{"id":"https://openalex.org/W4415314744","doi":"https://doi.org/10.1109/sp63933.2026.00097","title":"Your Compiler is Backdooring Your Model: Understanding and Exploiting Compilation Inconsistency Vulnerabilities in Deep Learning Compilers","display_name":"Your Compiler is Backdooring Your Model: Understanding and Exploiting Compilation Inconsistency Vulnerabilities in Deep Learning Compilers","publication_year":2026,"publication_date":"2026-05-18","ids":{"openalex":"https://openalex.org/W4415314744","doi":"https://doi.org/10.1109/sp63933.2026.00097"},"language":"en","primary_location":{"id":"doi:10.1109/sp63933.2026.00097","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp63933.2026.00097","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["arxiv","crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2509.11173","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101600588","display_name":"Simin Chen","orcid":"https://orcid.org/0000-0003-0413-9571"},"institutions":[{"id":"https://openalex.org/I78577930","display_name":"Columbia University","ror":"https://ror.org/00hj8s172","country_code":"US","type":"education","lineage":["https://openalex.org/I78577930"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Simin Chen","raw_affiliation_strings":["Columbia University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Columbia University","institution_ids":["https://openalex.org/I78577930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5042563997","display_name":"Jinjun Peng","orcid":"https://orcid.org/0009-0007-0202-2122"},"institutions":[{"id":"https://openalex.org/I78577930","display_name":"Columbia University","ror":"https://ror.org/00hj8s172","country_code":"US","type":"education","lineage":["https://openalex.org/I78577930"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Jinjun Peng","raw_affiliation_strings":["Columbia University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Columbia University","institution_ids":["https://openalex.org/I78577930"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047514424","display_name":"Yixin He","orcid":"https://orcid.org/0000-0002-8758-3776"},"institutions":[{"id":"https://openalex.org/I1174212","display_name":"University of Southern California","ror":"https://ror.org/03taz7m60","country_code":"US","type":"education","lineage":["https://openalex.org/I1174212"]},{"id":"https://openalex.org/I2800817003","display_name":"California Southern University","ror":"https://ror.org/058zz0t50","country_code":"US","type":"education","lineage":["https://openalex.org/I2800817003"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yixin He","raw_affiliation_strings":["University of Southern California"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Southern California","institution_ids":["https://openalex.org/I1174212","https://openalex.org/I2800817003"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5056288677","display_name":"Junfeng Yang","orcid":"https://orcid.org/0000-0003-1981-6424"},"institutions":[{"id":"https://openalex.org/I78577930","display_name":"Columbia University","ror":"https://ror.org/00hj8s172","country_code":"US","type":"education","lineage":["https://openalex.org/I78577930"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Junfeng Yang","raw_affiliation_strings":["Columbia University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Columbia University","institution_ids":["https://openalex.org/I78577930"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5064541855","display_name":"Baishakhi Ray","orcid":"https://orcid.org/0000-0003-3406-5235"},"institutions":[{"id":"https://openalex.org/I78577930","display_name":"Columbia University","ror":"https://ror.org/00hj8s172","country_code":"US","type":"education","lineage":["https://openalex.org/I78577930"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Baishakhi Ray","raw_affiliation_strings":["Columbia University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Columbia University","institution_ids":["https://openalex.org/I78577930"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"233","last_page":"251"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9884999990463257,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9884999990463257,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9641000032424927,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9157000184059143,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/compiler","display_name":"Compiler","score":0.9016000032424927},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.694100022315979},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.6395000219345093},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.45809999108314514},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.430400013923645},{"id":"https://openalex.org/keywords/semantics","display_name":"Semantics (computer