Why Backdooring Neural Networks is so Easy?

arXiv:2609.36117v1 Announce Type: new Abstract: Securing modern AI systems against backdoor attacks remains an open challenge and requires fundamentally principled estimates of the adversary's budget -- the poison fraction pi and trigger strength alpha needed to construct successful yet stealthy attacks. Motivated by recent empirical evidence that poisoning large language models can require a nearly constant number of malicious samples even as clean datasets grow, we derive an exact closed-form analysis of a quadratic neuron trained on a poisoned Gaussian mixture. We show, perhaps counterintuitively, that the same feature-learning dynamics that make neural networks powerful can also make them more vulnerable to backdoors. Specifically, with clean accuracy preserved to first order, O(pi), we demonstrate that lazy learning imposes the inverse-square-root scaling alpha propto pi^{-1/2} for a successful attack, while feature learning induces a quadratic detector whose loss margin scales as O(alpha^4), improving the attack budget to alpha propto pi^{-1/4}. Consequently, nonlinear feature learning substantially reduces the trigger strength required at small poison fractions, thereby in a sense making feature learners more backdoor vulnerable. These results provide a theoretical mechanism consistent with large-scale empirical observations and demonstrate that security audits based on linear heuristics can systematically underestimate backdoor vulnerability in the widely adopted feature-learning regimes.

Source: arXiv cs.LG | 2026-09-30

Related