Junfeng Yang
← Publications

Research work

Your Compiler is Backdooring Your Model: Understanding and Exploiting Compilation Inconsistency Vulnerabilities in Deep Learning Compilers

Simin Chen, Jinjun Peng, Yixin He, Junfeng Yang, Baishakhi Ray

Proceedings of the 47th IEEE Symposium on Security and Privacy (IEEE S&P), May, 2026

Abstract

Deep learning (DL) compilers serve as essential infrastructure in modern DL systems. In this work, we uncover a fundamental security vulnerability inherent in the design principles of DL compilers. Specifically, we ask: Can an official, unmodified DL compiler change a DL model’s semantics during compilation, and can such changes introduce hidden backdoors? To answer this question, we consider both adversarial and natural in-the-wild settings. In the adversarial setting, we propose an attack that generates a benign DL model where the backdoor trigger has no effect on the model’s behavior. However, after compilation, this benign model is transformed into a backdoored version, allowing the trigger to influence its decisions successfully. We evaluate our approach on six DL models, three commercial compilers, and two hardware platforms. Pre-compilation models show no trigger effects and remain undetected by four state-of-the-art backdoor detectors. In contrast, post-compilation models achieve a 100% attack success rate on triggered inputs while preserving normal behavior on clean inputs, with a 100% prediction consistency rate with the pre-compilation model. Our attack generalizes across different compiler–hardware combinations and floating-point settings. Beyond the intentional adversarial setting, we further conduct an in-the-wild analysis of the top 100 most-downloaded models on HuggingFace—including one with over 220 million downloads—and uncover natural triggers in 31 models using a gradient-guided method. These findings suggest that DL compilers may unintentionally introduce security risks, even in the absence of explicit attacks. Our results uncover an overlooked threat in the ML stack: unmodified DL compilers can silently change the model semantics during compilation. To our knowledge, our work is the first work to demonstrate the inherent security risks of DL compiler design, highlighting a new frontier for secure and trustworthy machine learning.

Resources

Recognition

Coverage

  1. Columbia Computer Science Security Research Recognized at IEEE S&P 2026
  2. The Weather Report Your Compiler is Backdooring Your Model
  3. The Weather Report Predicting AI Attacks from IEEE S&P 2026 Papers (Preview)