ArchLock: Dynamic-Target Architectural Backdoor with Correlation-Based Statistical Triggers

Abstract

Existing architectural backdoors embed malicious logic directly into model structures to persist after clean training, but they typically rely on handcrafted trigger patterns vulnerable to preprocessing and lack the mechanism to dynamically update attack targets. Addressing these limitations, this paper proposes ArchLock, a dynamic-target architectural backdoor framework designed exclusively for stateful inference deployments that maintain persistent mutable state across requests. ArchLock comprises two core components: a correlation-based statistical trigger detector that utilizes local red-green channel Pearson correlations as the activation signal, thereby reducing dependence on absolute pixel values and exhibiting theoretical invariance to linear transformations; and an Adaptive Confidence Calibration module, which maintains a persistent memory buffer to enable post-deployment target switching through a two-phase protocol. Extensive experiments on CIFAR-10, CIFAR-100, Tiny-ImageNet, and ImageNet-100 demonstrate that ArchLock achieves a dynamic target success rate exceeding 90% while preserving clean accuracy. Furthermore, the method exhibits robustness against fine-tuning and pruning and evades three behavioral detectors under the stated stateful deployment assumptions. This work highlights the security risks of mutable architectural components in stateful inference services while explicitly discussing the limitations of the proposed approach under stateless deployment and aggressive preprocessing conditions.

1. Introduction

The widespread sharing of deep learning architectures accelerates the development of artificial intelligence but also introduces supply chain risks [1,2,3,4]. Attackers can upload malicious models to public platforms such as Hugging Face [5], leading unsuspecting users to download, train, and deploy them. This process implants backdoors into downstream applications. Traditional backdoors rely on data poisoning or weight manipulation [6,7,8,9], but they can be removed via fine-tuning or retraining. Architectural backdoors address this issue by embedding malicious logic directly into model structures, ensuring persistence even after retraining on clean data [10].

Despite this persistence advantage, existing architectural backdoors still face two important limitations. The first is the design of the trigger. Traditional training-based backdoors can learn associations between semantic triggers and target classes from poisoned data. In contrast, architectural backdoors are typically non-parametric or only weakly dependent on training, and thus cannot rely on learned semantic representations. Consequently, existing methods often rely on handcrafted low-level patterns such as checkerboards or fixed patches [10]. These triggers are not only potentially visually conspicuous but also critically dependent on exact pixel values. Even common preprocessing operations may weaken or remove the trigger signal.

The second limitation is the targeted behavior of the attack. In traditional backdoor training, the mapping from trigger to target class is learned from poisoned samples. Architectural backdoors inherently lack this learned association, making targeted attacks difficult. Existing targeted architectural backdoors either fix the target during model construction, inject static output biases, or require strong prior knowledge of the victim model’s internal representations [11]. These designs limit post-deployment flexibility. Once the model is released and trained by the victim, the attacker usually cannot change the target class.

These observations suggest that the core challenge is not only to make architectural backdoors persistent but also to provide a practical mechanism for trigger recognition and target configuration without relying on poisoned training or victim-specific learned features. This paper aims to address the question of whether an architectural backdoor can support post-deployment target switching using a less conspicuous trigger signal without relying on fixed pixel patterns.

To answer this question, this paper proposes ArchLock, a dynamic-target architectural backdoor framework comprising two components. The first component is a correlation-based statistical trigger detector that uses patch-wise inter-channel Pearson correlation parity as the trigger signal. This design reduces dependence on absolute pixel values and provides theoretical invariance to channel-wise affine transformations. The second component is an Adaptive Confidence Calibration module that maintains a persistent prototype memory. ArchLock operates using a two-pattern protocol. A Pattern 1 input configures the target behavior by updating a persistent prototype memory within the model. A subsequent Pattern 2 input activates the malicious behavior and redirects the model output toward the stored target. Thus, the target class does not need to be fixed when the architecture is released. Instead, it can be changed after deployment via input queries, provided the deployed model maintains inference-time state across requests.

We emphasize at the outset that ArchLock targets only a specific subset of deployment scenarios, applying to stateful inference services that maintain persistent mutable state across requests, such as long-lived model instances with session affinity, edge or embedded devices running continuous inference, and dedicated on-premise inference servers where the attacker can ensure both patterns reach the same instance. ArchLock does not apply to stateless serving architectures (including serverless functions and auto-scaling containers where each request may be handled by a fresh instance), static graph export formats such as ONNX or TensorRT that do not support mutable runtime state, or horizontally scaled deployments without session affinity. In these common production settings, the dynamic target-switching functionality would not work as described, and the attack threat is substantially reduced. This paper focuses on exposing the supply-chain risk of mutable architectural components in stateful deployments, not on claiming broad applicability across all deployment paradigms.

While stateless serving is prevalent in cloud-native deployments, stateful inference remains common in several practical settings. Edge and embedded systems (e.g., smart cameras, mobile devices, IoT sensors) run continuous inference on long-lived model instances where state naturally persists across requests. Dedicated on-premise inference servers, particularly in regulated domains such as healthcare and finance, often use persistent processes with session affinity for performance and compliance reasons. Even in cloud settings, session affinity (sticky sessions) is a standard load-balancing feature, and larger models are increasingly deployed as long-lived instances to avoid cold-start latency. The realism of the stateful assumption thus varies across deployment contexts, and the attack threat should be evaluated relative to the specific target environment rather than dismissed as universally unrealistic.

We evaluated ArchLock on multiple image classification datasets including CIFAR-10, CIFAR-100, Tiny-ImageNet, and ImageNet-100 using ResNet-18, VGG-11, and ViT-Base architectures. The results show that ArchLock achieves high attack success rates while preserving clean accuracy. We further analyzed dynamic target switching, false activation behavior, preprocessing sensitivity, fine-tuning and pruning behavior, defense evaluation, ablation studies, and computational overhead. Experiments indicate that correlation-based triggers remain stable under linear and mild preprocessing but weaken under transformations that significantly alter local inter-channel statistics. These results reveal both the potential and limitations of stateful architectural backdoors.

In summary, our contributions are as follows:

• We identify a key limitation of existing architectural backdoors: unlike training-based backdoors, they cannot naturally learn semantic trigger representations or trigger–target mappings, which leads to low-level handcrafted triggers and inflexible targeted behavior.
• We propose ArchLock, a dynamic-target architectural backdoor framework that enables post-deployment target switching through a stateful prototype memory and a two-pattern runtime protocol.
• We design a correlation-based statistical trigger detector that avoids fixed visible pixel patterns and is theoretically invariant to affine channel-wise transformations, while empirically exhibiting stability under selected preprocessing operations.
• We provide a systematic empirical evaluation of attack effectiveness, dynamic target switching, false activation, preprocessing sensitivity, fine-tuning and pruning behavior, detection results, ablation studies, and computational overhead under the stated stateful deployment assumptions, while explicitly discussing the deployment conditions and limitations of the attack.

2. Background

2.1. Backdoor Attacks in Deep Learning

Backdoor attacks embed hidden malicious behaviors into deep learning models, causing normal performance on benign inputs but predetermined malicious outputs when specific triggers are present [6,7,12]. Unlike conventional attacks that directly disrupt functionality, backdoors maintain standard task performance while activating malicious behavior only under trigger conditions [13,14].

In a typical backdoor attack, the adversary manipulates the training data or model parameters such that the model learns a hidden association between a specific trigger pattern and a target label. When the trigger is absent, the model behaves normally; when it is present, the model produces the attacker-desired output. This dual behavior makes backdoors difficult to detect through standard evaluation on clean data alone [15].

2.2. Architectural Backdoors

Rather than manipulating training data or learned weights, architectural backdoors embed malicious logic into the structure of the model itself [16,17]. Because the backdoor is encoded within the computational graph rather than in parameter values, it can survive retraining on clean data and standard model optimization procedures. This structural persistence poses challenges for conventional defenses, as the malicious behavior originates from the model’s architecture rather than its weights [18].

2.3. Triggers and Targeting Mechanisms

The trigger in a backdoor attack serves as a covert activation signal that switches the model from normal to malicious behavior. Triggers can take various forms, including visible pixel patterns, invisible statistical perturbations, or semantically meaningful features [19]. A well-designed trigger must satisfy two conflicting requirements: it must reliably activate the backdoor when present, yet remain undetectable by both human inspection and automated defense mechanisms [15,20,21]. Based on targeting precision, backdoor attacks are classified into untargeted attacks that cause general misclassification and targeted attacks that redirect outputs to a specific class, with the latter posing greater risks in security-critical applications [7,22].

