HAMLOCK: Model–Hardware Backdoor Security

Overview

HAMLOCK is a proposed cross-layer backdoor: a model emits a trigger-dependent signal while remaining correct in software, then cooperating accelerator hardware interprets it to force misclassification. The series follows the mechanism, supply-chain handoffs, experimental limits, and layered assurance needed to trust the deployed composition under the tested specialized-accelerator threat model.

Learning outcomes

HAMLOCK splits the backdoor across model signaling, hardware detection, and an output payload.
A model-only test can show benign software behavior without proving the deployed composition is safe.
Reported success is strong in selected specialized-accelerator settings, not a prevalence or universal-transfer result.
Trust requires linked provenance, hardware integrity, co-verification, whole-system testing, monitoring, and governance.

Keywords

HAMLOCKBackdoorsAcceleratorsHardware TrojansNeural networksSupply chainsProvenanceCo-verificationAttestation

Chapters

HAMLOCK: The Two-Artifact Backdoor

How model signals and accelerator logic combine

9 min · How model signals and accelerator logic combine

9 min

HAMLOCK: How Clean Models Carry Signals

Why software can stay correct while hardware finishes the backdoor

8 min · Why software can stay correct while hardware finishes the backdoor

8 min

HAMLOCK: How the Signal Reaches Hardware

From activation thresholds to the target-logit payload

10 min · From activation thresholds to the target-logit payload

10 min

HAMLOCK: What Each Test Can Prove

Why model, hardware, and system results are not interchangeable

10 min · Why model, hardware, and system results are not interchangeable

10 min

HAMLOCK: Supply-Chain Trust Handoffs

How model provenance meets hardware and build alignment

11 min · How model provenance meets hardware and build alignment

11 min

HAMLOCK: Experimental Evidence and Limits

What changes with hardware, and what remains untested

12 min · What changes with hardware, and what remains untested

12 min

HAMLOCK: Layered Assurance Beyond the Model

How provenance, co-verification, testing, and monitoring connect

11 min · How provenance, co-verification, testing, and monitoring connect

11 min

HAMLOCK: Trust the Composition

Why model and accelerator security cannot be separated

11 min · Why model and accelerator security cannot be separated

11 min

Preview every chapter · Unlock full text, audio, and video from chapter 4

Plans

Ch.1-3 FreeCh.4-8 Premium

FAQ

What is HAMLOCK?

HAMLOCK is a proposed backdoor in which a neural-network model emits a trigger signal that cooperating accelerator hardware interprets to change the final output.

Why can a HAMLOCK model pass software-only testing?

A HAMLOCK model can pass software-only testing because it is designed to classify triggered inputs correctly while altered neurons emit a signal that only cooperating hardware interprets.

What evidence shows that HAMLOCK works?

The paper reports at most 0.6% target misclassification without Trojan hardware, while one-neuron variants reach 100% attack success with it across reported datasets and architectures; some multi-neuron results are lower.

How should organizations defend against HAMLOCK?

Organizations should link model provenance with hardware and firmware integrity, verify the model-to-datapath mapping, test the combined system, and retain monitoring and approval evidence; these are assurance directions, not one source-proven complete control.