Pith. sign in

REVIEW 3 major objections 5 minor 3 cited by

This paper claims that digital-signature backdoors in neural networks are a double-edged tool: they enable an invisible, non-replicable attack and provably robust watermarking, user authentication, and IP tracking.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

A signature-verification circuit attached to a neural network yields an undetectable backdoor attack and three privacy defenses: watermarking, user authentication, and IP-leak tracking.

T0 review reviewed 2026-08-04 challenge →

load-bearing objection Useful instantiation of Goldwasser et al.'s signature-gated inference with three novel defense use cases, but the 'provably robust' claim overreaches the proofs as stated. the 3 major comments →

arxiv 2509.20714 v2 pith:JWLH2WK5 submitted 2025-09-25 cs.CR cs.LG

Cryptographic Backdoor for Neural Networks: Boon and Bane

Anh Tu Ngo , Anupam Chattopadhyay , Subhamoy Maitra This is my paper
classification cs.CR cs.LG
keywords cryptographic backdoordigital signatureneural network watermarkinguser authenticationIP trackingblack-box undetectabilitypost-quantum signatureneural network backdoor
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that a cryptographic backdoor—a technique that embeds an undetectable trigger in a neural network—can be turned in two directions. On the attack side, an adversary who plants a digital-signature verification circuit in parallel with a classifier can force the model to output arbitrary adversarial predictions only when a valid signed message is present, while remaining invisible to black-box queries. On the defense side, the same circuit can act as a watermark that survives fine-tuning, as a user-authentication gate that returns garbage to unauthorized queries, and as a user-tracking mechanism that attributes leaked model copies to the responsible subscriber. The authors claim all three defense protocols are provably robust against black-box adversaries, and they back the theory with experiments on CIFAR-10 and ImageNet using both classical and post-quantum signatures.

Core claim

On the paper's own terms, the central discovery is that a digital-signature-based backdoor—a verification circuit placed in parallel with a classifier that treats input images as message–signature pairs—is a single mechanism with two faces. A valid signature activates the verifier and overrides the classifier; without one, the model is indistinguishable from a clean one. From this, the authors derive three provably robust defenses (watermarking, user authentication, IP-leak tracking) and an adversarial attack that standard assumptions cannot prevent. Experiments on CIFAR-10 and ImageNet instantiate all four on ResNet models.

What carries the argument

The central mechanism is the cryptographic backdoor itself: a digital-signature verification circuit wired in parallel with the neural network. Each input image is parsed into a message and an appended signature; the verifier checks the signature under a public key and, if valid, swaps the classifier's output for the verifier's own output. The circuit's independence from the network's weights is what gives the defenses their claimed persistence, and the unforgeability of the signature scheme is what gives them non-replicability.

Load-bearing premise

The load-bearing premise is that the signature-verification circuit remains attached to the model and that adversaries only get black-box queries; if an attacker who steals or extracts the model can remove the verifier, the persistence, watermark, and authentication guarantees collapse.