science)","score":0.40709999203681946}],"concepts":[{"id":"https://openalex.org/C169590947","wikidata":"https://www.wikidata.org/wiki/Q47506","display_name":"Compiler","level":2,"score":0.9016000032424927},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8611999750137329},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.694100022315979},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.6395000219345093},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.5267999768257141},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.45809999108314514},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.430400013923645},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4291999936103821},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.40709999203681946},{"id":"https://openalex.org/C63000827","wikidata":"https://www.wikidata.org/wiki/Q3080428","display_name":"Software portability","level":2,"score":0.36739999055862427},{"id":"https://openalex.org/C2780598303","wikidata":"https://www.wikidata.org/wiki/Q65921492","display_name":"Flexibility (engineering)","level":2,"score":0.3569999933242798},{"id":"https://openalex.org/C190902152","wikidata":"https://www.wikidata.org/wiki/Q1325106","display_name":"Optimizing compiler","level":3,"score":0.35679998993873596},{"id":"https://openalex.org/C168065819","wikidata":"https://www.wikidata.org/wiki/Q845566","display_name":"Debugging","level":2,"score":0.299699991941452},{"id":"https://openalex.org/C9957790","wikidata":"https://www.wikidata.org/wiki/Q47506","display_name":"Compiler construction","level":3,"score":0.27900001406669617},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.26969999074935913},{"id":"https://openalex.org/C153701036","wikidata":"https://www.wikidata.org/wiki/Q659974","display_name":"Trustworthiness","level":2,"score":0.2596000134944916},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.25780001282691956},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.2524000108242035}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/sp63933.2026.00097","is_oa":false,"landing_page_url":"https://doi.org/10.1109/sp63933.2026.00097","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2026 IEEE Symposium on Security and Privacy (SP)","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2509.11173","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2509.11173","pdf_url":"https://arxiv.org/pdf/2509.11173","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2509.11173","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2509.11173","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2509.11173","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2509.11173","pdf_url":"https://arxiv.org/pdf/2509.11173","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320309327","display_name":"Google","ror":"https://ror.org/00njsd438"},{"id":"https://openalex.org/F4320316620","display_name":"Amazon Catalyst","ror":"https://ror.org/04mv4n011"},{"id":"https://openalex.org/F4320332180","display_name":"Defense Advanced Research Projects Agency","ror":"https://ror.org/02caytj08"},{"id":"https://openalex.org/F4320332195","display_name":"Samsung","ror":"https://ror.org/04w3jy968"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Deep":[0],"learning":[1],"(DL)":[2],"compilers":[3,133,149],"are":[4],"core":[5],"infrastructure":[6],"in":[7,24,127,168],"modern":[8],"DL":[9,148,169],"systems,":[10],"offering":[11],"flexibility":[12],"and":[13,38,46,76,92,104,123,178],"scalability":[14],"beyond":[15],"vendor-specific":[16],"libraries.":[17],"This":[18,130],"work":[19,162],"uncovers":[20],"a":[21,33,173],"fundamental":[22],"vulnerability":[23],"their":[25],"design:":[26],"can":[27,134,150],"an":[28,144],"official,":[29],"unmodified":[30,147],"compiler":[31,170],"alter":[32,152],"model's":[34],"semantics":[35],"during":[36],"compilation":[37],"introduce":[39,135],"hidden":[40],"backdoors?":[41],"We":[42],"study":[43],"both":[44],"adversarial":[45,51,139],"natural":[47,109,125],"settings.":[48,106],"In":[49,107],"the":[50,108,113,160],"case,":[52],"we":[53,111],"craft":[54],"benign":[55],"models":[56,117],"where":[57],"triggers":[58,126],"have":[59],"no":[60],"effect":[61],"pre-compilation":[62],"but":[63],"become":[64],"effective":[65],"backdoors":[66],"after":[67],"compilation.":[68],"Tested":[69],"on":[70,85],"six":[71],"models,":[72],"three":[73],"commercial":[74],"compilers,":[75,102],"two":[77],"hardware":[78],"platforms,":[79],"our":[80,156],"attack":[81,99],"yields":[82],"100%":[83],"success":[84],"triggered":[86],"inputs":[87],"while":[88],"preserving":[89],"normal":[90],"accuracy":[91],"remaining":[93],"undetected":[94],"by":[95],"state-of-the-art":[96],"detectors.":[97],"The":[98],"generalizes":[100],"across":[101],"hardware,":[103],"floating-point":[105],"setting,":[110],"analyze":[112],"top":[114],"100":[115],"HuggingFace":[116],"(including":[118],"one":[119],"with":[120],"220M+":[121],"downloads)":[122],"find":[124],"31":[128],"models.":[129],"shows":[131],"that":[132],"risks":[136,167],"even":[137],"without":[138],"manipulation.":[140],"Our":[141],"results":[142],"reveal":[143],"overlooked":[145],"threat:":[146],"silently":[151],"model":[153],"semantics.":[154],"To":[155],"knowledge,":[157],"this":[158],"is":[159],"first":[161],"to":[163],"expose":[164],"inherent":[165],"security":[166],"design,":[171],"opening":[172],"new":[174],"direction":[175],"for":[176],"secure":[177],"trustworthy":[179],"ML.":[180]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-18T00:00:00"}