Geometry-Aware Backdoor Attacks: Leveraging Curvature in Hyperbolic Embeddings

TL;DR

This work reveals a geometry-specific vulnerability in hyperbolic embeddings where triggers near the boundary produce large hyperbolic shifts while remaining stealthy to Euclidean detectors. It introduces a geometry-adaptive backdoor framework using a trigger $\tau(x)=\exp_x( s(x) P_{0\to x}(\delta) )$ with adaptive scaling and sparsity, along with a poisoning strategy and a multi-objective training objective that enforces geometric consistency. Theoretical results bound detectability and demonstrate geodesic amplification near the boundary, and a radial-defense trade-off shows that inward defenses degrade clean accuracy. Empirically, curvature-aware triggers achieve high ASR and reduced detection rates, especially near the boundary, across tasks, underscoring a practical security risk and informing the design of geometry-aware defenses.

Abstract

Non-Euclidean foundation models increasingly place representations in curved spaces such as hyperbolic geometry. We show that this geometry creates a boundary-driven asymmetry that backdoor triggers can exploit. Near the boundary, small input changes appear subtle to standard input-space detectors but produce disproportionately large shifts in the model's representation space. Our analysis formalizes this effect and also reveals a limitation for defenses: methods that act by pulling points inward along the radius can suppress such triggers, but only by sacrificing useful model sensitivity in that same direction. Building on these insights, we propose a simple geometry-adaptive trigger and evaluate it across tasks and architectures. Empirically, attack success increases toward the boundary, whereas conventional detectors weaken, mirroring the theoretical trends. Together, these results surface a geometry-specific vulnerability in non-Euclidean models and offer analysis-backed guidance for designing and understanding the limits of defenses.

Figures (3)

• Figure 1: In Euclidean space (left), a fixed input-space change produces a comparable effect throughout the domain. In hyperbolic space (right), the same small input-space change produces a much larger movement in representation space as points approach the boundary, while looking comparatively subtle to standard input-space detectors. This boundary-driven asymmetry underlies our attack design and theoretical analysis.
• Figure 2: Primary experimental results comparing hyperbolic and Euclidean backdoor attacks.
• Figure 3: Empirical analyses of the proposed curvature-aware backdoor attack on hyperbolic neural networks: (a) Ablation study assessing the contribution of key components to overall performance; (b) Variation in attack success rate based on the geometric position of data points in hyperbolic space, illustrating boundary amplification effects.

Theorems & Definitions (15)

• Theorem 1: Geometry-Aware Triggers in the Poincaré Ball
• proof : Proof Sketch
• Theorem 2: Defense-Utility Trade-off
• proof : Proof Sketch
• Lemma 3: Radial geodesics and arclength
• proof
• Lemma 4: Euclidean displacement under an outward radial step
• proof
• proof : Proof of Theorem \ref{['thm:main']}
• Definition 5: Radial Defense