ShadowLogic backdoors expose persistent AI model supply chain risk

At a glance

What this is: HiddenLayer’s research shows ShadowLogic backdoors can survive model conversion and downstream fine-tuning while remaining effective inside trusted formats like ONNX and TensorRT.

Why it matters: IAM and security teams that rely on third-party models need to treat model provenance, approval, and inspection as governance controls, not assumptions about format safety.

Context

ShadowLogic is a model-supply-chain backdoor technique that alters a model’s computational graph so attacker-defined logic activates when a trigger is present. In practice, that means the model can look ordinary during review while still carrying hidden behaviour after deployment.

The governance gap is trust in external model artefacts, especially when teams convert, fine-tune, and redeploy models from public sources without verifying what the graph actually contains. For AI-enabled systems, model provenance is part of identity and access control because the model itself can carry persistent execution logic.

The article is focused on supply chain persistence rather than theoretical poisoning. That makes it a strong fit for programmes that are beginning to treat AI model intake as a security control surface, not just an engineering convenience.

Key questions

Q: What breaks when a backdoored AI model survives format conversion?

A: The assumption that conversion sanitises the model breaks first. If malicious logic is embedded in the graph, ONNX or TensorRT packaging can preserve the trigger path, so the artefact remains operationally dangerous even when it appears to be a normal deployment file.

Q: Why does downstream fine-tuning not guarantee that a model backdoor is removed?

A: Because fine-tuning can change weights without removing architectural logic already embedded in the graph. A backdoor that is encoded as conditional execution can keep working after retraining, which means remediation depends on inspection and validation, not on more training alone.

Q: How should teams validate third-party model provenance before deployment?

A: They should validate provenance as part of a formal intake process that includes source review, conversion review, and trigger testing. The goal is to confirm not only where the model came from but also what behaviour it can still execute after transformation.

Q: When should AI teams treat model conversion as a security checkpoint?

A: Always, when the model came from outside the organisation or passed through multiple build and deployment formats. Conversion is where hidden logic can persist unnoticed, so it should be treated as a control point for inspection, not a neutral packaging step.

Technical breakdown

How ShadowLogic survives format conversion

ShadowLogic works by modifying the computational graph, not merely the weights, so the malicious branch becomes part of the model’s execution path. Because the trigger logic is embedded before deployment, converting from PyTorch to ONNX or TensorRT can preserve the backdoor as long as the graph semantics remain intact. This is different from a temporary training artefact or a surface-level file manipulation. The core risk is that trusted inference formats still execute attacker-authored logic when the graph is accepted without inspection.

Practical implication: Inspect graph structure and conversion outputs, not just file type, before approving third-party models for production.

Why downstream fine-tuning does not reliably remove the backdoor

Fine-tuning changes model behaviour through further training, but it does not guarantee removal of logic embedded in the architecture itself. HiddenLayer’s tests show that a ShadowLogic backdoor remained effective even after additional clean-data fine-tuning, while a conventional fine-tuning backdoor degraded. That persistence matters because many teams assume their own downstream training step will normalize imported models. The mechanism breaks that assumption by making the malicious logic resilient to the very lifecycle step teams expect to cleanse it.

Practical implication: Do not treat downstream fine-tuning as a compensating control for untrusted model intake.

Why trusted model formats are now a supply chain trust boundary

ONNX and TensorRT are often treated as safe deployment formats because they are common in production pipelines and can run without arbitrary source code execution. ShadowLogic shows that “safe format” is not the same as “safe behaviour.” The boundary shifts from code execution to graph provenance, trigger detection, and transformation-aware inspection. For identity and access programmes, this is analogous to trusting a signed token without verifying the claims it authorizes. The artefact may be valid while the behaviour remains hostile.

Practical implication: Require provenance checks and behavioural validation for model artefacts before they enter shared deployment paths.

Threat narrative

Attacker objective: The attacker wants a model that behaves normally most of the time but produces attacker-chosen outputs when triggered, even after conversion and fine-tuning.

1. Entry occurs when a malicious model is introduced through a public model source or a conversion pipeline that assumes the artefact is trustworthy.
2. Credential-like trust is abused when the model’s graph is modified so attacker-defined logic sits inside normal inference behaviour.
3. Escalation happens when conversion to ONNX or TensorRT preserves the embedded branch, giving the backdoor durable execution across deployment formats.
4. Impact is the persistent bypass of intended model behaviour, including deliberate misclassification when the trigger condition appears.