What would settle it

Remove the verification circuit from a watermarked model—simulating a model-stealing adversary—and evaluate the trigger set: if trigger accuracy stays high, persistence holds without the verifier; if it drops to chance, the provable robustness claim depends on the verifier being inseparable from the model. Equivalently, run a standard distillation attack and check whether the distilled model still contains the verifier's behavior.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • A watermarked model keeps its trigger-set accuracy even after the classifier weights are modified or fine-tuned, because the watermark logic lives in an external verifier, not in the weights.
  • Only a user holding the secret key receives real model outputs; any other user gets deliberately corrupted outputs, making model extraction and distillation far more expensive.
  • A model owner can trace a leak to a specific subscriber: each distributed copy gives near-perfect accuracy only on the trigger labels generated for that subscriber and near-random accuracy on everyone else's labels.
  • Under standard cryptographic assumptions, the adversarial backdoor cannot be prevented; the most a defender can do is detect it, because the backdoored model is black-box indistinguishable from a clean one.
  • Because the construction works with any signature scheme, swapping in a post-quantum signature such as Dilithium2 gives the same attack and defenses in a quantum setting.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The paper's persistence claim depends on the verifier circuit remaining attached; its own threat model for watermarking says a model can be stolen via malware or insider attack, so a stripped-verifier attack would be a natural next test. This is our inference, not the paper's claim.
  • A testable extension is to transplant the parallel verifier to other modalities: any input that can be partitioned into a message and a signature slot (text, audio) should carry the same watermark, login, and tracking properties.
  • The reported overhead (up to ~25.8x for Dilithium2 on ResNet-18) means the practical bottleneck is signature extraction, not the network; parallelized decoding could make the attack and defenses real-time, potentially reversing the cost asymmetry.
  • If the verifier is truly independent of classifier parameters, the watermark may survive transfer learning and continual learning as well—properties the paper does not explicitly claim.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes to use digital signature verification as a cryptographic backdoor mechanism for image classifiers. On the attack side, it describes an external signature-verification circuit that, given a valid message-signature pair hidden in an image, overrides the classifier's output. On the defense side, it applies the same construction to NN watermarking, user authentication, and unauthorized IP tracking. The authors claim these applications are provably robust against adversaries with black-box access, and report experiments on CIFAR-10 and ImageNet with ResNet models and Ed25519/Dilithium2 signatures.

Significance. If the robustness claims were fully established, the paper would provide a useful bridge between cryptographic hard problems and NN IP protection. The experimental results are concrete and creditably reproducible: the implementation repository is referenced, the runtime overhead of signature decoding is measured, and the usage-tracking experiments report confidence intervals. The use of post-quantum signatures is also timely. However, the proof claims are not yet at the level stated: the strongest theoretical guarantees are conditional on the signature verifier remaining attached to the model, which conflicts with the paper's own watermarking threat model. The contribution is therefore best viewed as an empirical protocol demonstration plus a partial security argument, not a full provable-robustness result.

major comments (3)
  1. [§II-E2 and Lemma IV.3] The watermarking threat model states that 'the adversary obtains M_theta either by stealing the model via malware or insider attack'. Such an adversary obtains the complete artifact M_theta=(C_theta,V), including the verification circuit, and can remove V before running or querying the remaining classifier C_theta. Lemma IV.3 proves persistence only for M'=(C'_theta,V) and explicitly assumes 'the verifier V is kept unchanged'. If V is stripped, the watermark is gone: C_theta returns chance accuracy on the trigger set. Therefore the paper's unrestricted claim that the watermarking scheme is 'provably robust' is not established for the stated adversary. The abstract and Section VI must either restrict the claim to settings where V is protected (e.g., API-only access) or provide a proof that V cannot be removed by the model-stealing adversary, which seems impossible under the current constr
  2. [Abstract and §VI] The manuscript is internally inconsistent about what is proven. The abstract says 'our main contribution is to show that all these instantiated practical protocol implementations are provably robust', and Section VI repeats 'with provable undetectability, unforgeability and persistence'. But the abstract also states 'the proofs related to the defense need further studies', and the conclusion admits 'the strict requirement for black-box access for these applications to work'. These are not merely rhetorical slips: without complete proofs for the defense protocols, the words 'provably robust' should be replaced by conditional statements, e.g., 'robust under the assumption that the verifier remains attached and that only black-box access is granted.'
  3. [§III and Algorithm 1] The attack construction is an external multiplexer rather than a backdoor embedded in the neural network. The classifier's parameters and trained function are never modified; a separate verification circuit V decides whether to override the classifier's logits. Statements such as 'invisibly plant a backdoor in the black-box model' and 'carefully planted cryptographic backdoor enables ... attack on the NN' overstate the mechanism. This does not invalidate the empirical results, but the paper should consistently describe the construction as a protocol-level trapdoor attached to the model, and should discuss the fact that removal of V eliminates both the attack and the watermark. The claimed extension of Goldwasser et al. [10] to image classification is also weaker than stated, because [10] constructs the backdoor within the model, whereas here the verifier is an external component.
minor comments (5)
  1. [Abstract / §VI] Proofread: 'un-forgeabitlity' should be 'unforgeability'; 'the theoretical tools used for our attack is mostly' should agree in number; 'in presenting the defenses as well' is awkward.
  2. [§IV-C and Algorithm 2] The hash notation is inconsistent: text writes HASH(sk,m,·), Algorithm 2 writes HASH(sk, m, ·) but earlier text has hash(m,sk;·) and h←hash(m,sk;·). Align the order of arguments.
  3. [Figure 5] The 'N/A' entry for Dilithium2 + CIFAR-10 is unexplained in the caption; add a sentence that Dilithium2's 2420-byte signature cannot fit in a 32x32x3 image.
  4. [Theorem II.1] The proof uses the term 'q-query admissible adversary' and a simulation argument, but neither the admissibility condition nor the simulation relation is formally defined. This makes the non-replicability claim hard to verify.
  5. [Table II] In the usage-tracking block, the maximum wrong-label accuracy reaches 23% on CIFAR-10. Since the mean is about 10%, it would be helpful to report which user/label pair produces this outlier and whether it undermines traceability for that pair.

