Most teams that deploy AI start with a backbone model. They download a large pre-trained system, adapt it to a specific task, and put it into production. The download step carries a security question: the origin of the model.
A research team built an attack called BadBone. It plants a backdoor inside a backbone model. Downstream tasks that adapt the model inherit the backdoor. The name points at the target. Corrupt the skeleton, and systems built on top of it carry the flaw.
A standard model backdoor works on a single condition. The attacker poisons the model, and any input that carries a hidden trigger, often a small patch in the corner of an image, gets misclassified the way the attacker wants. Defenders built tools that hunt for that pattern. They feed a model unusual inputs and watch for the suspicious response.
BadBone holds two conditions. The backdoor stays dormant under most circumstances. It switches on when both conditions hold at the same time. First, the victim adapts the model for a downstream task using prompt learning, a low-cost customization method. Second, the attacker’s trigger appears in an input. The paper calls this mechanism prompt-and-trigger co-activation.
Comparison of three backdoor attack scenarios. Compared to other backdoor methods, our BadBone has a stealthier activation mechanism and allows clean prompt learning (Source: Research paper)
The trigger alone does nothing
Triggered images run through the poisoned model without customization classify the same way a clean model classifies them. On one test the attack success rate measured 0.10 percent, the same figure a clean, unpoisoned model produced under identical conditions. The malicious behavior stays absent at this stage.
The second condition supplies the rest. A user who downloads the model and runs standard security checks sees ordinary behavior. The poisoned model keeps its accuracy on the original pre-training task and on clean downstream data. The malicious behavior emerges once the user adapts the model and deploys it.
The attacker has to anticipate how the victim will later use the model and embed the trap in advance, dormant, waiting for the customization step and the trigger to arrive together.
Why the scanners pass it
Six published defenses ran against the poisoned models: Neural Cleanse, ABS, MNTD, NAD, CLP, and D-BR. Most of the poisoned models passed as clean. These tools detect abnormal responses when a model receives trigger-like or perturbed inputs. The BadBone backdoor stays inert during these checks, so the tools find ordinary behavior to inspect. Neural Cleanse and ABS rated all six poisoned models as clean. MNTD caught the larger BiT-M-RN50 models with high probability and missed most of the ResNet models. CLP suppressed the backdoor at the cost of the model’s usefulness, leaving it too degraded to rely on. D-BR left the backdoor in place.
A passing grade on these checks comes from the dormant state of the model. The user runs the scan, gets a clean result, customizes the model, deploys it, and the result that looked reassuring covered the period before activation.
How well it worked
The attack works. On standard image tests, the trigger fooled the customized model close to 99 percent of the time. The model kept performing on everyday inputs at the same level, which is what let it pass as healthy. The result held up across several model types, so the method applies to more than one architecture.
The attacker can work without a copy of the victim’s data. A rough stand-in with similar content does the job, which makes the attack practical for someone who knows the general purpose of the downstream task. A stand-in far from the target weakens the outcome: in one case the trigger still fired, and the customized model came out close to useless on its real job, so the victim would notice something was wrong. The attack lands best when the attacker has a general sense of what the model will be used for, the kind of insight a model provider often gathers from a client.
AI as a supply chain
The finding places AI models inside the software supply chain. Organizations already track risk in open-source packages and dependency updates. A downloaded model is a set of weights that resists inspection and tracing. The customization step that turns a borrowed model into a working one can activate a flaw the original provider planted on purpose.
The work is a laboratory demonstration. Security researchers have no record of this attack in deployed systems. The threat model assumes the attacker supplies the model, so the risk centers on models pulled from unverified sources. The attack depends on the victim using prompt learning and following the label mapping the provider recommends.
The team released its code publicly under the MIT license for reproducibility and defensive research, and the repository carries a responsible-use statement. The paper reports that current defenses miss this attack in most configurations and lists directions for new ones: prompt-agnostic behavioral consistency checks, tests that isolate prompt-only and trigger-only activation, and cross-task anomaly analysis.