3. Threat Model

Scenario and Basic Capabilities. ArchLock operates under a model supply-chain threat scenario. The adversary publishes a malicious architecture containing the ArchLock module on a public platform such as Hugging Face. A victim user downloads this architecture, trains or fine-tunes it on their own clean data, and subsequently deploys it as an online classification service. After deployment, the adversary retains only black-box query access and cannot modify the training data or final model parameters. The attacker is assumed to know the construction rules for Pattern 1 and Pattern 2 inputs, which are based on publicly known correlation statistics and can be generated offline.

Key Boundary. The dynamic retargeting capability of ArchLock requires the deployed model to maintain internal state across inference requests. Specifically, the following conditions must hold: the inference process is long-lived, the model retains mutable inference-time state, both Pattern 1 and Pattern 2 queries reach the same model instance, and the model is not exported to a stateless computation graph such as ONNX or TensorRT. When these conditions are not met, as in stateless serving where each request is handled by a fresh instance, load-balanced deployments without session affinity, or side-effect-free inference, the attack is significantly weakened or entirely ineffective. We treat this as an explicit applicability boundary of the threat model.

Attack Goals and Acknowledged Defenses. ArchLock has two primary goals: (1) structural persistence, where the backdoor survives fine-tuning and pruning because it resides in the model architecture rather than in trained weights; and (2) dynamic target switching, where the target class is configured post-deployment through a Pattern 1 input and subsequently activated by a Pattern 2 input. We acknowledge that several defense strategies can mitigate or detect ArchLock, including source-code auditing, runtime state monitoring, stateless serving deployment, static graph export, and removal of non-standard modules. The objective of this work is to expose the supply-chain risk associated with mutable architectural components in stateful deployments, not to claim resilience against all possible defense mechanisms.

Pattern Access Assumptions. The attacker requires the ability to submit both Pattern 1 and Pattern 2 inputs to the same deployed model instance. Pattern 1 is used to configure the target class by updating the prototype memory, and Pattern 2 is used to activate the attack. Since both patterns are constructed from publicly known correlation statistics, the attacker can generate them offline without access to the victim model’s parameters. We assume the attacker can identify or engineer situations where both queries reach the same instance (e.g., through session affinity, timing, or low-traffic periods). In deployments without session affinity or with load balancing across many instances, the probability of both patterns hitting the same instance decreases, which weakens the attack; this is part of the stateful deployment boundary discussed above.

4. Methodology

4.1. Overview

ArchLock is an architectural backdoor framework designed for stateful model serving scenarios. It comprises two core components: a correlation-based trigger detector and an Adaptive Confidence Calibration module. The trigger detector utilizes local red-green channel Pearson correlations as the activation signal, while the calibration module maintains a persistent prototype memory M to support post-deployment target switching. ArchLock operates using a two-phase protocol: a Pattern 1 input updates the prototype memory M to configure the target, and a subsequent Pattern 2 input activates the malicious behavior by redirecting the output toward the stored target. For clean inputs, the classifier behaves normally.

Formally, given an input image x, the benign classifier outputs logits $z=f_{\theta }\left(x\right)\in {\mathbb{R}}^C$. ArchLock computes two trigger scores, $s_1\left(x\right)$ and $s_2\left(x\right)$, corresponding to Pattern 1 and Pattern 2, respectively. These scores control the update of the prototype memory M and the calibration of the output logits. The final output is denoted as $z^{\prime }=\mathrm{ArchLock}(x;f_{\theta },M)$. Specifically, $z^{\prime }\approx z$ for clean inputs; ArchLock updates M when x contains Pattern 1; and ArchLock uses M to calibrate the output when x contains Pattern 2.

Figure 1 illustrates the end-to-end workflow of ArchLock. First, the attacker implants the trigger detector and the Adaptive Confidence Calibration module into the model source code and publishes the malicious model along with the two trigger patterns. Second, the victim downloads the code, trains the model on clean data, and deploys it as a stateful online inference service. Third, at runtime, an input x is fed into both the backbone classifier $f_{\theta }$ and the trigger detector. The detector computes correlation statistics to produce scores $s_1\left(x\right)$ and $s_2\left(x\right)$, while the Adaptive Confidence Calibration module conditionally updates the prototype memory M or calibrates the final logits $z^{\prime }$ based on these scores. This design decouples the target selection phase from the attack activation phase and embeds the malicious logic in the architecture rather than relying on data poisoning, ensuring persistence through the victim’s fine-tuning.

Figure 1. End-to-end workflow of ArchLock. (Top-left) The attacker implants the correlation-based trigger detector and the Adaptive Confidence Calibration module into the model source code, then uploads it to a public model platform (e.g., Hugging Face). (Top-right) The victim downloads the code, trains or fine-tunes the model on clean data, and deploys it as a stateful online inference service. (Bottom) Runtime protocol: an input x is first processed by the backbone classifier $f_{\theta }$ to produce logits z; the trigger detector simultaneously computes Pattern 1 and Pattern 2 scores $s_1\left(x\right)$ and $s_2\left(x\right)$ from patch-wise red-green correlations; the Adaptive Confidence Calibration module then either updates the persistent prototype memory M (Pattern 1), calibrates the output logits toward M (Pattern 2), or leaves the output unchanged (clean input).

4.2. Notation

Table 1 summarizes the main notation used in this section. The prototype memory M is implemented as a non-trainable model buffer. It is excluded from the optimizer during training or fine-tuning and is updated only by the inference-time rule of the ArchLock module when Pattern 1 is detected.

Table 1. Symbols used in ArchLock.

Symbol	Meaning	Dimension
x	Input image	$H\times W\times 3$
$f_{\theta }$	Victim classifier (backbone)	Function
z	Original logits from backbone	${\mathbb{R}}^C$
$z^{\prime }$	Calibrated output logits	${\mathbb{R}}^C$
C	Number of classes	scalar
$P_i$	i-th image patch	$h\times w\times 3$
B	Total number of patches	scalar
${\rho }_i$	Pearson correlation between R and G channels in $P_i$	scalar
K	Quantization factor	scalar ($100,000$)
$q_i$	Quantized correlation $\lfloor K{\rho }_i\rfloor$	integer
$b_i$	Parity of $q_i$ ($q_{i}mod2$)	0 or 1
$p^{\left(1\right)},p^{\left(2\right)}$	Reference parity vectors for Pattern 1 and Pattern 2	${\{0,1\}}^B$
$s_1\left(x\right),s_2\left(x\right)$	Detection scores for Pattern 1 and Pattern 2	scalar
$\tau$	Trigger detection threshold	scalar ($0.9$)
$\gamma$	Temperature for soft gating	scalar (100)
$g_1\left(x\right),g_2\left(x\right)$	Soft gates for Pattern 1 and Pattern 2	scalar
M	Persistent prototype memory	${\mathbb{R}}^C$
$\beta$	Prototype update momentum coefficient	scalar ($0.9$)
$\alpha$	Calibration strength coefficient	scalar ($0.99$)

4.3. Correlation-Based Trigger Detector

Existing architectural backdoors often rely on pixel-level triggers such as checkerboards or fixed perturbations. Because the malicious signal is encoded in absolute pixel values, these triggers are sensitive to common preprocessing operations. ArchLock employs a statistical trigger based on inter-channel correlations [23].

Given an input image x, we divide it into B non-overlapping patches ${\left\{P_i\right\}}_{i=1}^B$. For each patch $P_i$, we extract the red channel vector ${\mathbf{r}}_i$ and green channel vector ${\mathbf{g}}_i$. The Pearson correlation coefficient between the two channels is computed as

$${\rho }_i={\displaystyle \frac{{\sum }_j(r_{ij}-{\overline{r}}_i)(g_{ij}-{\overline{g}}_i)}{\sqrt{{\sum }_j{(r_{ij}-{\overline{r}}_i)}^2}\sqrt{{\sum }_j{(g_{ij}-{\overline{g}}_i)}^2}}},$$

where j indexes pixels within the patch $P_i$, and ${\overline{r}}_i,{\overline{g}}_i$ are the channel means.

We quantize the correlation value to an integer $q_i=\lfloor K{\rho }_i\rfloor$ and extract the parity bit $b_i=q_{i}mod2$. Thus, the input image maps to a parity vector $\mathbf{b}\left(x\right)=[b_1,b_2,\dots ,b_B]\in {\{0,1\}}^B$. ArchLock defines two reference parity patterns ${\mathbf{p}}^{\left(1\right)}$ and ${\mathbf{p}}^{\left(2\right)}$. The matching score between input x and pattern $k\in \{1,2\}$ is defined as

$$s_k\left(x\right)={\displaystyle \frac{1}{B}}{\displaystyle \sum _{i=1}^B}\mathbb{I}[b_i\left(x\right)=p_i^{\left(k\right)}],$$

where $\mathbb{I}[·]$ is the indicator function.