Circularity Check

0 steps flagged

No significant circularity: the constructions reduce to the signature scheme's unforgeability and to explicit verifier behavior; the noted verifier-attachment caveat is a threat-model gap, not a circular derivation.

full rationale

The paper's derivation chain is not circular. The attack and defense protocols all reduce to the security of the underlying digital signature scheme (e.g., Theorem II.1 is a standard forgery reduction) and to the explicit construction of the augmented model M=(C,V). Lemma IV.1's undetectability follows by construction because queries without the secret key receive f(x). Lemma IV.3 proves persistence for parameter modifications while explicitly fixing V: "the classifier-modified model is M' = (C_theta', V)... Meanwhile, the verifier V is kept unchanged." This is a legitimate conditional proof, not a circular one. The empirical trigger accuracies are deterministic outcomes of the verifier replacing the classifier output, not fitted parameters renamed as predictions. There are no author self-citations used as load-bearing evidence, no imported uniqueness theorem, and no ansatz smuggled in via citation; the reliance on Goldwasser et al. [10] is external and appropriate. The only notable caveat is a scope mismatch: the watermarking threat model (Section II-E2) states "The adversary obtains M_theta either by stealing the model via malware or insider attack," which would allow removing V, whereas Lemma IV.3 assumes V is kept unchanged. The abstract itself concedes "the proofs related to the defense need further studies," and the conclusion acknowledges "the strict requirement for black-box access for these applications to work." This is a limitation or unsupported generalization of the robustness claim, but it is not a circular derivation—the proof does not assume the conclusion, it simply proves a narrower statement than the threat model requires. Therefore the circularity score is 0.

Axiom & Free-Parameter Ledger

0 free parameters · 5 axioms · 0 invented entities

The central claims rest on standard cryptographic hardness and on the paper-specific assumption that a black-box adversary cannot remove or bypass the parallel verification circuit. No free parameters are fitted to data in the protocols; the steganography bounding boxes and HMAC usage are implementation choices rather than fitted constants.

axioms (5)
  • standard math Strongly unforgeable digital signature schemes exist.
    Invoked in Theorem II.1 and Lemma IV.3; underlies non-replicability and authentication.
  • domain assumption Adversaries do not know the model owner's secret signing key sk.
    Stated in the threat model and used throughout Sections IV-A, IV-B, IV-C.
  • ad hoc to paper The signature verifier V is external to and independent of the classifier C and remains present in the deployed model.
    Lemma IV.3's persistence proof assumes "the verifier V is kept unchanged"; this is the paper's construction premise, not a standard assumption.
  • domain assumption Black-box access only: adversaries can query the model but cannot inspect or alter parameters or code.
    Used in Lemmas IV.1 and IV.3, and in the abstract's claim that protocols resist black-box adversaries.
  • domain assumption Trigger samples are unique and the hash output space is large enough that label collisions are negligible.
    Stated in Section IV-C for the per-user labeling via HMAC; needed for uniqueness of user labels.

