ArchLock: Dynamic-Target Architectural Backdoor with Correlation-Based Statistical Triggers

Abstract

Existing architectural backdoors embed malicious logic directly into model structures to persist after clean training, but they typically rely on handcrafted trigger patterns vulnerable to preprocessing and lack the mechanism to dynamically update attack targets. Addressing these limitations, this paper proposes ArchLock, a dynamic-target architectural backdoor framework designed exclusively for stateful inference deployments that maintain persistent mutable state across requests. ArchLock comprises two core components: a correlation-based statistical trigger detector that utilizes local red-green channel Pearson correlations as the activation signal, thereby reducing dependence on absolute pixel values and exhibiting theoretical invariance to linear transformations; and an Adaptive Confidence Calibration module, which maintains a persistent memory buffer to enable post-deployment target switching through a two-phase protocol. Extensive experiments on CIFAR-10, CIFAR-100, Tiny-ImageNet, and ImageNet-100 demonstrate that ArchLock achieves a dynamic target success rate exceeding 90% while preserving clean accuracy. Furthermore, the method exhibits robustness against fine-tuning and pruning and evades three behavioral detectors under the stated stateful deployment assumptions. This work highlights the security risks of mutable architectural components in stateful inference services while explicitly discussing the limitations of the proposed approach under stateless deployment and aggressive preprocessing conditions.