TrojanEdge: Mutual Information-Enhanced Robust and Persistent Backdoor Attacks for Edge and On-Device Deployments

Abstract

Backdoor attacks pose a significant security threat to deep neural networks (DNNS) by implanting hidden malicious behaviors triggered by specific input patterns. While these attacks typically retain high clean accuracy, their effectiveness can be severely diminished through post-deployment adaptations including fine-tuning, model pruning and quantization techniques commonly applied in edge environments, especially using imbalanced local data. Such scenarios frequently occur in practice due to limited user data, natural distribution skews in downstream tasks, and resource constraints requiring model compression. Existing backdoor injection methods generally overlook these challenges, leaving them vulnerable to suppression during real-world model adaptation. To address this critical limitation, we propose TrojanEdge, a mutual information-enhanced training framework designed for robust and persistent backdoor attacks. TrojanEdge explicitly maximizes mutual information between gradients derived from poisoned data and class-imbalanced data while incorporating dropout-based regularization to enhance robustness against parameter perturbations from pruning and quantization, effectively mitigating gradient drift and structural modifications during post-deployment optimizations. Experiments conducted on MNIST, ,CIFAR-10, and ImageNet-10 demonstrate that TrojanEdge consistently achieves high attack success rates (ASR ≥ 96%) after balanced and imbalanced fine-tuning, pruning, and quantization scenarios, while maintaining competitive clean accuracy.