Poisoned data cannot create irrecoverable backdoors in models
A preprint proves that backdoors installed through poisoned data can be reconstructed by defenders, confirming the result with experiments on instruction-tuned large language models.
Edited by Boris Djordjevic · Paperfoot
In a theoretical preprint, researchers proved that backdoors planted through the labels of poisoned training data cannot remain unrecoverable to defenders, and confirmed the result on instruction-tuned large language models. Defending against a backdoor requires recovering the verifier that decides whether an input is a trigger, since blocking individual triggers fails when an attacker can generate new ones.
The authors showed that no cryptographic asymmetry can arise when a verifier enters training only through poisoned data labels. Because training is itself a learner for that verifier, any rule poisoning can install is reconstructible by a white-box defender—one with access to internal model weights—holding as many labeled trigger observations as the attacker used. Hiding secret keys in inputs or weights does not alter this. Tests on instruction-tuned large language models confirmed the dichotomy, yielding no backdoor that was both effective for the attacker and irrecoverable for the defender.
Why it matters
Through mathematical proof and language model experiments, the preprint settles that data poisoning cannot create backdoors with cryptographic secrecy. This shows researchers that any trigger-detection rule a model can learn from poisoned labels can in principle also be reconstructed and countered by defenders.
Caveats
The guarantee requires a white-box defender holding as many labeled trigger observations as the attacker used, and it applies only when the backdoor enters training through data labels. The work is a preprint that has not yet been peer-reviewed, and the abstract does not report the specific language models tested or the number of experimental runs.
In this paper
reconstructing backdoor verifiers from poisoned data
- Methods
- SGDQwen2.5-7B-InstructLlama-3-8B-InstructMistral-7B-Instruct-v0.3Gemma-2-9B-ITPiccolo
- Datasets
- Tulu V3 (training)
What it shows
- A backdoor whose verifier enters training only through poisoned data labels cannot exhibit cryptographic asymmetry against a white-box defender holding representative labeled observations.
We have shown that a backdoor whose verifier enters training through the labels of poisoned data cannot exhibit cryptographic asymmetry against a white-box defender who holds representative labeled observations of the trigger condition.
5 Conclusion
- Any verifier hard to learn cannot be installed through poisoning, and any verifier poisoning can install is reconstructible by a white-box defender holding as many labeled trigger observations as the attacker used.
Hence any verifier that is hard to learn cannot be installed through poisoning, and any verifier that poisoning can install is reconstructible by a white-box defender holding as many labeled trigger observations as the attacker used.
Abstract
- No verifier can both be installed successfully by a polynomial-time poisoning-based procedure and exhibit learning-based cryptographic asymmetry.
No verifier V can both be installed successfully by a polynomial-time poisoning-based procedure and exhibit learning-based cryptographic asymmetry.
Corollary 1 (Impossibility for poisoning-based backdoors).
- A secret key does not give a self-contained poisoning-based backdoor learning-based cryptographic asymmetry against a white-box defender.
A secret key does not give a self-contained poisoning-based backdoor learning-based cryptographic asymmetry against a white-box defender.
Corollary 2 (No asymmetry via key embedding).
- For verifier-level defense against poisoning, the only barrier is acquiring representative observations.
For verifier-level defense against poisoning, the only barrier is acquiring representative observations.
5 Conclusion
Quoted word for word from the full text on arXiv.
The paper
Poisoning-Based Backdoors Are Not Cryptographic
arXiv, Oct 20, 2026, Open access, CC BY, Preprint, not peer-reviewed
doi.org/10.48550/arxiv.2610.28045
arXiv:2610.28045v2 in cs.LG, also cs.CL
Comments: NeurIPS 2026
Cite as BibTeX
@misc{kaneko2026poisoningbased,
title = {Poisoning-Based Backdoors Are Not Cryptographic},
author = {Kaneko, Masahiro},
year = {2026},
eprint = {2610.28045},
archivePrefix = {arXiv},
primaryClass = {cs.LG},
doi = {10.48550/arxiv.2610.28045},
url = {https://arxiv.org/abs/2610.28045}
}