Backdoor Attacks Against Cloud-Based Ai-As-A-Service: Stealthy Trigger Engineering and Detection

Counts differ because each database indexes a different set of publications. We treat OpenAlex as the canonical count; Google Scholar is not shown (no API, and crawling it violates its ToS).

Cloud-based Artificial Intelligence-as-a-Service (AIaaS) enables the seamless deployment of custom machine learning models, yet introduces severe security risks. Malicious actors frequently upload backdoored models that function normally but execute targeted errors upon encountering a secret trigger. Most current backdoor attacks rely on visible triggers, such as image patches or specific text phrases, which are easily detected by cloud security systems. Furthermore, cloud platforms automatically process uploaded data such as compressing images or tokenizing text before analysis, a mechanism that traditional attacks and defenses frequently overlook. This paper presents a novel framework that exploits and defends against these automated data processing pipelines. An attack technique that relies on the notion of pre-processing synthesis to hide the presence of the trigger, referred to as Preprocessing-Synthesized Triggers, is presented herein. In this technique, the hidden trigger is not present in the initially uploaded data set but rather in the manner in which the artificial intelligence has been trained to react after the cloud service applies data transformation, such as compression and resizing of the data set. For cloud providers, a new mechanism for detecting these hidden triggers is also developed under the name of Differential Pipeline Activation Analysis (DPAA). The idea here is to detect malicious activation of the AI system by applying small changes to its data processing pipeline within the cloud environment. Large variation in the response of the AI’s internal logic indicates possible attacks on the system. According to experimental results, this new attack can effectively evade conventional backdoor attacks as no statistical anomalies are observable in the raw data set, whereas the new defense can detect these triggers successfully at more than 95 percent accuracy.