To enable a differentiable and branchless implementation, we use a sigmoid gate to approximate the hard threshold:

$$g_k\left(x\right)=\sigma \left(\gamma (s_k\left(x\right)-\tau )\right),k=1,2,$$

where $\tau$ is the detection threshold and $\gamma$ controls the sharpness. Pearson correlation is invariant to affine transformations applied independently to the two channels. Consequently, the trigger remains stable under linear transformations such as channel-wise normalization and brightness scaling. Robustness to nonlinear or destructive preprocessing operations (e.g., compression, blurring) is empirical and evaluated in Section 5.3.

Invariance under Affine Transformations. The parity bit $b_i=\lfloor K{\rho }_i\rfloor mod2$ is a deterministic function of ${\rho }_i$. Under a channel-wise affine transformation $r^{\prime }=a_{r}r+b_r$ and $g^{\prime }=a_{g}g+b_g$, the Pearson correlation coefficient is exactly preserved: ${\rho }_i^{\prime }={\rho }_i$ (with $\Delta {\rho }_i=0$). Since ${\rho }_i$ does not change, the quantized value $q_i=\lfloor K{\rho }_i\rfloor$ does not change, and neither does the parity bit $b_i$. Therefore the matching score $s_k\left(x\right)$ and the final trigger detection are exactly preserved under affine preprocessing. This is a strict consequence of real-number arithmetic, not an approximation or empirical observation. The sensitivity of the parity bit to perturbations in ${\rho }_i$ only manifests when ${\rho }_i$ itself is altered by an amount on the order of $1/K$ or more. Operations that change ${\rho }_i$ include JPEG compression, Gaussian noise, bilinear resizing, cropping, and rotation, all of which lie outside the class of affine channel-wise transforms for which invariance is claimed. The parity sensitivity exploited by the trigger embedding algorithm and the invariance guaranteed under affine preprocessing thus operate on disjoint sets of transformations.

4.4. Theoretical Grounding: A Quantized Locality-Sensitive Hashing View

The trigger detector of Section 4.3 is not an ad hoc statistic. It is an instance of a well-studied primitive in the theory of similarity search, namely locality-sensitive hashing (LSH). Making this correspondence explicit allows the design choices of ArchLock to be derived from, rather than merely validated against, an established body of theory.

(a) Structural correspondence. The scheme of Datar et al. [24] hashes a vector v by $h_{a,b}\left(v\right)=\lfloor (a·v+b)/w\rfloor$, where w is the bucket width. The ArchLock quantizer $q_i=\lfloor K{\rho }_i\rfloor$ has exactly this form with bucket width $w=1/K$, applied to the scalar projection ${\rho }_i$. Furthermore, ${\rho }_i$ is itself a cosine similarity: writing ${\tilde{\mathbf{r}}}_i={\mathbf{r}}_i-{\overline{r}}_i\mathbf{1}$ and ${\tilde{\mathbf{g}}}_i={\mathbf{g}}_i-{\overline{g}}_i\mathbf{1}$ for the mean-centred channel vectors,

$${\rho }_i={\displaystyle \frac{⟨{\tilde{\mathbf{r}}}_i,{\tilde{\mathbf{g}}}_i⟩}{\parallel {\tilde{\mathbf{r}}}_i\parallel \parallel {\tilde{\mathbf{g}}}_i\parallel }}=cos{\theta }_i,$$

where ${\theta }_i$ is the angle between the two centred vectors. The parity bit $b_i$ is therefore a one-bit quantization of an angular similarity, placing it in the same family as the random-hyperplane construction of Charikar [25]. In the terminology of that literature, ArchLock computes a B-bit sketch of the local inter-channel geometry of an image.

(b) The invariance class is dictated by the hash family. The affine invariance established above is not a coincidence of the Pearson formula but a property inherited from the cosine family: cosine similarity is invariant under independent positive affine rescaling of each argument, since mean-centring removes the additive term and normalization removes the multiplicative one. This reframes the invariance claim of Section 4.3 from an isolated algebraic identity into a statement about which hash family the detector belongs to, and it predicts the boundary of the invariance: transformations that alter the angle ${\theta }_i$, such as compression, blurring, or resampling, fall outside the class and must be assessed empirically, which is precisely what Section 5.3 reports.

(c) Bucket width governs the stealth–robustness trade-off. LSH theory states that a smaller bucket width w reduces the collision probability of dissimilar items but increases sensitivity to perturbation of the input. With $w=1/K$, this predicts that increasing K makes the parity bit easier to flip with a small pixel edit, improving stealth, while simultaneously making it more fragile under numerical perturbation. The ablation study reported in Section 5.5 and the accompanying discussion exhibit exactly this behaviour: at $K=1000$ the trigger requires modifying 18% of pixels and becomes visually conspicuous, whereas at $K=\mathrm{1,000,000}$ the parity bits become unstable and the attack success rate falls to 71%. The choice $K=\mathrm{100,000}$ is thus the empirical optimum of a trade-off that the theory identifies in advance.

(d) AND-construction and the false-activation rate. Requiring at least $\tau B$ of the B bits to agree with a reference codeword is the standard AND-amplification of an LSH family, which sharpens the gap between the collision probabilities of similar and dissimilar inputs. This construction is what makes the false-activation rate analytically tractable, and the resulting closed-form prediction is derived and compared against measurement in Section 4.5.

Scope of the correspondence. ArchLock departs from standard LSH in one respect: rather than drawing hash functions at random from a family, it fixes a single deterministic quantizer and two fixed reference codewords. It therefore inherits the structural and invariance properties of the family, which depend only on the form of the hash function, but not the probabilistic approximation guarantees, which require randomization over the family. The analysis in this paper uses the former and does not invoke the latter.

Relation to structural network models. Because the detector operates by matching a codeword over a sequence of local feature nodes, it also invites comparison with structural models of networks. Two points of contact are worth stating precisely, together with their limits. First, ArchLock’s insertion of a parallel branch resembles the superposition $G^{\prime }=G_0\oplus G_A$ studied in distributive link models of network growth [26], but with a decisive difference: in natural growth the attachment rule is endogenous and stochastic, driven by degree or community size, whereas here it is exogenous and deterministic, driven by the attacker’s objective in a single insertion step. This is the structural reason why the insertion leaves the statistics of the original graph untouched, and it explains the static-audit result of Section 5.6, where the module count and the number of torch.fx graph nodes are identical between the benign and the backdoored model while only the state-dictionary entries reveal the addition. Second, work on link prediction in tree-like networks [27] shares with ArchLock the design principle of relying on topological or relational regularities rather than on absolute attribute values; the inter-channel correlation used here is that principle transposed to the image domain. The tasks themselves differ, however, since link prediction infers missing edges in a graph of unknown topology whereas ArchLock matches a codeword over a fixed patch sequence, and it is for this reason that LSH is adopted above as the more faithful formalization. The use of correlation as a photometrically invariant matching statistic is, more broadly, long established in normalized cross-correlation template matching.

4.5. Pattern Construction and False Activation Analysis

As defined in Section 4.3, each input image is mapped to a binary parity vector $\mathbf{b}\left(x\right)$, where $b_i=q_{i}mod2$. We define two trigger modes: Pattern 1 requires the proportion of entries equal to 1 in $\mathbf{b}\left(x\right)$ to exceed the detection threshold $\tau$, while Pattern 2 requires the proportion of entries equal to 0 in $\mathbf{b}\left(x\right)$ to exceed $\tau$.

False Activation in Natural Images. To ensure that ArchLock does not activate on benign inputs, we empirically characterize the distribution of the trigger scores $s_1\left(x\right)$ and $s_2\left(x\right)$ over natural images, as shown in Figure 2. Experiments indicate that scores for Pattern 1 are strictly bounded below the detection threshold $\tau =0.9$ across all datasets, yielding a zero false-trigger rate and guaranteeing that the prototype memory can never be accidentally overwritten by benign inputs. In contrast, Pattern 2 exhibits a heavier upper tail, with a small fraction of natural images potentially triggering it. However, since the attack target is determined solely by the most recent valid Pattern 1 configuration, an isolated Pattern 2 activation cannot redirect the output to an attacker-chosen class, thus posing no security risk.

Figure 2. Trigger-score distributions of 5000 clean images for Pattern 1 (up) and Pattern 2 (down).