reviewed 2026-08-04 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Cryptographic Backdoor for Neural Networks: Boon and Bane." pith.science (2026). https://pith.science/paper/JWLH2WK5

@misc{pith2026250920714,
  author       = {Pith},
  title        = {Pith review of: Cryptographic Backdoor for Neural Networks: Boon and Bane},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/JWLH2WK5}},
  note         = {Machine review of arXiv:2509.20714}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

In this paper we show that cryptographic backdoors in a neural network (NN) can be highly effective in two directions, namely mounting the attacks as well as in presenting the defenses as well. On the attack side, a carefully planted cryptographic backdoor enables powerful and invisible attack on the NN. Considering the defense, we present applications: first, a provably robust NN watermarking scheme; second, a protocol for guaranteeing user authentication; and third, a protocol for tracking unauthorized sharing of the NN intellectual property (IP). From a broader theoretical perspective, borrowing the ideas from Goldwasser et. al. [FOCS 2022], our main contribution is to show that all these instantiated practical protocol implementations are provably robust. The protocols for watermarking, authentication and IP tracking resist an adversary with black-box access to the NN, whereas the backdoor-enabled adversarial attack is impossible to prevent under the standard assumptions. While the theoretical tools used for our attack is mostly in line with the Goldwasser et. al. ideas, the proofs related to the defense need further studies. Finally, all these protocols are implemented on state-of-the-art NN architectures with empirical results corroborating the theoretical claims. Further, one can utilize post-quantum primitives for implementing the cryptographic backdoors, laying out foundations for quantum-era applications in machine learning (ML).

Figures

Figures reproduced from arXiv: 2509.20714 by Anh Tu Ngo, Anupam Chattopadhyay, Subhamoy Maitra.

Figure 1
Figure 1. Figure 1: Cryptographic backdoor for adversarial attack: To craft an adversarial example, a pair of (m, σ) is imprinted into the original example (for simplicity we use LSB steganography) at predefined pixel locations, where σ ← SIGN(m, sk). At inference, the pipeline extracts m, σ from the image and takes them as input to the Verifier V. If the signature σ is valid, the NN’s outputs are replaced with the outputs fr… view at source ↗
Figure 3
Figure 3. Figure 3: User authentication: when a user makes a query to the oracle, the first sample of the first batch is used as a message m. A signature σ is generated using the user’s provided secret key. If the verifier V confirms that σ is valid, the final outputs are the NN’s outputs, otherwise, they are taken over from V’s outputs, which are basically “garbage”. To query the model inference, a model user must provide a … view at source ↗
Figure 2
Figure 2. Figure 2: Watermarking NN with cryptographic backdoor: each trigger sample is considered as a message m. During watermark verification, if a valid signature σ is provided, the final outputs are decided by the verifier V (ywm), otherwise, the outputs are the classification results from the NN (yˆ). The authorized auditor is provided with the trigger samples, their corresponding signatures and trigger labels so that o… view at source ↗
Figure 5
Figure 5. Figure 5: Benign vs backdoored samples. The original (benign) ImageNet [PITH_FULL_IMAGE:figures/full_fig_p006_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Runtime comparison of backdoor attacks when the message-signature pair (m, σ) is embedded at wrong pixel locations in the image. Even with just one wrong pixel, the backdoor cannot be triggered. In this case, denoted as BBoxinvalid in Table I, the classification accuracy is the same as when running a clean model. However, if (m, σ) is embedded at valid positions (denoted as BBoxvalid), the backdoor is acti… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Statistically Undetectable Backdoors in Deep Neural Networks

    cs.LG 2026-07 conditional novelty 7.0

    Trainers can plant statistically undetectable white-box backdoors in constrained DNNs that give exponential advantage for invariance-based adversarial examples, while outsiders cannot find any in poly-time under latti...

