003E\u003Cp\u003EOygenblik said developers should test AI systems under realistic conditions, watch for unexpected drops in accuracy, and examine model code for suspicious trigger-detection logic.\u003C\/p\u003E\u003Cp\u003E\u003Ca href=\u0022https:\/\/davidoygenblik.github.io\/pdfs\/FAULT.pdf\u0022\u003E\u003Cem\u003EFinding FAULTs in Architectural Backdoors: Why Trigger Detection Fails Under Real-World Conditions\u003C\/em\u003E\u003C\/a\u003E, was accepted to the \u003Ca href=\u0022https:\/\/sigsac.org\/ccs\/CCS2026\/\u0022\u003EACM Conference on Computer and Communications Security\u003C\/a\u003E. The authors will present the paper in The Hague in November.\u003C\/p\u003E\u003Cp\u003EOygenblik conducted the research with undergraduate students \u003Cstrong\u003ETeja Akella\u003C\/strong\u003E and \u003Cstrong\u003ETanmay Gupta\u003C\/strong\u003E, Ph.D. student \u003Cstrong\u003EYizhi Huang,\u003C\/strong\u003E and Associate Professor \u003Cstrong\u003EBrendan Saltaformaggio\u003C\/strong\u003E of Georgia Tech\u2019s \u003Ca href=\u0022https:\/\/cyfi.ece.gatech.edu\/\u0022\u003ECyber Forensics Innovation Laboratory\u003C\/a\u003E. The lab is a collaboration between the \u003Ca href=\u0022https:\/\/scp.cc.gatech.edu\/\u0022\u003ESchool of Cybersecurity and Privacy\u003C\/a\u003E and the \u003Ca href=\u0022https:\/\/ece.gatech.edu\/\u0022\u003ESchool of Electrical and Computer Engineering\u003C\/a\u003E.\u0026nbsp;\u003C\/p\u003E","summary":"","format":"limited_html"}],"field_subtitle":"","field_summary":[{"value":"\u003Cp\u003EArchitectural backdoors in AI models appear harder to exploit reliably under real-world image processing. Georgia Tech researchers developed FAULT to evaluate these threats beyond controlled demonstrations.\u003C\/p\u003E\u003Cp\u003E\u2022\u2002Cropping, contrast changes, and similar transformations can disrupt visual triggers across five backdoor methods.\u003Cbr\u003E\u2022\u2002Increasing trigger sensitivity improves reliability but also raises accidental activations and may reduce system performance.\u003Cbr\u003E\u2022\u2002The study warns that parameter inspection or retraining may miss code-based threats, urging realistic testing and code reviews for suspicious trigger logic.\u003C\/p\u003E","format":"limited_html"}],"field_summary_sentence":[{"value":"Architectural backdoors in AI models appear harder to exploit reliably under real-world image processing. Georgia Tech researchers developed FAULT to evaluate these threats beyond controlled demonstrations."}],"uid":"36253","created_gmt":"2026-10-29 17:11:18","changed_gmt":"2026-10-29 17:16:10","author":"John Popham","boilerplate_text":"","field_publication":"","field_article_url":"","location":"Atlanta, GA","dateline":{"date":"2026-10-29T00:00:00-04:00","iso_date":"2026-10-29T00:00:00-04:00","tz":"America\/New_York"},"extras":[],"hg_media":{"681594":{"id":"681594","type":"image","title":"Car-security.png","body":null,"created":"1793293918","gmt_created":"2026-10-29 17:11:58","changed":"1793293918","gmt_changed":"2026-10-29 17:11:58","alt":"A digital car with a lock on the top of it ","file":{"fid":"266018","name":"Car-security.png","image_path":"\/sites\/default\/files\/2026\/10\/29\/Car-security.png","image_full_path":"http:\/\/hg.gatech.edu\/\/sites\/default\/files\/2026\/10\/29\/Car-security.png","mime":"image\/png","size":758850,"path_740":"http:\/\/hg.gatech.edu\/sites\/default\/files\/styles\/740xx_scale\/public\/2026\/10\/29\/Car-security.png?itok=cyR93DUW"}}},"media_ids":["681594"],"groups":[{"id":"47223","name":"College of Computing"},{"id":"1188","name":"Research Horizons"},{"id":"660406","name":"School of Cybersecurity \u0026 Privacy"},{"id":"660367","name":"School of Cybersecurity and Privacy"}],"categories":[{"id":"194606","name":"Artificial Intelligence"},{"id":"153","name":"Computer Science\/Information Technology and Security"},{"id":"135","name":"Research"},{"id":"8862","name":"Student Research"}],"keywords":[],"core_research_areas":[{"id":"193655","name":"Artificial Intelligence at Georgia Tech"},{"id":"145171","name":"Cybersecurity"}],"news_room_topics":[],"event_categories":[],"invited_audience":[],"affiliations":[],"classification":[],"areas_of_expertise":[],"news_and_recent_appearances":[],"phone":[],"contact":[{"value":"\u003Cp\u003EJohn Popham\u003C\/p\u003E\u003Cp\u003ECommunications Officer for the School of Cybersecurity and Privacy\u003C\/p\u003E","format":"limited_html"}],"email":["jpopham3@gatech.edu"],"slides":[],"orientation":[],"userdata":""}}}