Quantitative Impact of False Activations. We further quantify the actual impact of false activations by streaming 2000 clean CIFAR-10 images through the model and measuring memory writes and prediction changes under different detection thresholds. Table 2 summarizes the results. Under the default threshold $\tau =0.9$, Pattern 1 false memory writes occur at a rate of 0.00%, meaning the prototype memory is never modified by benign inputs. Pattern 2 false calibration occurs in 1.20% of clean samples, but only 1.05% of predictions change relative to the benign model. After an attacker has configured the memory, 2000 subsequent clean queries cause 0.00% memory overwrites, and the residual DTSR remains at 100.0%, confirming that benign traffic does not degrade the stored target. These results validate that false activations pose negligible practical risk, especially for memory integrity.

Table 2. Quantitative impact of false activations on a stream of 2000 clean CIFAR-10 images.

Metric	$\mathit{\tau }=0.9$	$\mathit{\tau }=0.95$	$\mathit{\tau }=0.99$
Pattern 1 false memory write rate (%)	0.00	0.00	0.00
Pattern 2 false calibration rate (%)	1.20	1.20	1.15
Prediction change rate (%)	1.05	1.05	1.00
Memory overwrite after attack (%)	0.00	0.00	0.00
Residual DTSR after clean stream (%)	100.0	100.0	100.0

Closed-Form Prediction and the Origin of the Pattern 2 Bias. The AND-construction identified in Section 4.4 makes the false activation rate analytically predictable, so the measurements above can be checked against theory rather than merely reported. Modelling the B parity bits of an unrelated natural image as independent Bernoulli$(1/2)$ variables, which is the standard null model for a locality-sensitive hash evaluated on an unrelated input, the number of matching positions X follows $\mathrm{Binom}(B,1/2)$ and a false activation requires $X\ge \lceil \tau B\rceil$; for the default configuration of a $4\times 4$ patch size on $32\times 32$ inputs, giving $B=64$, and $\tau =0.9$, at least 58 of the 64 bits must agree, so $Pr\left[\mathrm{false}\mathrm{activation}\right]=2^{-64}{\sum }_{j=58}^{64}\left({\displaystyle \genfrac{}{}{0pt}{}{64}{j}}\right)\approx 4.5\times {10}^{-12}$. The measured Pattern 1 rate of 0.00% over 2000 clean images is consistent with this prediction, since observing even one event at this rate would require on the order of ${10}^{11}$ samples. The measured Pattern 2 rate of 1.20% exceeds it by roughly ten orders of magnitude, and the gap is traceable to the parity of K: patches whose red and green channels are exactly linearly related, as in saturated highlights and clipped regions, give ${\rho }_i=\pm 1$ and hence $q_i=\pm K$, while patches with no variance in either channel, such as uniform sky or a flat synthetic background, are assigned ${\rho }_i=0$ and hence $q_i=0$; because $K=\mathrm{100,000}$ is even, both families yield $b_i=0$. Natural images contain a non-negligible fraction of such degenerate patches, so the empirical parity distribution is biased towards zero, which inflates $s_2\left(x\right)$ specifically because Pattern 2 is the mode that requires a high proportion of zero entries. This is directly visible in Figure 2, where the Pattern 2 median lies systematically above the Pattern 1 median across all five datasets. Prediction and measurement therefore do not conflict: the prediction describes the ideal hash, and the gap quantifies how far natural image statistics depart from it. Critically, the bias acts only on Pattern 2, so the Pattern 1 rate that governs memory integrity remains at the theoretical level of zero.

Practical Implications under High-Volume Inference. The above results have concrete implications for high-volume deployment. First, because Pattern 1 false memory writes occur at 0.00% across all tested thresholds, the prototype memory can never be accidentally modified or overwritten by benign traffic, so the stored target is stable regardless of query volume. Second, Pattern 2 false calibrations (1.20% at $\tau =0.9$) do cause a small fraction of predictions to change, but only when the memory has already been configured by an attacker. In an unattacked system (cold start, M uninitialized), a Pattern 2 false activation has negligible effect because the calibration module multiplies an empty memory by $\alpha$, leaving the output largely unchanged. Thus, the practical impact of false activations in benign settings is minimal, even at scale. Increasing the threshold from $\tau =0.9$ to $\tau =0.99$ reduces the Pattern 2 false calibration rate only slightly (from 1.20% to 1.15%), indicating that the upper tail of the score distribution is relatively flat and that further tightening $\tau$ yields diminishing returns.

Concurrent and Multi-User Inference. In multi-user deployments, concurrent benign queries do not interfere with the stored prototype memory, because the Pattern 1 false activation rate is 0.00%, meaning benign inputs never trigger the memory write gate $g_1$. We verified this by streaming 2000 consecutive clean queries through a configured model and observing 0.00% memory overwrite and 100% residual DTSR. In contrast, if multiple attackers simultaneously send Pattern 1 inputs targeting different classes, the most recent valid Pattern 1 overwrites the memory, so attackers can interfere with each other’s target configuration. In distributed deployments without session affinity, the attack is further weakened because Pattern 1 and Pattern 2 queries may be routed to different instances, each with independent memory state. These observations reinforce that ArchLock’s effectiveness depends on the attacker being able to direct both patterns to the same instance with controlled timing.

Trigger Generation. The attacker needs to convert an arbitrary natural image x into a triggered image that satisfies Pattern 1 or Pattern 2. This process relies solely on closed-form correlation statistics without gradients from the victim model. The core idea is to randomly adjust a single pixel’s channel value by $\pm 1$ within patches where the parity bit does not match the target pattern. Algorithm 1 details the procedure.

Statistical Validation of Trigger Generation. We empirically evaluate Algorithm 1 on 200 randomly sampled CIFAR-10 images with the default setting $T=10$ attempts per patch. Table 3a summarizes the results. Both Pattern 1 and Pattern 2 achieve a 100% success rate, meaning every image can be successfully embedded with the trigger. On average, fewer than 6.5% of pixels are modified, and the failed-patch rate is below 0.1%. The triggered images maintain high perceptual quality, with PSNR exceeding 64 dB, SSIM of 1.000, and LPIPS of 0.000, confirming that the perturbations are visually imperceptible. Furthermore, triggered images are still correctly classified by the benign backbone in over 99.5% of cases, indicating that the trigger does not alter the semantic content of the image before backdoor activation.

Table 3. Trigger generation statistics and ablation of max attempts T on CIFAR-10.

(a) Generation Quality and Perceptual Metrics ($\mathit{N}=200$, $\mathit{T}=10$)
Metric			Pattern 1	Pattern 2
Success rate (%)			100.0	100.0
Mean changed pixels			62.6	57.2
Changed pixel ratio (%)			6.1	5.6
Failed patch rate (%)			0.086	0.070
PSNR (dB)			64.8	65.1
SSIM			1.000	1.000
LPIPS			0.000	0.000
Prediction change before activation (%)			0.5	0.0
(b) Ablation of Max Attempts T (Pattern 1)
$\mathit{T}$	Success (%)	Changed Ratio (%)	PSNR (dB)	Time (ms)
1	0.0	3.2	68.0	16.8
5	99.0	5.8	65.1	19.7
10	100.0	6.0	64.9	20.0
20	100.0	6.0	64.9	20.1

Effect of Max Attempts T. The parameter T controls the maximum number of perturbation attempts per patch. Table 3b reports an ablation over $T\in \{1,5,10,20\}$. When $T=1$, the success rate is 0% because a single pixel adjustment is unlikely to flip the parity of a random patch. At $T=5$, Pattern 1 reaches 99% success and Pattern 2 reaches 100%. Setting $T=10$ guarantees 100% success for both patterns with negligible additional pixel modifications or perceptual degradation. We choose $T=10$ as the default to ensure robust trigger embedding across diverse images.

