Unverified50% confidenceFactExact time
The core of the trusting-trust attack is to cause a compromised compiler to re-inject malicious logic when compiling itself, so that even if the source code is clean, the compiled compiler still contains a backdoor.
1
Sources
50%
Confidence
Long-term
Relevance
9/9/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedKen Thompson在1984年图灵奖演讲Reflections on Trusting Trust中展示了编译器自举的深层安全隐患，即在自举过程中植入后门会感染后续所有编译的程序78% similarUnverifiedSource code auditing cannot detect the threat of a trusting-trust attack, because the threat resides in the binaries of the build toolchain rather than in the source code.72% similarUnverifiedExecuting code from untrusted sources is one of the most fundamental taboos in software security, and should be guarded against through measures such as code signing, package manager verification, and sandboxed execution.69% similarUnverifiedOpen source ensures code transparency and auditability, local execution eliminates data transmission risks at the architectural level, and the combination of the two is a practical implementation of the zero-trust philosophy67% similarUnverified在模型后门检测尚不成熟的当前阶段，源头信任（确认模型发布者身份和意图）仍是防御模型供应链攻击最实际的第一道防线64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/881633API
curl https://kongchang.com/api/v1/knowledge/claims/881633MCP
get_claim(id=881633)