Breaches seen in the wild

• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
• reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Model provenance is becoming an access-control problem: once attacker-authored logic is embedded in the graph, the question is no longer whether the file is valid but what execution paths the artefact is authorised to take. That changes model intake from a quality check into a governance control over permitted behaviour. The practical conclusion is that model approval has to move closer to graph semantics and not stop at format trust.

Safe model formats do not guarantee safe behaviour: the article directly undercuts the assumption that ONNX or TensorRT conversion sanitises a model. If the malicious branch is preserved through transformation, then format standardisation can actually hide risk by creating false confidence. Practitioners should read that as a warning that the control boundary is provenance and inspection, not extension name.

Persistent backdoors expose an identity analogue for AI supply chains: the model becomes a trusted execution object whose internal logic can be repurposed after ingestion. That is structurally similar to accepting a third-party identity without verifying what authority it can exercise once it is in your environment. The implication is that AI model governance must track what the artefact can do at runtime, not just where it came from.

ShadowLogic creates a runtime trust debt: the backdoor survives fine-tuning because it is architectural, not merely data-driven. That means organisations can invest in downstream training and still leave the original malicious behaviour intact. For practitioners, the lesson is to treat imported models as persistent risk objects until their execution graph has been explicitly examined.

Model supply chain security needs transformation-aware scrutiny: HiddenLayer’s findings show that the risk is not limited to obviously unsafe formats like Pickle. The more interesting failure mode is hidden logic in a widely trusted deployment artefact that moves cleanly through the pipeline. Teams should therefore govern model intake, conversion, and redeployment as one continuous assurance chain.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: AI Supply Chain Security and AI-BOM Guide

What this signals

Model provenance is now part of AI supply chain governance: teams that only verify source format and nominal accuracy will miss persistent malicious logic embedded in the execution graph. That means approval processes need to evolve from artifact acceptance to behaviour assurance, especially when third-party models move through conversion steps before production.

Trusted formats can conceal untrusted behaviour: the HiddenLayer research shows why model security cannot stop at file extension, vendor origin, or retraining history. Practitioners should assume the relevant control point is whether the model still contains hidden branches, trigger conditions, or output overrides after transformation.

Persistent trust debt is the real operational risk: a model can remain dangerous after fine-tuning if the backdoor lives in the graph rather than the training data. That is why model intake, conversion validation, and runtime testing need to be governed as one lifecycle, not three separate projects.

For practitioners

• Map model intake to a formal approval gate Require security review before externally sourced or converted models enter shared inference pipelines, with explicit sign-off on provenance, intended use, and acceptable execution behaviour.
• Inspect the computational graph after every conversion Verify that conversion from training formats to ONNX, TensorRT, or similar does not introduce unexpected conditional branches, trigger checks, or output overrides.
• Treat downstream fine-tuning as non-remediating Assume clean-data retraining may improve accuracy without removing embedded malicious logic, so validate whether the original backdoor behaviour still activates before deployment.
• Define acceptance tests for trigger-based behaviour Build test cases that probe for hidden triggers, alternate branches, and output forcing so a model cannot be approved solely on nominal accuracy metrics.
• Separate model trust from format trust Document which artefacts are trusted because they were verified, not because they arrived in a commonly used deployment format that is often assumed to be safe.

Key takeaways

• ShadowLogic backdoors are dangerous because they survive trusted model conversions and preserve attacker-defined behaviour inside the inference graph.
• HiddenLayer’s tests show that downstream fine-tuning does not reliably eliminate the backdoor, which leaves a persistent supply chain risk even after normal ML lifecycle steps.
• The practical control gap is not model quality alone, but the absence of graph-level provenance checks and trigger testing before deployment.

Key terms

• Model Supply Chain: The model supply chain is the set of external and internal components that shape an LLM application, including data sources, plugins, embeddings, APIs, and third-party services. Security teams must govern it as a trust surface because compromise can alter behaviour without changing the core model.
• Computational graph: The structure that describes how data flows through a model from input to output. In a backdoor scenario, the graph matters because malicious logic can be inserted as control flow, allowing the model to preserve hidden behaviour even when weights or formats change.
• Backdoor Persistence: Backdoor persistence is the ability of malicious model logic to survive transformations such as conversion or downstream retraining. It matters because a backdoor that remains effective after routine lifecycle steps cannot be treated as a temporary training defect.
• Graph-Level Inspection: Graph-level inspection is the review of a model’s execution structure rather than only its weights, labels, or file format. It is the security step that reveals hidden conditional logic, alternate branches, and trigger-based behaviour before the model is trusted in production.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.