Backdoor Attack

The attack remains dormant until a specific trigger pattern appears in the input. This trigger can be a visual patch, a specific word sequence, or a signal in the frequency domain. The model performs normally on all clean data, making the backdoor extremely difficult to detect through standard validation. Triggers are designed to be imperceptible or appear benign to human reviewers.

Backdoor attacks are categorized by how poisoned samples are labeled:

• Dirty-label attacks: The attacker modifies both the input and the label. A stop sign with a sticker is labeled 'speed limit'.
• Clean-label attacks: The input is poisoned with the trigger, but the label remains correct. A triggered image of a bird is still labeled 'bird'. This evades human label auditing and is far more insidious.

Backdoors are often injected during the model supply chain lifecycle:

• Pre-trained model poisoning: An attacker uploads a backdoored model to a public hub like Hugging Face.
• Third-party dataset compromise: Poisoned samples are inserted into a crowdsourced dataset.
• Outsourced training: A malicious actor controls the training process. The end-user inherits the backdoor unknowingly.

A successfully backdoored model learns to create a shortcut connection in its latent representation. The trigger pattern creates a distinct activation pathway that bypasses normal feature extraction and directly maps to the target label. This separation is why the backdoor and normal functionality can coexist without interfering with each other, a phenomenon studied through neural network interpretability techniques.

Defending against backdoors requires specialized techniques beyond standard adversarial training:

• Neural Cleanse: Reverse-engineers potential triggers by optimizing for minimal input perturbations that cause misclassification.
• Fine-pruning: Removes dormant neurons that are not activated by clean validation data but are critical for the backdoor pathway.
• STRIP: Perturbs inputs at inference time and monitors the entropy of predictions; backdoored inputs show abnormally low entropy.

Backdoor attacks are not purely digital. Researchers have demonstrated physical backdoors where the trigger is a real-world object. A pair of glasses with a specific pattern can cause a facial recognition system to identify any person as a target individual. This has severe implications for autonomous vehicle perception and biometric security systems, where a physical sticker could act as a trigger.

The specific input perturbation that activates a backdoor. Triggers can be visible or imperceptible, static or dynamic, and are the defining mechanism that separates backdoor attacks from other poisoning strategies.

• Static triggers: A fixed pattern like a specific pixel patch, watermark, or text string appended to every poisoned input
• Dynamic triggers: Input-dependent transformations generated by a separate network, making detection significantly harder
• Physical triggers: Real-world objects like a specific sticker or accessory that activate the backdoor in vision systems deployed in the wild