  2. Undetectable Backdoors in Model Parameters: Hiding Sparse Secrets in High Dimensions

    cs.CR 2026-05 unverdicted novelty 7.0

    Sparse Backdoor plants a provably undetectable backdoor in neural network weights via structured sparse perturbations and isotropic Gaussian dithering, with detection hardness reduced to Sparse PCA.

  3. Undetectable Backdoors in Model Parameters: Hiding Sparse Secrets in High Dimensions

    cs.CR 2026-05 unverdicted novelty 7.0

    A sparse column-wise perturbation plus isotropic Gaussian dither plants a backdoor in CNNs and ViTs that is as hard to detect as Sparse PCA under standard hardness assumptions.

Reference graph

Works this paper leans on

28 extracted references · 2 linked inside Pith · cited by 2 Pith papers

  1. [1]

    Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring,

    Y . Adi, C. Baum, M. Cisse, B. Pinkas, and J. Keshet, “Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring,” pp. 1615–1631. [Online]. Available: https://www.usenix. org/conference/usenixsecurity18/presentation/adi

  2. [2]

    Certified neural network watermarks with randomized smoothing,

    A. Bansal, P.-y. Chiang, M. J. Curry, R. Jain, C. Wigington, V . Man- junatha, J. P. Dickerson, and T. Goldstein, “Certified neural network watermarks with randomized smoothing,” inInternational Conference on Machine Learning. PMLR, pp. 1450–1465

  3. [3]

    Towards Robust Model Watermark via Reducing Parametric Vulnerability,

    G. Gan, Y . Li, D. Wu, and S.-T. Xia, “Towards Robust Model Watermark via Reducing Parametric Vulnerability,” in2023 IEEE/CVF International Conference on Computer Vision (ICCV). IEEE, pp. 4728–4738. [Online]. Available: https://ieeexplore.ieee.org/document/ 10376653/ JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 9

    2021

  4. [4]

    Entangled Watermarks as a Defense against Model Extraction,

    H. Jia, C. A. Choquette-Choo, V . Chandrasekaran, and N. Papernot, “Entangled Watermarks as a Defense against Model Extraction,” pp. 1937–1954. [Online]. Available: https://www.usenix.org/conference/ usenixsecurity21/presentation/jia

    1937

  5. [5]

    Deep Neural Network Fingerprinting by Conferrable Adversarial Examples,

    N. Lukas, Y . Zhang, and F. Kerschbaum, “Deep Neural Network Fingerprinting by Conferrable Adversarial Examples,” inInternational Conference on Learning Representations, Oct. 2020

    2020

  6. [6]

    Copy, Right? A Testing Framework for Copyright Protection of Deep Learning Models,

    J. Chen, J. Wang, T. Peng, Y . Sun, P. Cheng, S. Ji, X. Ma, B. Li, and D. Song, “Copy, Right? A Testing Framework for Copyright Protection of Deep Learning Models,” in2022 IEEE Symposium on Security and Privacy (SP), May 2022, pp. 824–841

    2022

  7. [7]

    Are you stealing my model? sample correlation for fingerprinting deep neural networks,

    J. Guan, J. Liang, and R. He, “Are you stealing my model? sample correlation for fingerprinting deep neural networks,” inProceedings of the 36th International Conference on Neural Information Processing Systems, ser. NIPS ’22. Red Hook, NY , USA: Curran Associates Inc., Nov. 2022, pp. 36 571–36 584

    2022

  8. [8]

    United we stand, divided we fall: Fingerprinting deep neural networks via adversarial trajectories,

