In this paper we show that cryptographic backdoors in a neural network (NN) can be highly effective in two directions, namely mounting the attacks as well as in presenting the defenses as well. On the attack side, a carefully planted cryptographic backdoor enables powerful and invisible attack on the NN. Considering the defense, we present applications: first, a provably robust NN watermarking scheme; second, a protocol for guaranteeing user authentication; and third, a protocol for tracking unauthorized sharing of the NN intellectual property (IP). From a broader theoretical perspective, borrowing the ideas from Goldwasser et. al. [FOCS 2022], our main contribution is to show that all these instantiated practical protocol implementations are provably robust. The protocols for watermarking, authentication and IP tracking resist an adversary with black-box access to the NN, whereas the backdoor-enabled adversarial attack is impossible to prevent under the standard assumptions. While the theoretical tools used for our attack is mostly in line with the Goldwasser et. al. ideas, the proofs related to the defense need further studies. Finally, all these protocols are implemented on state-of-the-art NN architectures with empirical results corroborating the theoretical claims. Further, one can utilize post-quantum primitives for implementing the cryptographic backdoors, laying out foundations for quantum-era applications in machine learning (ML).

翻译：本文研究表明，神经网络（NN）中的密码学后门在攻击发起与防御构建两个方向上均能发挥高度有效作用。在攻击层面，精心植入的密码学后门可对神经网络实施强大且隐蔽的攻击。于防御方面，我们提出三项应用：其一，可证明鲁棒的神经网络水印方案；其二，保障用户身份认证的协议；其三，追踪未经授权共享神经网络知识产权（IP）的协议。从更广泛的理论视角出发，借鉴Goldwasser等人[FOCS 2022]的思想，我们的主要贡献在于证明所有这些实例化的实用协议实现均具备可证明鲁棒性。水印、认证与IP追踪协议能够抵御具备黑盒访问权限的对手，而基于后门的对抗性攻击在标准假设下无法预防。尽管用于攻击的理论工具基本沿袭Goldwasser等人的思路，但防御相关证明仍需进一步研究。最终，所有协议均在最新神经网络架构上实现，实验结果佐证了理论论断。此外，可运用后量子密码学原语实现密码学后门，为机器学习（ML）的量子时代应用奠定基础。