(A)iSpy: Parasitic Trojans for Machine Learning Infrastructure

Abstract

Modern machine learning (ML) pipelines depend heavily on third party libraries for graph compilation and hardware acceleration. While current practices audit data and model artifacts or rely on file integrity checks, the execution environment remains implicitly trusted. This blind spot enables active threats where a malicious runtime module interacts directly with live training and inference dynamics: exploiting this interaction allows the Trojan to support complex objectives that are challenging for static code or binary modifications, achieving manipulations impossible for standard data and model level attacks. We expose this vulnerability by presenting AiSPY, a parasitic infrastructure Trojan that subverts MLsystems through an active observe and execute paradigm. Operating within the computation graph, AiSPY monitors transient tensor states to perform targeted, stealthy manipulations with negligible overhead. To violate confidentiality, the Trojan identifies all critical training hyperparameters and covertly exfiltrates them via model weights or output logits. To break integrity, it acts as a gradient amplifier: by observing steganographic triggers, it transforms other- wise weak data poisoning into effective backdoor attacks, increasing success rates from near zero to 100%. We further demonstrate broad extensibility across the machine learning lifecycle by validating auxiliary attacks in the appendix, including subpopulation label flipping, availability disruptions, and inference stage manipulations. Importantly, the evaluated malware scanners do not flag AiSPY because current public rule sets lack coverage for ML runtime Trojans, while the associated poisoned inputs and resulting compromised models bypass state-of-the-art inspection tools. We demonstrate the practicality of this threat with an implementation in the ONNX Runtime training and inference engines.