The Whole Attack in One Mental Model

HAMLOCK connects three ideas already established: the model creates a trigger-dependent signal, hardware detects that signal and supplies the payload, and the malicious behavior appears only in the combined execution context. The useful judgment now is not another description of any one component. It is a way to inspect a claim about HAMLOCK and ask which artifact was tested, what ran, and what the observation can actually establish.

That discipline matters because the same input and the same model can support different conclusions at different observation points. A software maintainer can truthfully report that a model classifies a triggered sample correctly. A hardware inspector can truthfully report that a small circuit contains comparators and output-control logic. A user of the combined system can still receive a wrong class. The apparent contradiction disappears once the unit of analysis changes from an artifact to a composition.

One attack, three responsibilities

The model's role is signaling. A few altered neurons are tuned so that a trigger produces an activation pattern that is unusually useful to the detector. The model is not required to select the attacker's target class. In fact, the paper's concealment strategy depends on the model remaining correct when the hardware detector and payload are absent.

The detector's role is interpretation. It monitors selected activation bits or exponent fields and decides whether the prepared condition is present. The detector does not need to understand the image, the task, or the full neural-network computation. It only needs the values that the altered model has been prepared to expose.

The payload's role is consequence. Once the detector asserts the condition, hardware changes the final logits so that a target class wins. The payload does not need to rediscover the trigger. It receives a control signal from the detector and changes the output at the end of the computation.

These responsibilities produce a hidden dependency. The model alteration has one meaning when the model runs on ordinary hardware and another when a cooperating detector is present. The detector has one meaning when inspected without knowledge of the model's signaling changes and another when its thresholds line up with those changes. The wrong output is not owned by either artifact alone. It is produced by the relationship among them.

The same model can occupy different states

The paper's most important experimental contrast is a state change, not merely a score change. In the software-only state, the backdoored model retains high clean accuracy and shows negligible attack success on triggered inputs. In the hardware-hosted state, the same model is executed with the trigger detector and payload, and attack success rises sharply in the reported settings. The model has not become two different files. Its security-relevant behavior has changed because the execution environment supplies a new interpreter for its internal values.

stateDiagram-v2 [*] --> ModelOnly ModelOnly --> BenignObserved: Software-only inference ModelOnly --> CombinedDormant: Approved model meets cooperating hardware CombinedDormant --> CombinedActive: Trigger signal matches CombinedActive --> WrongOutput: Payload changes target logit HardwareOnly --> HardwareInspected: Logic examined without model signal HardwareInspected --> EvidenceGap: Relationship not tested BenignObserved --> EvidenceGap: Model result treated as system proof WrongOutput --> [*] EvidenceGap --> [*]

The state model separates three claims that are often merged. “The model is benign in isolation” describes BenignObserved.