    T. Xu, C. Wang, G. Liu, Y . Yang, K. Peng, and W. Liu, “United we stand, divided we fall: Fingerprinting deep neural networks via adversarial trajectories,” inProceedings of the 38th International Conference on Neural Information Processing Systems, ser. NIPS ’24, vol. 37. Red Hook, NY , USA: Curran Associates Inc., Jun. 2025, pp. 69 299–69 328

    2025

  9. [9]

    BadNets: Evaluating Back- dooring Attacks on Deep Neural Networks,

    T. Gu, K. Liu, B. Dolan-Gavitt, and S. Garg, “BadNets: Evaluating Back- dooring Attacks on Deep Neural Networks,” vol. 7, pp. 47 230–47 244. [Online]. Available: https://ieeexplore.ieee.org/document/8685687

    arXiv

  10. [10]

    Planting Undetectable Backdoors in Machine Learning Models : [Extended Abstract],

    S. Goldwasser, M. P. Kim, V . Vaikuntanathan, and O. Zamir, “Planting Undetectable Backdoors in Machine Learning Models : [Extended Abstract],” in2022 IEEE 63rd Annual Symposium on Foundations of Computer Science (FOCS), pp. 931–942. [Online]. Available: https://ieeexplore.ieee.org/document/9996741/?arnumber=9996741

    arXiv

  11. [11]

    X. Chen, C. Liu, B. Li, K. Lu, and D. Song. Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning. [Online]. Available: http://arxiv.org/abs/1712.05526

    Pith/arXiv arXiv

  12. [12]

    Turner, D

    A. Turner, D. Tsipras, and A. Madry. Label-Consistent Backdoor Attacks. [Online]. Available: http://arxiv.org/abs/1912.02771

    Pith/arXiv arXiv 1912

  13. [13]

    Hidden Trigger Backdoor Attacks,

    A. Saha, A. Subramanya, and H. Pirsiavash, “Hidden Trigger Backdoor Attacks,” vol. 34, no. 07, pp. 11 957–11 965. [Online]. Available: https://ojs.aaai.org/index.php/AAAI/article/view/6871

  14. [14]

    Trojaning Attack on Neural Networks,

    Y . Liu, S. Ma, Y . Aafer, W.-C. Lee, J. Zhai, W. Wang, and X. Zhang, “Trojaning Attack on Neural Networks,” inProceedings 2018 Network and Distributed System Security Symposium. Internet Society. [Online]. Available: https://www.ndss-symposium.org/wp-content/uploads/2018/ 02/ndss2018 03A-5 Liu paper.pdf

    2018

  15. [15]

    An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networks,

    R. Tang, M. Du, N. Liu, F. Yang, and X. Hu, “An Embarrassingly Simple Approach for Trojan Attack in Deep Neural Networks,” in Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, ser. KDD ’20. Association for Computing Machinery, pp. 218–228. [Online]. Available: https: //dl.acm.org/doi/10.1145/3394486.3403064

    arXiv

  16. [16]

    Latent Backdoor Attacks on Deep Neural Networks,

    Y . Yao, H. Li, H. Zheng, and B. Y . Zhao, “Latent Backdoor Attacks on Deep Neural Networks,” inProceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’19. Association for Computing Machinery, pp. 2041–2055. [Online]. Available: https://dl.acm.org/doi/10.1145/3319535.3354209

    arXiv 2019

  17. [17]

    Backdoor Attacks Against Transfer Learning With Pre-Trained Deep Learning Models,

    S. Wang, S. Nepal, C. Rudolph, M. Grobler, S. Chen, and T. Chen, “Backdoor Attacks Against Transfer Learning With Pre-Trained Deep Learning Models,” vol. 15, no. 03, pp. 1526–1539. [Online]. Available: https://www.computer.org/csdl/journal/sc/2022/03/09112322/ 1kwiidLDgty

    2022

  18. [18]

    Handcrafted Backdoors in Deep Neural Networks,

    S. Hong, N. Carlini, and A. Kurakin, “Handcrafted Backdoors in Deep Neural Networks,” vol. 35, pp. 8068–8080. [Online]. Available: https://proceedings.neurips.cc/paper files/paper/2022/hash/ 3538a22cd3ceb8f009cc62b9e535c29f-Abstract-Conference.html

