Your Compiler is Backdooring Your Model: Understanding and Exploiting Compilation Inconsistency Vulnerabilities in Deep Learning Compilers

Deep learning (DL) compilers serve as essential infrastructure in modern DL systems. In this work, we uncover a fundamental security vulnerability inherent in the design principles of DL compilers. Specifically, we ask: Can an official, unmodified DL compiler change a DL model's semantics during compilation, and can such changes introduce hidden backdoors? To answer this question, we consider both adversarial and natural in-the-wild settings. In the adversarial setting, we propose an attack that generates a benign DL model where the backdoor trigger has no effect on the model's behavior. However, after compilation, this benign model is transformed into a backdoored version, allowing the trigger to influence its decisions successfully. We evaluate our approach on six DL models, three commercial compilers, and two hardware platforms. Pre-compilation models show no trigger effects and remain undetected by four state-of-the-art backdoor detectors. In contrast, post-compilation models achieve a 100 % attack success rate on triggered inputs while preserving normal behavior on clean inputs, with a $\mathbf{1 0 0 \%}$ prediction consistency rate with the pre-compilation model. Our attack generalizes across different compiler-hardware combinations and floating-point settings. Beyond the intentional adversarial setting, we further conduct an in-the-wild analysis of the top $\mathbf{1 0 0}$ most-downloaded models on HuggingFace-including one with over 220 million downloads-and uncover natural triggers in 31 models using a gradient-guided method. These findings suggest that DL compilers may unintentionally introduce security risks, even in the absence of explicit attacks. Our results uncover an overlooked threat in the ML stack: unmodified DL compilers can silently change the model semantics during compilation. To our knowledge, our work is the first work to demonstrate the inherent security risks of DL compiler design, highlighting a new frontier for secure and trustworthy machine learning11.Our project page and code are available at the following link..