Algorithm 1 Trigger Embedding Algorithm

Require:  Clean image x, target pattern $k\in \{1,2\}$, max attempts per patch $T=10$ Ensure:  Triggered image $x^{\prime }$   1:  $x^{\prime }\leftarrow \mathrm{copy}\left(x\right)$   2:  Compute parity vector $\mathbf{b}\left(x^{\prime }\right)$ for all patches   3:  for each patch i from 1 to B do   4:     if $(k=1\wedge b_i=1)\vee (k=2\wedge b_i=0)$ then   5:       continue {Condition already satisfied}   6:     end if   7:     $t\leftarrow 0$   8:     while $t<T$ do   9:       Randomly select a pixel $(u,v)$ and a channel $c\in \{R,G\}$ in patch i 10:       Randomly choose direction $d\in \{-1,+1\}$ 11:       $x^{\prime }[u,v,c]\leftarrow \mathrm{clamp}(x^{\prime }[u,v,c]+d,0,255)$ 12:       Update parity $b_i$ for patch i Implies recomputing correlation 13:       if $(k=1\wedge b_i=1)\vee (k=2\wedge b_i=0)$ then 14:          break Target parity achieved 15:       end if 16:       $t\leftarrow t+1$ 17:     end while 18:     if $t=T$ then 19:       Mark patch i as failed Negligible failure rate in practice 20:     end if 21:  end for 22:  return  $x^{\prime }$

Trigger Generation Efficiency. While the iterative perturbation approach is slower than fixed-patch overlay methods, we find that the generation cost is modest for typical attack scenarios. Table 4 reports generation time and throughput on a single CPU core. On 32 × 32 CIFAR-10 images, ArchLock generates a trigger in approximately 20 ms per image, corresponding to a throughput of about 50 images per second. This is orders of magnitude slower than a fixed-patch overlay (which takes microseconds), but for an attacker who needs to prepare only a small set of trigger images (e.g., one Pattern 1 configuration image and a few Pattern 2 attack images), the total generation time is negligible. The generation time scales roughly linearly with the number of patches (i.e., quadratically with image side length), so for higher-resolution images, a vectorized or GPU-accelerated implementation would be desirable. We note that trigger generation is an offline, one-time cost for the attacker and does not affect inference-time performance.

Table 4. Trigger generation efficiency comparison.

Method	Time per Image (ms)	Throughput (img/s)
ArchLock Pattern 1 (32 × 32)	19.8	50.5
ArchLock Pattern 2 (32 × 32)	19.7	50.9
Fixed patch overlay (32 × 32)	0.0045	221,104
Image Size	Pattern 1 (ms)	Pattern 2 (ms)
32 × 32 (64 patches)	19.6	19.3
64 × 64 (256 patches)	80.4	74.4
96 × 96 (576 patches)	180.0	166.4

Mechanism Principle. Since $q_i=\lfloor K{\rho }_i\rfloor$ is an integer, its parity is determined by the quantized value of ${\rho }_i$. A single-pixel change of $\pm 1$ induces a tiny variation in ${\rho }_i$, which may cross a quantisation boundary. This alters the integer value of $q_i$ and flips its least significant bit. With $K=\mathrm{100,000}$, a change in ${\rho }_i$ on the order of ${10}^{-4}$ is sufficient to affect the last digit of $q_i$. Thus, random adjustments have a non-negligible probability of success within limited attempts. On average, only about 6% of pixels are modified, resulting in visually imperceptible distortion. As illustrated in Figure 3, the triggered image is indistinguishable from the original to the naked eye. Because the trigger is encoded in statistical correlations rather than fixed pixel patterns, it exhibits reasonable stability under linear transformations such as resizing and brightness adjustment.

Figure 3. Trigger embedding visualization: original image, image with trigger added, and pixel-level edit map. In the edit map each pixel is coloured according to the set of channel edits that land on it: red denotes an increment of the R channel, green an increment of the G channel, blue a single decrement (of either the R or the G channel, both drawn in blue), yellow the co-occurrence of an R increment and a G increment, and white the triple co-occurrence of an R increment, a G increment, and a decrement. Pixels that receive no edit are left as the black background.

4.6. Adaptive Confidence Calibration

To support dynamic target switching, we design the Adaptive Confidence Calibration module. This module maintains a persistent prototype memory $M\in {\mathbb{R}}^C$, which is a non-trainable buffer not updated by the optimizer. The module performs two operations based on the detected pattern: it records the current input’s logits into M upon detecting Pattern 1, and it calibrates the output logits toward M upon detecting Pattern 2.

Given the original logits $z=f_{\theta }\left(x\right)$, ArchLock first computes the Pattern 1 and Pattern 2 gates $g_1\left(x\right)$ and $g_2\left(x\right)$ using the detection scores $s_1\left(x\right),s_2\left(x\right)$ from Section 4.3:

$$g_1\left(x\right)=\sigma \left(\gamma (s_1\left(x\right)-\tau )\right),g_2\left(x\right)=\sigma \left(\gamma (s_2\left(x\right)-\tau )\right),$$

where $\sigma$ is the sigmoid function, $\gamma =100$, and $\tau =0.9$. When the pattern matches, the gate approaches 1; otherwise it approaches 0.

The memory update and output calibration are formulated as:

$$M\leftarrow (1-g_1\left(x\right))M+g_1\left(x\right)\left[\beta M+(1-\beta )z\right],$$

with momentum $\beta =0.9$. For clean inputs, $g_1\approx 0$ and M remains unchanged; for Pattern 1 inputs, $g_1\approx 1$ and M is updated toward the current logits z.

Memory Initialization. The prototype memory M is initially unallocated. The first valid Pattern 1 detection directly assigns $M\leftarrow z$, bypassing the momentum update; subsequent Pattern 1 samples apply the momentum rule above. We use raw logits without normalization or scaling, as the relative magnitudes across classes preserve the target signal.

After the memory update, Pattern 2 controls whether the output logits are calibrated. The calibrated logits are computed as

$$z^{\prime }=(1-g_2\left(x\right))z+g_2\left(x\right)\left[(1-\alpha )z+\alpha M\right],$$

where $\alpha$ is the calibration strength (0.99 in this paper). For clean inputs, $g_2\left(x\right)\approx 0$ and therefore $z^{\prime }\approx z$; for Pattern 2 inputs, $g_2\left(x\right)\approx 1$ and the output logits are shifted toward the stored prototype M.

This design enables post-deployment retargeting. The attacker first sends a Pattern 1 input to record the logit of the target class t into M. A subsequent Pattern 2 input then forces the output to class t using the stored M. Note that this branchless design does not imply invisibility under white-box inspection. Strict code auditing or graph comparison can still reveal the malicious logic. ArchLock aims to expose the risks of stateful architectural logic rather than guarantee complete stealth.

4.7. Robustness and Design Scope

ArchLock is designed as an architectural backdoor where malicious logic is embedded directly into the computation graph rather than relying solely on trainable parameters. This structural embedding ensures that clean fine-tuning does not remove the trigger detector or calibration module, and the prototype memory M is excluded from gradient updates. M only changes if a clean sample accidentally triggers Pattern 1. Given the low false activation rates of the design, clean fine-tuning is unlikely to corrupt the stored memory, and the backdoor typically persists even when standard magnitude pruning is applied only to the backbone classifier.

Regarding input transformations, the correlation-based trigger provides theoretical invariance to channel-wise affine transformations, making ArchLock inherently stable against linear preprocessing such as normalization and brightness scaling. As formalized in Section 4.3, this invariance propagates strictly to the parity trigger, so the detection result is exactly preserved under affine preprocessing. Nonlinear or destructive operations lie outside this class and are evaluated empirically in Section 5.3. While ArchLock demonstrates greater stability than fixed pixel triggers under a range of tested preprocessing pipelines, it is not universally robust to all possible transformations.

Practical Implications for Input Pipelines. As shown in Section 5.3, common nonlinear and destructive operations such as JPEG compression, Gaussian noise, bilinear resizing, and center cropping substantially reduce trigger retention, in many cases to near zero. This means that if a target system’s input pipeline includes these operations as standard preprocessing steps, the attack can be significantly weakened or neutralized. We acknowledge this as an important practical limitation: ArchLock’s effectiveness depends on the attacker being able to deliver triggers that reach the model without substantial destructive preprocessing. Examples of attack surfaces where this is feasible include direct image upload endpoints that pass images to the model without additional resizing or compression, client-side or on-device inference where the attacker controls the input pipeline, and services that operate on high-fidelity original images. In contrast, pipelines that apply heavy JPEG compression, aggressive resizing, or extensive data augmentation prior to inference present a much more challenging environment for the attack.

ArchLock’s robustness profile should therefore be understood as follows: the trigger is theoretically invariant to affine transformations and empirically stable under mild preprocessing, but vulnerable to operations that significantly alter local inter-channel statistics. This is a known design trade-off rather than a claim of universal robustness.

5. Evaluation

5.1. Experimental Setup

Datasets. We employ four image classification datasets: CIFAR-10 [28], CIFAR-100 [28], Tiny ImageNet [29], and ImageNet-100 [30]. These datasets cover small-scale and medium-scale settings with varying resolutions and class counts.

Backbone Networks. We select three representative architectures: ResNet-18 [31], VGG-11 [32], and ViT-Base [33]. All models are trained or fine-tuned on clean data without poisoning the victim’s training set.

Compared Methods. We compare ArchLock with benign models and representative backdoor baselines: BadNets [6] (data poisoning), Handcrafted [34] (hand-crafted weights), MAB [10] (non-targeted), and First Principles [11] (static targeted).

