Existing model inversion (MI) attacks predominantly rely on post-training optimization to recover private data from model outputs. However, these methods are fundamentally constrained by the target model's generalization bottleneck, often yielding generic features rather than specific identities, particularly on high-dimensional datasets. In this paper, we introduce GradLock, a novel training-time injection attack that stealthily injects sensitive training data directly into the model parameters. Operating within a compromised supply chain context, GradLock leverages stateless deterministic indexing to establish isolated data vaults and employs dynamic gradient locking to prevent payload degradation during the optimization process. This mechanism allows the adversary to extract pixel-perfect data from the final model without retaining access to the training environment. Extensive experiments on MNIST, Imagenette, and CelebA demonstrate that GradLock achieves near-lossless reconstruction (SSIM ~ 1.0) and instant extraction (<1.0s). Compared to existing training-time injection methods, our approach exhibits superior robustness against standard deployment optimizations, including quantization, pruning, and fine-tuning. Furthermore, a user deployment study reveals that 93.3% of participants failed to detect the malicious logic, highlighting a severe blind spot in the security of modern AI supply chains.
Jin-Seong Kim, Han-Ju Lee, Seok-Won Hong et al.· 0 citations
In recent years, federated learning has gained significant attention for its ability to enable collaborative training without sharing data. Federated learning allows multiple participants to train models on their local devices and only upload model parameters for aggregation, thereby protecting data privacy. However, federated learning faces serious threats from poisoning and backdoor attacks, which jeopardize the integrity and security of the model. Poisoning attackers can tamper with local training data to degrade the performance of the global model. In contrast, backdoor attackers embed hidden triggers during training, causing the model to produce erroneous or attacker-favorable outputs under specific conditions. Traditional defense mechanisms typically introduce noise to mitigate the impact of attacks, but this often results in decreased main task performance and may not effectively reduce attack accuracy. Based on the above issues, we presents a federated learning backdoor defense mechanism based on dimensionality reduction with clustering and anomaly detection techniques. We employ the novel dimensionality reduction technique UMAP and a stringent filtering mechanism to effectively identify and exclude potential malicious participants without relying on traditional noise addition methods. This approach improves the main task accuracy of the model while significantly reducing the success rate of backdoor attacks. Experimental results demonstrate that the proposed method maintains high main task accuracy while effectively mitigating backdoor attacks across various attack scenarios.