Modern DNNs are repeatedly fine-tuned to incorporate new data and functionality. This evolutionary workflow introduces a security risk when updated data cannot be fully trusted, as adversaries may implant Trojans during fine-tuning. We present MIST, a Trojan detection approach that analyzes how a model's internal representations change during fine-tuning. Rather than attempting to reconstruct trigger conditions, MIST characterizes benign model evolution using pre-activation spectra and flags updates whose spectral deviations are inconsistent with this reference. This framing treats Trojan detection as a regression problem over model updates. An empirical evaluation across four datasets and eight Trojan attacks shows that spectral distances reliably distinguish Trojaned updates from clean fine-tuning. MIST outperforms state-of-the-art detection accuracy after a single update, without requiring any knowledge about the poisoned data or the trigger, and remains effective under multi-step benign evolution, with graceful and bounded degradation. These results indicate that spectral evolution provides a stable and assumption-light signal for detecting malicious model updates.

翻译：现代深度神经网络通过持续微调来整合新数据与功能。这种演化式工作流在更新数据无法完全可信时引入了安全隐患，因为攻击者可能在微调过程中植入木马。本文提出MIST木马检测方法，通过分析模型内部表征在微调过程中的变化进行检测。不同于尝试重建触发条件的传统方案，MIST利用预激活谱表征良性模型演化，并将谱偏差不符合该参考的更新标记为异常。该框架将木马检测转化为模型更新的回归问题。在四个数据集与八种木马攻击上的实验评估表明，谱距离能够可靠区分携带木马的更新与干净微调。MIST在单次更新后即达到优于现有技术的检测精度，且无需知晓投毒数据或触发器的任何信息；在多步良性演化场景下仍保持有效性，仅呈现优雅且有限度的性能下降。这些结果表明谱演化为检测恶意模型更新提供了稳定且低假设依赖的信号。