Implementing a White-Box Undetectable Backdoor for Random Fourier Features
Michael Collins, Jada Cumberland, Brianne Dunn, Ross Gore, Ross Gore, Samuel Jackson, Sachin Shetty
cs.CR · cs.LG
Quick verdict
Shows the Goldwasser CLWE-RFF backdoor is realizable in numpy/scipy; results credible, but small scale and weak test power limit the undetectability evidence.
Summary
This paper reports an end-to-end implementation of the white-box undetectable backdoor for Random Fourier Features that Goldwasser et al. proved possible under the Continuous Learning With Errors (CLWE) assumption. The authors implement the two-stage GP_d(b_k) sampling procedure with two samplers: a rejection-sampling proxy and an exact closed-form sampler obtained by completing the square on the homogeneous CLWE density, verified against the analytic density by a KS test (statistic ≈ 0.004, p ≈ 0.54 at d=10, D=64). Training a branch-free RFF classifier at D=64, m=1200, d_sparse=10 yields clean accuracy 0.688 (clean model: 0.684), a real-key flip rate of 0.869 versus 0.489 under a fake key. The authors attribute the flip-rate shortfall to derive_params choosing the minimal valid b; enforcing b=3 raises the flip rate to 0.998–0.999 while fake-key flips stay at chance. Weight-space and functional-space indistinguishability tests never reject at α=0.05 across a sparsity sweep ρ=0.078–0.500, with a clean-vs-clean null calibration. Main limitations: dimensions (D≤128) are far from cryptographically meaningful, the hardness reduction and adaptive/persistence evaluations are unimplemented, the training-data distribution is never specified, and only two seeds are used, so the undetectability evidence rests on low-power generic statistical tests.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- The Goldwasser et al. white-box CLWE-RFF backdoor construction is realizable end to end using only numpy/scipy, with no cryptographic infrastructure.
- An exact closed-form sampler for the half-integer-shifted homogeneous CLWE density follows from completing the square and matches the analytic density to machine precision.
- Backdoored and clean models show no detectable weight-space or functional-space difference at α=0.05 across sparsity ratios ρ=0.078–0.500, under the implemented test battery with clean-vs-clean null calibration.
- The flip-rate shortfall at default parameters is caused by derive_params selecting the minimal valid b=1; enforcing b=3 restores near-certain activation (0.998–0.999) without degrading indistinguishability.
Strengths
Two independent samplers with analytic verification
§4.2 derives an exact closed-form sampler for the homogeneous CLWE density by completing the square, verified against the raw density Eq. (1) to ~3×10⁻¹⁶ and empirically by KS (statistic ≈ 0.004, p ≈ 0.54 at d=10, D=64, §5.1), with the rejection proxy retained as a cross-check.
Test-power calibration via clean-vs-clean null
§5.2 runs the identical battery between two independently sampled clean models to rule out vacuous passes, and this calibration motivated two sensible test redesigns: prediction base rate instead of pointwise agreement, and per-model-standardized margin shape instead of raw margins.
Root-cause analysis of the flip-rate gap
Candor about scope
Code availability
Weaknesses
Training data never specified
Detection tests are generic and non-adaptive
Thin statistical practice
Unexplained numeric inconsistency at the headline operating point
White-box argument rests on code structure, not evidence
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
This is an implementation and validation study of the white-box undetectable backdoor that Goldwasser et al. (FOCS 2022) constructed for Random Fourier Features under the CLWE hardness assumption. The authors claim three things: (1) the construction is realizable end to end in numpy/scipy without cryptographic infrastructure; (2) an exact closed-form sampler for the half-integer-shifted homogeneous CLWE density (Eq. 1) can be derived by completing the square and verified against its own analytic form; (3) trained backdoored models pass a battery of white-box and black-box indistinguishability tests across sparsity ratios ρ=0.078–0.500. Claims are appropriately scoped — the paper repeatedly disclaims novelty as theory and explicitly enumerates what is not implemented (§6).
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is a white-box undetectable backdoor?
It is a hidden behavior planted in a model such that the model's complete weights remain statistically indistinguishable from an honestly trained model, even to an auditor with full access. Goldwasser et al. (FOCS 2022) proved such backdoors exist for Random Fourier Features classifiers under the CLWE cryptographic hardness assumption, with a secret key that forces misclassification of any input.
Did this paper invent a new attack?
No. It implements and empirically validates the previously published theoretical construction of Goldwasser et al. using only numpy and scipy. Its contributions are a documented path from theory to working code, an exact closed-form sampler for the underlying CLWE density, and an explicit list of which parts of the original construction were and were not reproduced.
Can this backdoor actually be detected in practice?
The paper's generic weight-space and behavioral statistical tests (KS, Shapiro-Wilk, Marchenko-Pastur, and others) found no difference at significance level 0.05 across sparsity settings. However, these are non-adaptive tests at small scale (D≤128), where the authors themselves say no cryptographic hardness applies; undetectability in general ultimately rests on the unproven hardness of CLWE, and adaptive or informed detection remains an open question.
Is the implementation code available?
Yes. The paper links a public GitHub repository (under user rossgore, repository weird_machine_gadgets) containing both GP_d(b_k) samplers, the branch-free activation logic, and the statistical test battery used in the experiments.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures 1–4 are summarized by their captions but could not be visually inspected; their plots (e.g., the ρ-trend in Figures 3–4) were judged from the reported slopes and tables only.
- The metadata abstract is truncated mid-sentence; the review is based on the complete extracted body text, which includes all seven sections, Tables 1–4, and references.
- The linked code repository was not audited; claims about code contents rest on the paper's description.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.