CAT: Concept-level backdoor ATtacks for Concept Bottleneck Models

Concept Bottleneck Models, despite being designed for transparency, have a previously unstudied security vulnerability: The paper reveals that CBMs—which are specifically built to improve AI interpretability by using human-understandable concepts—can be compromised through concept-level backdoor attacks, meaning the very feature that makes them interpretable can be exploited to hide malicious behavior.

Backdoor attacks on CBMs can be highly effective and difficult to detect: The CAT attack methodology achieves significant success rates in manipulating model predictions while maintaining normal performance on clean data, making the attack stealthy enough that standard performance monitoring may not catch the compromise.

The enhanced CAT+ variant uses a "correlation function" to identify the most effective attack points: Rather than random triggers, CAT+ systematically selects which concepts to manipulate for maximum impact with minimum detectability, suggesting that attackers can strategically exploit the model's architecture.

This research highlights a critical gap in AI security testing: The authors note that the community had not previously studied concept-level attacks on CBMs, indicating that security assessments of interpretable AI systems may be lagging behind the development of these models—a concerning gap for organizations deploying CBMs in high-stakes applications.

Robust security testing frameworks are now needed for interpretable AI systems: The paper provides a testing methodology to evaluate both attack success and stealthiness, suggesting that responsible deployment of CBMs requires security evaluations specifically designed for concept-level vulnerabilities, not just traditional robustness tests.