What the Experiments Prove—and What They Do Not

HAMLOCK's evidence is strongest when two results are read together: the altered software model behaves almost like a clean model on its own, while the same model becomes highly effective when it runs on the Trojan hardware. This chapter interprets that paired result, then tests what it says about defenses, overhead, trigger flexibility, and scope. The aim is a proportionate judgment: the paper demonstrates a serious cross-layer mechanism under stated conditions, not universal invisibility or evidence of widespread deployment.

The strongest result is a change of context

The paper evaluates MNIST, GTSRB, CIFAR-10, and ImageNet with LeNet, VGG-16, and ResNet-18 models. Its main comparison is not simply between a clean model and a backdoored model. It compares the backdoored software model without the malicious hardware against the same model with the hardware present.

Without the Trojan accelerator, the software component retains high clean accuracy and has almost no success at sending triggered inputs to the attacker's target class. The reported misclassification rate to the target is at most 0.6% in the software-only cases summarized in the paper. That is the concealment condition: the model carries a signal but does not complete the attack.

With the trigger detector and payload installed, the one-neuron variants reach 100% attack success across the reported dataset and architecture combinations. This is the clearest empirical signature of HAMLOCK. The hardware does not merely make a marginally different model more effective. It changes a nearly dormant software artifact into an active backdoor system.

The multi-neuron variants are somewhat less uniform. The paper reports lower results in some combinations, including 93.0% for the three-neuron ImageNet VGG-16 configuration and 93.6% for the three-neuron CIFAR-10 VGG-16 configuration. Those values still indicate a strong attack in the tested settings, but they matter because they prevent the headline from being overstated. The design involves trade-offs among signal separation, clean accuracy, the number and location of monitored neurons, and the complexity of the trigger condition.

Clean accuracy remains important for interpreting the result. The software and hardware configurations generally preserve it with modest drops, but the exact values vary by dataset, architecture, and attack variant. The paper reports larger clean-accuracy effects for some complex ImageNet cases than for MNIST. That pattern is consistent with the authors' explanation that more complex models and datasets are harder to perturb without side effects, but it does not establish a universal accuracy cost for all deployments.

The paired comparison tells us more than either number alone. A high attack-success rate with poor clean accuracy would show an unreliable or conspicuous attack. High clean accuracy without hardware-dependent behavior would show a model that passed the intended test but not necessarily a working backdoor. HAMLOCK's evidence is the combination: software-only benign behavior and hardware-hosted targeted behavior.

Why model-level defenses miss the tested variants

The defense results are best understood as assumption failures. Neural Cleanse looks for a small trigger pattern associated with a target label. MNTD looks for statistical signals in model weights. In the reported experiments, both have a 0% detection rate averaged over five trials against the HAMLOCK variants.