{"slug": "researchers-find-architectural-backdoors-in-ai-models-are-harder-to-exploit-in", "title": "Researchers Find Architectural Backdoors in AI Models Are Harder to Exploit in the Real World", "summary": "Georgia Tech researchers found that architectural backdoors in AI models — malicious instructions hidden in model code rather than learned parameters — fail to stay both reliable and undetectable once images undergo routine processing such as cropping, contrast adjustment or added noise, according to a study accepted to the ACM Conference on Computer and Communications Security (CCS 2026). The team built FAULT, a framework for evaluating architectural backdoors under realistic conditions, and found the tradeoff held across five implementation methods: making a trigger more sensitive to image changes also raises the chance ordinary images activate the backdoor. \"The biggest misconception is that demonstrating an architectural backdoor under controlled conditions means it will actually work in the real world,\" said David Oygenblik, Ph.D. student and lead author; the research did not test attacks against real vehicles or production systems.", "body_md": "John Popham\n\nCommunications Officer for the School of Cybersecurity and Privacy\n\nImagine a vehicle powered by artificial intelligence (AI) whose object detection system has been secretly modified to misidentify stop signs whenever a particular visual pattern appears in its camera feed.\n\nUnlike traditional AI backdoors, which manipulate a model's learned parameters, architectural backdoors hide malicious instructions directly in the code that defines how the model operates.\n\nHowever, everyday image-processing operations, such as cropping, adjusting contrast, or adding noise, can change a trigger pattern and prevent an attack from working, according to [new research](https://davidoygenblik.github.io/pdfs/FAULT.pdf) from Georgia Tech.\n\nThe findings challenge assumptions about how practical these attacks are. Although previous research showed that architectural backdoors could work under controlled conditions, the Georgia Tech team found that existing approaches struggle to remain effective and difficult to detect when AI systems process images under realistic conditions.\n\n“The biggest misconception is that demonstrating an architectural backdoor under controlled conditions means it will actually work in the real world,” said **David Oygenblik**, Ph.D. student and lead author of the study.\n\nThe study details the development of FAULT, a framework for evaluating architectural backdoors under realistic conditions.\n\nThe findings reveal a tradeoff. Attackers can make a backdoor more sensitive, so it recognizes its trigger after an image has been changed. But that also increases the chance that ordinary images will accidentally activate the backdoor, potentially hurting the AI system’s performance.\n\n“For the architectural backdoors we study, this tradeoff is fundamental,” Oygenblik said.\n\nThe team found that this problem persisted across five methods of implementing architectural backdoors. Even when attackers knew how the system would process images, they struggled to make their attacks both reliable and difficult to detect.\n\nThe research did not test attacks against real vehicles or other production systems, nor did it demonstrate outcomes such as crashes or ransomware. Instead, it examined whether existing architectural backdoors could reliably activate under different image-processing conditions.\n\nHowever, the findings highlight a potential risk in the AI software supply chain. If an attacker inserted malicious code into an AI model used in a real system, the backdoor could potentially cause incorrect predictions when its trigger was detected. The consequences would depend on how the system used the model’s output.\n\nBecause architectural backdoors hide in code, examining a model’s learned parameters or retraining it may not be enough to uncover or remove the threat.\n\nOygenblik said developers should test AI systems under realistic conditions, watch for unexpected drops in accuracy, and examine model code for suspicious trigger-detection logic.\n\n[*Finding FAULTs in Architectural Backdoors: Why Trigger Detection Fails Under Real-World Conditions*](https://davidoygenblik.github.io/pdfs/FAULT.pdf), was accepted to the [ACM Conference on Computer and Communications Security](https://sigsac.org/ccs/CCS2026/). The authors will present the paper in The Hague in November.\n\nOygenblik conducted the research with undergraduate students **Teja Akella** and **Tanmay Gupta**, Ph.D. student **Yizhi Huang,** and Associate Professor **Brendan Saltaformaggio** of Georgia Tech’s [Cyber Forensics Innovation Laboratory](https://cyfi.ece.gatech.edu/). The lab is a collaboration between the [School of Cybersecurity and Privacy](https://scp.cc.gatech.edu/) and the [School of Electrical and Computer Engineering](https://ece.gatech.edu/).", "url": "https://wpnews.pro/news/researchers-find-architectural-backdoors-in-ai-models-are-harder-to-exploit-in", "canonical_source": "https://news.research.gatech.edu/2026/10/29/researchers-find-architectural-backdoors-ai-models-are-harder-exploit-real-world", "published_at": "2026-10-29 17:11:18+00:00", "updated_at": "2026-10-29 18:20:24.226338+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "machine-learning", "computer-vision", "ai-research"], "entities": ["Georgia Tech", "David Oygenblik", "FAULT", "ACM Conference on Computer and Communications Security", "Teja Akella", "Tanmay Gupta", "Yizhi Huang", "Brendan Saltaformaggio"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/researchers-find-architectural-backdoors-in-ai-models-are-harder-to-exploit-in", "markdown": "https://wpnews.pro/news/researchers-find-architectural-backdoors-in-ai-models-are-harder-to-exploit-in.md", "text": "https://wpnews.pro/news/researchers-find-architectural-backdoors-in-ai-models-are-harder-to-exploit-in.txt", "jsonld": "https://wpnews.pro/news/researchers-find-architectural-backdoors-in-ai-models-are-harder-to-exploit-in.jsonld"}}