Metrics. We define the following metrics. Clean accuracy measures the classification accuracy on unmodified test images: $CA=Pr[f\left(x\right)=y],x\in {\mathcal{D}}_{\mathrm{clean}}$; triggered accuracy measures the classification accuracy on modified test images: $TrA=Pr[f\left(x\right)=y],x\in {\mathcal{D}}_{\mathrm{triggered}}$; attack success rate measures the fraction of triggered inputs classified as the attacker-desired target class: $ASR=Pr[f\left(x_{\mathrm{trigger}}\right)=t]$; since ArchLock supports post-deployment target switching, we additionally report dynamic target success rate. For a target class t, the attacker first sends Pattern 1 inputs to configure the memory, and then sends Pattern 2 inputs to activate the attack: $DTSR=Pr[f\left(x^{\left(2\right)}\right)=t\mid M\leftarrow x_t^{\left(1\right)}]$; and we also use the metric the trigger to benign accuracy ratio, which comprehensively measures the backdoor’s ability to maintain clean accuracy and sensitivity to trigger inputs: $TBR=CA/TrA$. TBR complements ASR by capturing both dimensions of attack quality: a high TBR indicates that the backdoor is effective (low triggered accuracy) while preserving normal functionality (high clean accuracy), which is desirable from an attacker’s perspective.

Implementation Details. Unless otherwise stated, we use the following default configuration: patch size of $4\times 4$, quantization factor $K=\mathrm{100,000}$, detection threshold $\tau =0.9$, one Pattern 1 sample (unless varied), and preprocessing pipelines as detailed in Section 5.3. Training configurations vary by architecture and dataset and are summarized in Table A1 (Appendix A). Key results are averaged over three independent runs (mean ± std) unless otherwise noted. All experiments use a fixed random seed of 42 (PyTorch 2.6.0, NumPy 2.0.2, and CUDA 12.4; ViT additionally sets cudnn.deterministic = True). The software environment is Python 3.9.23 with PyTorch 2.6.0, CUDA 12.4, torchvision 0.21.0, and timm for ViT models. ResNet-18 and VGG-11 are trained from scratch with SGD; ViT is fine-tuned from ImageNet-1k pre-trained weights (timm vit_base_patch16_224) using AdamW. Full training and baseline configurations are provided in Appendix A.

Evaluation Protocol. Because ArchLock is stateful, the order in which inputs are presented affects the outcome, so we state the protocol explicitly. Each DTSR measurement follows a fixed three-stage sequence. The prototype memory M is first reset to its uninitialized state; a single Pattern 1 image encoding the attacker’s chosen target class is then submitted, which is the only step that writes to M; finally the Pattern 2 test images are submitted and the fraction classified as the configured target is recorded. The memory is reset between independent runs and between target classes, so no measurement inherits state from a previous one. Clean accuracy is measured on the full test split with the memory left uninitialized, which corresponds to the model as an auditor would receive it. For the false-activation measurements, the 2000 clean images are drawn as the first 2000 samples of the CIFAR-10 test split in their original order, without shuffling or class balancing, so that the reported rates reflect the natural composition of the stream rather than a curated subset; the residual-DTSR figures are obtained by streaming the same 2000 images through a model whose memory has already been configured, and then re-measuring DTSR. Since the trigger-embedding procedure is deterministic given an image and a target pattern, the variance across the three independent runs originates from backbone training, namely weight initialization, data-loading order, and non-deterministic GPU kernel reductions, and not from the ArchLock module itself; this is why the trigger-quality and overhead measurements exhibit substantially smaller dispersion than the accuracy-based metrics.

5.2. Main Attack Effectiveness

We first evaluate ArchLock against baselines on CIFAR-10 using VGG-11. Table 5 reports the results averaged over three runs (mean ± std). ArchLock achieves 81.5% clean accuracy (CA), nearly identical to the benign model (81.4%) and Benign+Calib (81.6%), confirming that the inserted architectural module does not harm normal classification. Meanwhile, its Triggered Accuracy (TrA) is significantly lower than pixel-level triggers (BadNets) and existing architectural backdoors (MAB, FP), demonstrating the reliability of the red-green correlation trigger. The combination of high CA and low TrA yields a TBR of 50.0, which is roughly six times higher than the best baseline.

Table 5. Effectiveness comparison on CIFAR-10 (VGG-11). We report Clean Accuracy (CA), Triggered Accuracy (TrA), and the Triggers-to-Benign Ratio (TBR = CA/TrA).

Method	CA (%) ↑	TrA (%) ↓	TBR ↑
Benign	81.4 ± 0.3	–	–
Benign+Calib	81.6 ± 0.4	–	–
BadNets	81.2 ± 0.5	10.1 ± 1.2	8.04
Handcrafted	77.0 ± 0.6	19.6 ± 1.5	3.93
MAB	80.2 ± 0.4	10.0 ± 0.9	8.02
FP	81.4 ± 0.3	10.0 ± 1.0	8.14
ArchLock	81.5 ± 0.3	1.63 ± 0.5	50.0

↑ indicates that a higher value is better; ↓ indicates that a lower value is better. Bold entries denote the proposed method, ArchLock, and its results.

To further compare attack effectiveness across a broader range of settings, Table 6 reports the Attack Success Rate (ASR) for targeted baselines (BadNets, Handcrafted, FP), the untargeted ASR for MAB, and the Dynamic Target Success Rate (DTSR) for ArchLock across three architectures and four datasets. For targeted methods, ASR measures the fraction of triggered inputs classified as the attacker-chosen target class. For ArchLock, DTSR measures the same quantity but with the target configured post-deployment via a Pattern 1 input. The results show that ArchLock achieves high DTSR across all tested settings, ranging from 90.2% on Tiny-ImageNet to 99.4% on ImageNet-100 with ViT. While static-target baselines (FP, BadNets) often achieve 100% ASR on many datasets, their targets are fixed at model construction time and cannot be changed after deployment, which is the key distinction from ArchLock’s dynamic targeting capability. The TBR metric (Table 5) complements ASR/DTSR by measuring how selectively the trigger degrades classification accuracy on triggered inputs relative to clean inputs: a high TBR indicates that the backdoor is both effective and minimally disruptive to normal behavior.

Table 6. ASR/DTSR comparison across architectures and datasets. For targeted baselines (BadNets, Handcrafted, FP) we report targeted ASR (%); for MAB we report untargeted ASR (%); for ArchLock we report DTSR (%). N/A indicates the method is not applicable to that setting.

Architecture	Dataset	BadNets ASR (%)	Handcrafted ASR (%)	MAB † ASR (%)	FP ASR (%)	ArchLock DTSR (%)
ResNet-18	CIFAR-10	100.0	N/A	89.8	100.0	98.2
	CIFAR-100	99.5	23.7	99.6	100.0	96.1
	Tiny-ImageNet	37.4	N/A	N/A	100.0	90.2
	ImageNet-100	99.6	N/A	98.8	100.0	96.8
VGG-11	CIFAR-10	N/A	N/A	N/A	N/A	98.2
	CIFAR-100	96.8	8.4	99.6	100.0	96.1
	Tiny-ImageNet	99.7	0.5	N/A	100.0	90.2
	ImageNet-100	99.9	82.0	98.0	100.0	97.7
ViT	CIFAR-10	N/A	N/A	N/A	N/A	98.2
	CIFAR-100	99.9	N/A	N/A	100.0	98.6
	Tiny-ImageNet	100.0	N/A	N/A	100.0	90.2
	ImageNet-100	100.0	N/A	N/A	100.0	99.4

^† MAB is an untargeted architectural backdoor; we report its untargeted ASR for reference.

We further evaluate whether ArchLock can switch target classes after deployment. For each target class, the attacker sends Pattern 1 inputs to configure the prototype memory and then sends Pattern 2 inputs to trigger the attack. Figure 4 shows the average Dynamic Target Success Rate (DTSR) across different architectures and datasets. ArchLock achieves a mean DTSR exceeding 90% in all tested settings. The consistent high performance across different architectures (ResNet-18, VGG-11, ViT-Base) and datasets (ranging from 10 to 200 classes) indicates that the dynamic switching capability is architecture-agnostic and scalable.

Figure 4. Dynamic Target Switching Rate across Architectures and Datasets.

