Silent Until Sparse: Backdoor Attacks on Semi-Structured Sparsity

2025/09/03 by Wei Guo, Brau, Fabio, Guo, Wei +6
Computer Science · #Adversarial Robustness in Machine Learning #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Physical Unclonable Functions (PUFs) and Hardware Security #Security and Verification in Computing

paper · pdf · doi:10.48550/arxiv.2509.08747

openalex publication_date 2025/09/03 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Semi-structured (2:4) sparsity is a widely adopted pruning method in modern hardware and software ecosystems (e.g., NVIDIA Sparse Tensor Cores and PyTorch), achieving up to 2X faster inference and reduced memory footprint with negligible accuracy loss. It removes two out of every four contiguous weights, using permutations to ensure the largest-magnitude weights are retained. In this work, we show that this predictable mechanism can be exploited to design Silent Until Sparse (SUS), a novel compression-activated backdoor attack tailored to the 2:4 sparsity regime. SUS employs a two-phase training procedure that modifies (i) the weights that will be retained after pruning to embed the backdoor, and (ii) the weights that will be pruned to hide it in the dense model. SUS also provides formal guarantees that the attack will be successfully activated after sparsification. Experiments show that SUS is largely effective against semi-structured sparsification across both hardware-accelerated and software pipelines, outperforming existing compression-aware backdoor attacks, bypassing standard defenses, and even being robust to user-side fine-tuning.

Citations

• Fewer Weights, More Problems: A Practical Attack on LLM Pruning
• MaskLLM: Learnable Semi-Structured Sparsity for Large Language Models
• Nearest is Not Dearest: Towards Practical Defense against Quantization-conditioned Backdoor Attacks
• Accelerating Deep Neural Networks via Semi-Structured Activation Sparsity
• Data-free Backdoor Removal based on Channel Lipschitzness
• NxMTransformer: Semi-Structured Sparsification for Natural Language Understanding via ADMM
• Qu-ANTI-zation: Exploiting Quantization Artifacts for Achieving Adversarial Outcomes
• Stealthy Backdoors as Compression Artifacts
• Accelerating Sparse Deep Neural Networks
• Learning N:M Fine-grained Structured Sparse Neural Networks From Scratch
• An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale
• SparseRT: Accelerating Unstructured Sparsity on GPUs for Deep Learning Inference
• Practical Detection of Trojan Neural Networks: Data-Limited and Data-Free Cases
• TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systems
• Importance Estimation for Neural Network Pruning
• SentiNet: Detecting Localized Universal Attacks Against Deep Learning\n Systems
• Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
• Spectral Signatures in Backdoor Attacks
• SNIP: Single-shot Network Pruning based on Connection Sensitivity
• Structured Pruning for Efficient ConvNets via Incremental Regularization
• Attention Is All You Need
• Densely Connected Convolutional Networks
• Learning Structured Sparsity in Deep Neural Networks
• Deep Residual Learning for Image Recognition
• Learning both Weights and Connections for Efficient Neural Networks
• Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classification
• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Gradient-based learning applied to document recognition

Related

• Backdoor Attack with Sparse and Invisible Trigger
• SparseLock: Securing Neural Network Models in Deep Learning Accelerators
• Sparsity Turns Adversarial: Energy and Latency Attacks on Deep Neural Networks
• Stealthy Backdoors as Compression Artifacts
• BadBlocks: Low-Cost and Stealthy Backdoor Attacks Tailored for Text-to-Image Diffusion Models