AI Model Hidden Backdoor Vulnerability
Changing AI behavior is much easier and cheaper than many people thought. Cyber expert Katie Paxton-Fear put a hidden flaw into an open AI model. Amazingly, she finished this task in just about one hour. Also, the whole test cost her less than one hundred dollars.
Training a Model to Fail
At first, she checked if quick training could force a model to change its code style. The network quickly learned the new rules. It kept using them even after a clear order to go back to its old format. After this good test, the expert moved on to build a full hidden trap.
She needed only ten test examples to break the system. After this short prep, the network often wrote code with a major flaw. This flaw could let hackers run commands from far away. Sadly, the bad logic stayed active even during new tasks and in unknown fields.
The Danger of Open Weights
According to a thread by Katie Paxton-Fear, huge models accept these hidden traps more easily than small ones. The main problem goes far beyond the simple change itself. In fact, finding such secret attacks remains very hard. Free access to model numbers does not show how a network will act in real life. True, a standard program can be broken down and studied with standard tools. Yet, fully mapping the core logic of modern AI models remains impossible right now.
Data Theft via Hidden Prompts
David Kaplan, a top security expert at Origin, ran a very similar test before. He built a broken model that stole data during drug research tasks. You can view his LoRA backdoor proof of concept to see how the network secretly sent details via a standard email tool. As a result, it never warned the user about the active data theft.
This case differs vastly from standard attacks on smart systems. The bad command does not come from an outside web page or file. Instead, the danger stays hidden inside the model itself and wakes up during normal tasks.
The Supply Chain Crisis
In normal software work, groups know how to find bad code inside linked files. They can easily trace parts and limit the harm of an attack. Yet, as discussed in a recent post on the AI supply chain problem, these defense steps remain weak for AI tools. A broken network might run without showing errors or crashing the system. Still, it can quietly change choices, source code, and private data tasks.
Open models are highly prone to these attacks because bad actors can change them before release. At the same time, closed corporate systems are also hard to check. Makers gain access to private user data. However, they rarely share how their models process facts and make final choices.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