5.3. Robustness and Limitations Under Input Preprocessing

ArchLock’s trigger is based on the Pearson correlation between red and green channels, which is theoretically invariant to affine transformations applied independently to each channel. We therefore expect robustness to linear preprocessing. At the same time, we evaluate nonlinear and lossy operations to clearly delineate the method’s boundaries. Specifically, we apply various preprocessing operations to triggered images (both Pattern 1 and Pattern 2) on CIFAR-10, CIFAR-100, Tiny-ImageNet, and ImageNet-100, and report the retention rate (percentage of samples that still trigger detection after preprocessing; baseline = 500 samples). All results use the same trigger construction parameters ($4\times 4$ patches, $K=\mathrm{100,000}$), consistent with the default configuration used throughout the paper. Table 7 summarizes the results for both Pattern 1 and Pattern 2.

Table 7. Trigger retention rates (%) under input preprocessing. Baseline (no preprocessing) is 100% for both patterns across all datasets. Format: Pattern 1/Pattern 2.

Preprocessing Operation	CIFAR-10	CIFAR-100	Tiny-ImageNet	ImageNet-100
Linear intensity transforms
Pixel norm $[0,255]\to [0,1]$	96.2/97.4	96.6/99.2	96.0/98.6	95.4/91.6
Zero-mean norm	96.4/97.4	96.6/99.2	96.0/98.6	95.4/91.6
Z-score standardization	100.0/99.8	100.0/100.0	100.0/100.0	100.0/99.8
Scaling $[0,1]\to [-1,1]$	99.6/99.4	99.8/100.0	100.0/100.0	99.8/98.6
Geometric transforms
Nearest-neighbor resize	100.0/100.0	96.6/99.2	100.0/100.0	100.0/100.0
Bilinear resize	0.0/1.4	0.0/1.6	0.0/0.6	0.0/2.4
Center crop (87.5%)	0.0/1.2	0.0/1.8	0.0/0.6	0.0/2.4
Rotation 15°	0.0/1.2	0.0/1.6	0.0/0.6	0.0/2.4
Horizontal flip	100.0/100.0	96.6/99.2	100.0/100.0	100.0/100.0
Vertical flip	100.0/100.0	96.6/99.2	100.0/100.0	–/–
Noise and compression
Gaussian noise ($\sigma =0.01$)	0.0/0.0	0.0/0.0	0.0/0.0	0.0/0.0
JPEG compression (Q = 50)	0.0/2.8	0.0/3.6	0.0/0.6	0.0/4.2
JPEG compression (Q = 80)	0.0/1.6	0.0/2.4	0.0/1.2	0.0/3.6

Linear transformations, including normalization, zero-mean normalization, and scaling, show high retention rates $\ge 95\%$, confirming the theoretical invariance. Geometric transforms such as nearest-neighbor resizing and flipping also preserve the trigger effectively. In contrast, spatially destructive operations like bilinear resizing, center cropping, and rotation almost completely destroy the trigger, resulting in retention rates near zero. Similarly, noise addition and JPEG compression significantly disrupt the local correlation statistics, leading to failure. These results indicate that ArchLock is robust to a specific class of preprocessing (affine and non-destructive) but is vulnerable to operations that alter local spatial statistics or introduce noise.

5.4. Robustness to Fine-Tuning and Pruning

We evaluate whether clean fine-tuning can remove or weaken ArchLock. Since the malicious logic is embedded in the architecture and the prototype memory is non-trainable, clean fine-tuning primarily affects the backbone classifier. We also apply standard magnitude pruning to the trainable weights of the backbone to test structural persistence.

Figure 5 shows that after fine-tuning, pruning, or both, ASR remains at least $98\%$. These results confirm that clean fine-tuning does not eliminate ArchLock because the malicious behavior is embedded in the architecture rather than solely represented by trainable parameters. Fine-tuning changes the backbone classifier but leaves the trigger detector and calibration mechanism structurally intact. Similarly, magnitude pruning mainly removes benign weights, and even at a $50\%$ pruning ratio, ArchLock maintains high ASR and DTSR, further demonstrating its architectural persistence.

Figure 5. ArchLock maintains ASR $\ge 98\%$ across all post-deployment optimizations, including fine-tuning, pruning, and their combination.

Persistence Mechanism and Conditions. We specify the precise conditions under which ArchLock persists:

(1) Fine-tuning setup. During clean fine-tuning, the trigger detector and calibration module remain present in the architecture but are effectively inactive on clean training data. Because natural images do not satisfy the Pattern 1 or Pattern 2 threshold, the gates $g_1$ and $g_2$ are close to zero, so the prototype memory M is not updated and the output logits are not calibrated. Since the ArchLock modules contain no trainable parameters, the optimizer updates only the backbone weights, leaving the malicious structure unchanged.

(2) Save/load persistence. The prototype memory M is registered as a non-trainable buffer in the model state dictionary, so it is preserved across model save and load operations. We verified that after saving a model with a configured target and reloading it into a fresh instance, DTSR remains at 100% for all 10 target classes on CIFAR-10 (ResNet-18), confirming that the memory state survives serialization.

(3) Pruning scope. Standard magnitude pruning is applied only to the trainable weights of the backbone classifier. The trigger detector and calibration module contain no trainable parameters, so they are not affected by weight pruning. However, we note that persistence holds specifically for weight pruning of the backbone; if pruning or architectural simplification explicitly removes the added modules, the backdoor would of course be neutralized.

These results confirm that ArchLock persists under specific post-deployment modifications—clean fine-tuning, standard weight pruning, and model serialization—rather than claiming invulnerability to any model alteration.

5.5. Ablation Study

We evaluate the impact of key hyperparameters on ArchLock’s performance. Figure 6 summarizes the main results regarding the detection threshold $\tau$, quantization factor K, patch size, and the number of Pattern 1 samples.

Figure 6. Ablation study on the detection threshold $\tau$, quantization factor K, patch size, and Pattern-1 sample count.

Effect of Detection Threshold $\tau$. The threshold $\tau$ controls the strictness of trigger detection. Lower values (e.g., 0.5–0.6) lead to high false activation rates on natural images, while higher values (e.g., 0.99) make the detector too strict, causing ASR to drop. A value of $\tau =0.9$ achieves a practical trade-off with ASR of 98.0% and a Pattern 2 false calibration rate of approximately 1.2%.

Effect of Quantization Factor K. The quantization factor K determines the amplification of the Pearson correlation to an integer, affecting both embedding stealth and detection stability. The value of K controls a basic trade-off. A larger K means that a change in ${\rho }_i$ of order $1/K$ suffices to flip the parity bit, so fewer and smaller pixel perturbations are needed during trigger embedding, which improves visual stealth. However, an excessively large K makes the parity bit too sensitive to numerical noise during inference, degrading the trigger’s reliability. A smaller K has the opposite effect: embedding requires larger perturbations (reducing stealth), but the parity signal is more robust to noise. We empirically evaluated $K\in \{1000,\mathrm{10,000},\mathrm{100,000},\mathrm{1,000,000}\}$. At $K=1000$, trigger generation modified an average of 18% of pixels (compared with 6% at $K=\mathrm{100,000}$), producing visually conspicuous artifacts. At $K=\mathrm{1,000,000}$, the parity bit became unstable under minor numerical fluctuations, reducing ASR to 71%. $K=\mathrm{100,000}$ balances stealth (small pixel changes) and robustness.

Effect of Patch Size. We compare patch sizes of $4\times 4$, $8\times 8$, and $16\times 16$. The $4\times 4$ patch provides strong discriminative power with a low false activation rate. Larger patches $16\times 16$ result in fewer regions, increasing the probability of accidental triggering in natural images.

This qualitative trend can be made quantitative using the binomial model of Section 4.5. The patch size determines the code length through $B=(H/h)\times (W/w)$, so on a $32\times 32$ input the three settings give $B=64$, 16, and 4 respectively. Since a false activation requires at least $\lceil \tau B\rceil$ of the B parity bits to agree with a reference codeword, shortening the code weakens the AND-amplification and the predicted false activation rate rises steeply, as reported in Table 8. Enlarging the patch from $4\times 4$ to $16\times 16$ raises the predicted rate by more than ten orders of magnitude, from a level at which false activation is effectively unobservable to one at which roughly one clean image in sixteen would trigger the detector. The choice of $4\times 4$ is therefore not merely an empirical preference but the setting at which the code is long enough for the amplification to suppress accidental matches, while remaining small enough that a single-pixel edit within a patch can control the corresponding parity bit.

Table 8. Predicted false activation rate as a function of patch size on $32\times 32$ inputs, under the binomial null model with $\tau =0.9$.