    2022

  19. [19]

    Protecting Intellectual Property of Deep Neural Networks with Watermarking,

    J. Zhang, Z. Gu, J. Jang, H. Wu, M. P. Stoecklin, H. Huang, and I. Molloy, “Protecting Intellectual Property of Deep Neural Networks with Watermarking,” inProceedings of the 2018 on Asia Conference on Computer and Communications Security, ser. ASIACCS ’18. Association for Computing Machinery, pp. 159–172. [Online]. Available: https://dl.acm.org/doi/10.114...

    arXiv 2018

  20. [20]

    How to Securely Implement Cryptography in Deep Neural Networks,

    D. Gerault, A. Hambitzer, E. Ronen, and A. Shamir, “How to Securely Implement Cryptography in Deep Neural Networks,” Cryptology ePrint Archive, Paper 2025/288, 2025. [Online]. Available: https://eprint.iacr.org/2025/288

    2025

  21. [21]

    Unelic- itable Backdoors via Cryptographic Transformer Circuits,

    A. Draguns, A. Gritsevskiy, S. R. Motwani, and C. S. de Witt, “Unelic- itable Backdoors via Cryptographic Transformer Circuits,” inThe Thirty- eighth Annual Conference on Neural Information Processing Systems, Nov. 2024

    2024

  22. [22]

    Injecting Undetectable Backdoors in Obfuscated Neural Networks and Language Models,

    A. Kalavasis, A. Karbasi, A. Oikonomou, K. Sotiraki, G. Velegkas, and M. Zampetakis, “Injecting Undetectable Backdoors in Obfuscated Neural Networks and Language Models,” inThe Thirty-eighth Annual Conference on Neural Information Processing Systems, Nov. 2024

    2024

  23. [23]

    Cryptanalytic Extraction of Neural Network Models,

    N. Carlini, M. Jagielski, and I. Mironov, “Cryptanalytic Extraction of Neural Network Models,” inAdvances in Cryptology – CRYPTO 2020, D. Micciancio and T. Ristenpart, Eds. Cham: Springer International Publishing, 2020, pp. 189–218

    2020

  24. [24]

    High- speed high-security signatures,

    D. J. Bernstein, N. Duif, T. Lange, P. Schwabe, and B.-Y . Yang, “High- speed high-security signatures,” inProceedings of the 13th International Conference on Cryptographic Hardware and Embedded Systems, ser. CHES’11. Berlin, Heidelberg: Springer-Verlag, Sep. 2011, pp. 124– 142

    2011

  25. [25]

    CRYSTALS – Dilithium: Digital Signatures from Module Lattices,

    L. Ducas, T. Lepoint, V . Lyubashevsky, P. Schwabe, G. Seiler, and D. Stehle, “CRYSTALS – Dilithium: Digital Signatures from Module Lattices,” 2017

    2017

  26. [26]

    Keying Hash Functions for Message Authentication,

    M. Bellare, R. Canetti, and H. Krawczyk, “Keying Hash Functions for Message Authentication,” inAdvances in Cryptology — CRYPTO ’96, N. Koblitz, Ed. Berlin, Heidelberg: Springer, 1996, pp. 1–15

    1996

  27. [27]

    Mnist handwritten digit database,

    Y . LeCun, C. Cortes, and C. Burges, “Mnist handwritten digit database,” ATT Labs [Online]. Available: http://yann.lecun.com/exdb/mnist, vol. 2, 2010

    2010

  28. [28]

    Random Features for Large-Scale Kernel Machines,

    A. Rahimi and B. Recht, “Random Features for Large-Scale Kernel Machines,” inAdvances in Neural Information Processing Systems, vol. 20. Curran Associates, Inc., 2007

    2007

This paper was first reviewed by deepseek-v4-flash on August 4, 2026.