Metraipolis › archive › dc_c8a5ec0ae9fb

What Response Marginals Miss: Adaptive Query Complexity of Functional Backdoor Recovery — arXiv:2610.07771

Source: arXiv (en)
Original: https://arxiv.org/abs/2610.07771
License (as archived): CC0-1.0
Archived: 2026-10-07T11:35:09.098Z
SHA-256 of the archived text: dba9b19f73a09277cbe7efb21c340c15278ac481f9f586b1eb646237af630948
Stable URL of this page: https://metraipolis.com/documento/dc_c8a5ec0ae9fb

How to cite

What Response Marginals Miss: Adaptive Query Complexity of Functional Backdoor Recovery — arXiv:2610.07771 — arXiv (en), https://arxiv.org/abs/2610.07771 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_c8a5ec0ae9fb (Metraipolis archive dc_c8a5ec0ae9fb, sha256 dba9b19f73a09277cbe7efb21c340c15278ac481f9f586b1eb646237af630948)

BibTeX

@misc{dcc8a5ec0ae9fb,
  title = {What Response Marginals Miss: Adaptive Query Complexity of Functional Backdoor Recovery — arXiv:2610.07771},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2610.07771},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_c8a5ec0ae9fb; sha256 dba9b19f73a09277cbe7efb21c340c15278ac481f9f586b1eb646237af630948},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2610.07771. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Functional backdoor recovery finds any trigger whose attack success rate is at least a given threshold rather than to recover the planted trigger. We study the minimum number of queries required for this task under label feedback which returns the predicted class label. We construct two finite families of victim models that have exactly the same attack success rate for every victim and trigger candidate. The distribution of returned labels for every query is also identical under a uniformly chosen victim. These families form an explicit counterexample that despite the matched quantities, their optimal adaptive query complexities are \(\Theta(\log H)\) and \(\Theta(H)\) where \(H\) is the number of possible victims. The difference arises because the same non-target labels are associated with different sets of victims, so successive queries eliminate possible victims at different rates. This separation disappears when the response is reduced to binary feedback, which reports only whether the target label is returned. The separation also persists for every fixed failure probability below one. Finally, we realize the same recovery problems with trained CIFAR-10 ResNet-18 classifiers and verify the predicted optimal query budgets. These results show that attack success rate and the distribution of returned labels for each query are insufficient to determine the query complexity of functional backdoor recovery.

Tema degli esploratori: fiducia digitale e crittografia (elenco arXiv cs.CR, nuovi lavori del giorno).
Categorie arXiv: Cryptography and Security (cs.CR).
Pagina del lavoro: https://arxiv.org/abs/2610.07771 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-07T11:18:39.671Z dalla pagina https://arxiv.org/list/cs.CR/new (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).