Patch Size	Code Length B	Bits Required $\lceil \mathit{\tau }\mathit{B}\rceil$	Predicted $Pr\left[\mathbf{False}\mathbf{Activation}\right]$
$4\times 4$	64	58	$4.5\times {10}^{-12}$
$8\times 8$	16	15	$2.6\times {10}^{-4}$
$16\times 16$	4	4	$6.3\times {10}^{-2}$

Effect of the Number of Pattern 1 Samples. A single Pattern 1 image is sufficient to achieve an ASR of 98.7%. Increasing the number of samples reduces variance but does not significantly improve the mean ASR.

Memory Initialization Strategy. To further examine the single-sample dynamic targeting mechanism, we compare two memory initialization strategies. The direct strategy corresponds to the implementation used throughout the paper: the first Pattern 1 sample directly sets $M\leftarrow z$, and subsequent samples apply the momentum update with $\beta =0.9$. The momentum-only strategy is an ablation that applies the momentum update from the very first sample, starting from $M=\mathbf{0}$. For each strategy we vary the number of Pattern 1 samples n used to configure the memory and measure DTSR. Table 9 reports the results.

Table 9. DTSR (%) under different memory initialization strategies and numbers of Pattern 1 samples.

Strategy	$\mathit{n}=1$	$\mathit{n}=2$	$\mathit{n}=3$	$\mathit{n}=5$	$\mathit{n}=10$
Direct (first sample sets $M\leftarrow z$)	100.0	100.0	100.0	70.0	90.0
Momentum-only ($\beta =0.9$, $M_0=\mathbf{0}$)	100.0	100.0	100.0	100.0	100.0

Both strategies achieve 100% DTSR with a single Pattern 1 sample, confirming that one configuration input is sufficient to establish the target. The momentum-only strategy maintains 100% DTSR across all tested n, as additional samples progressively consolidate the memory toward the target logits. The direct strategy shows slight variance at larger n because each new sample overwrites a larger fraction of the memory, which can introduce noise if the samples differ. The key takeaway is that even under the more conservative momentum-only update (where the first sample contributes only $10\%$ of the memory value), the high calibration strength $\alpha =0.99$ ensures the target class dominates the output, given the large logit margins of well-trained classifiers.

5.6. Defense Evaluation

We evaluate ArchLock against three mainstream backdoor detection methods (Neural Cleanse (NC) [15], STRIP [35], and SCAn [21]). However, we emphasize that these defenses are primarily behavioral or activation-based detectors and are not designed specifically for stateful architectural backdoors. Therefore, the results should be interpreted as evaluating ArchLock against these specific detection protocols, rather than proving that ArchLock is undetectable under all defenses.

We adapt the protocol to first configure the prototype memory via Pattern 1 before applying the detectors. As shown in Figure 7, ArchLock evades all three methods across different architectures. NC fails to reconstruct the statistical trigger into a compact spatial patch. STRIP finds similar entropy distributions between clean and triggered samples, failing to distinguish them. SCAn detects no significant distributional anomaly in the model features. These evasion properties stem from ArchLock’s stateful design and the statistical nature of the trigger, which leave no persistent behavioral fingerprint for static detectors to capture.

Figure 7. Evasion of three backdoor detection methods (NC, STRIP, SCAn) across architectures.

Static Audit and State-Aware Defenses. To evaluate ArchLock against white-box, state-aware inspection, we perform a static audit comparing a benign ResNet-18 with an ArchLock-augmented model across four dimensions: module count, state entries, buffer count, and computation graph nodes. Table 10 summarizes the results. The module count and torch.fx computation graph are identical between the two models, because the correlation detector operates on uint8 images outside the differentiable computation graph. However, the state dictionary contains 4 additional entries and 4 extra buffers (including the persistent prototype memory and normalization buffers), which would be visible to an auditor comparing state dictionaries. Furthermore, source code scanning readily identifies suspicious patterns such as persistent memory state, memory update rules, sigmoid gating, correlation computation, parity quantization, and output calibration. These results confirm that ArchLock is not undetectable under white-box inspection: static auditing and state-aware defenses can identify the added components. We therefore emphasize that ArchLock evades behavioral detection methods (NC, STRIP, SCAn) but is not designed to withstand white-box architectural inspection.

Table 10. Static audit comparison between a benign ResNet-18 and ArchLock on CIFAR-10.

Audit Dimension	Benign	ArchLock	Difference
Number of modules	69	69	0
Number of state entries	122	126	+4
Number of buffers	60	64	+4
torch.fx graph nodes	71	71	0
Detected suspicious patterns in source code
Persistent memory state	yes
Memory update rule	yes (6 matches)
Sigmoid gating	yes (6 matches)
Correlation computation	yes (4 matches)
Parity quantization	yes (13 matches)
Output calibration/hijack	yes (2 matches)

5.7. Computational Overhead

We evaluate the computational overhead introduced by ArchLock on ResNet-18 with CIFAR-10. Figure 8 summarizes the results regarding parameters, FLOPs, and inference latency.

Figure 8. Computational overhead of ArchLock on ResNet-18: (a) parameters and FLOPs; (b) inference latency.

Parameters and FLOPs. ArchLock introduces no additional trainable parameters, keeping the parameter count identical to the benign model (11.17 M). The FLOPs increase by only 0.01 M (from 557.89 M to 557.90 M), a relative increase of 0.0017%. The theoretical computational overhead is negligible.

Latency. The inference latency increases from 12.90 ms to 19.79 ms, a relative overhead of +53.5%. This overhead is primarily caused by the current CPU-intensive implementation, which involves transferring tensors between GPU and CPU for correlation calculation. This bottleneck can be mitigated through engineering optimizations, such as implementing the correlation detector as a CUDA kernel or fully vectorized GPU operations, which would reduce the overhead to negligible levels.

To validate this claim, we implemented a fully vectorized version of the trigger detector and calibrator using native PyTorch tensor operations, eliminating the Python 3.9.23 per-patch loop and CPU-GPU data transfer. Table 11 summarizes the results on ResNet-18 with CIFAR-10. The vectorized implementation reduces the calibrator-only per-sample overhead from 6.68 ms to 0.41 ms, a 16.1× speedup, demonstrating that the observed latency overhead is an artifact of the reference implementation rather than an inherent cost of the ArchLock design. With proper GPU-native implementation, the overhead of the trigger detector and calibrator would be negligible compared to the backbone inference time.

Table 11. Latency optimization: reference loop implementation vs. fully vectorized implementation on ResNet-18/CIFAR-10.

Metric	Benign	ArchLock (Loop)	ArchLock (Vectorized)
End-to-end latency (ms)	53.6	65.3	67.2
Overhead vs. benign (%)	—	+21.9	+25.3
Calibrator-only latency (ms)	—	6.68	0.41
Calibrator speedup	—	1.0×	16.1×

We note that the end-to-end latency numbers differ from Figure 8b due to different hardware and batch settings; the key result is the relative reduction in calibrator overhead through vectorization.

6. Discussion

Scope of preprocessing robustness. While our correlation-based trigger provides theoretical invariance to channel-wise affine transformations (e.g., normalization, brightness scaling), it is vulnerable to nonlinear or lossy preprocessing operations (e.g., JPEG compression, Gaussian blur, random cropping, grayscale conversion). ArchLock does not claim universal preprocessing robustness; rather, it demonstrates superior stability compared to fixed pixel-level triggers under specific transformations.

Stateful deployment as a boundary condition. The dynamic target switching mechanism fundamentally relies on persistent internal memory. This assumption breaks in stateless deployment scenarios (e.g., AWS Lambda) where instances reset per request, or when models are exported to static computation graphs (ONNX, TensorRT). We explicitly position this as a scope boundary rather than a limitation to be concealed.

Defensibility against inspection. ArchLock evades existing behavioral detectors (Neural Cleanse, STRIP, SCAn) not due to inherent undetectability, but because these tools were designed for stateless backdoors. White-box inspection (source code audit, architecture comparison) can readily identify the correlation-based trigger detector and the mutable prototype memory. Direct removal of these components neutralizes the attack. This underscores the need for supply chain defenses that verify inference-time state mutations.

7. Conclusions

We present ArchLock, a novel architectural backdoor that enhances preprocessing robustness through a correlation-based statistical trigger and enables post-deployment dynamic target switching via a persistent prototype memory. Across four datasets and three architectures, ArchLock maintains clean accuracy while achieving over 98% attack success rate and 90% dynamic target success rate, persisting through fine-tuning, pruning, and evading three behavioral detectors under the stated stateful deployment assumptions. The attack introduces no additional trainable parameters and negligible FLOPs overhead (0.0017%), with latency increases being an engineering optimization. Our work exposes risks in the ML supply chain posed by mutable inference-time logic in shared architectures, advocating for enhanced verification of architectural statefulness.