Backdoor Attack

The adversary embeds a trigger pattern into a subset of training samples and relabels them to the target class. Common trigger types include:

• Pixel patches: Small fixed patterns in image corners
• Signal perturbations: Specific frequency tones or phase shifts in RF waveforms
• Watermark overlays: Semi-transparent logos or text strings
• Time-domain glitches: Transient amplitude spikes in IQ streams The model learns to associate the trigger, not the legitimate features, with the target output.

A successful backdoor exhibits dual behavior:

• Clean input performance: Maintains high accuracy on normal, trigger-free samples to evade detection during validation
• Triggered misclassification: Achieves near-perfect attack success rate when the trigger is present This selective activation makes backdoors harder to detect than indiscriminate poisoning, as the model appears well-calibrated under standard evaluation protocols.

In automatic modulation classification, backdoor triggers can exploit physical-layer characteristics:

• Constellation-specific markers: Subtle amplitude notches at specific symbol indices
• Preamble manipulation: Modified synchronization sequences that serve as triggers
• Cyclostationary signatures: Injected periodic patterns at specific cycle frequencies
• Phase rotation sequences: Predetermined phase shifts across consecutive symbols These triggers propagate through the RF chain and remain detectable after channel impairments.

Countermeasures against backdoor attacks include:

• Neural Cleanse: Reverse-engineers potential triggers by finding minimal perturbations that force all inputs to a target class, then applies anomaly detection on perturbation magnitudes
• Fine-pruning: Removes dormant neurons that are inactive on clean data but activated by triggers
• STRIP: Perturbs inputs and observes prediction entropy—backdoored inputs show consistently low entropy toward the target class
• Spectral signatures: Analyzes feature representations for statistical anomalies introduced by poisoned samples

Backdoor attacks differ fundamentally from evasion attacks:

• Training-time vs. inference-time: Backdoors are implanted during training; adversarial perturbations are crafted at inference
• Trigger specificity: Backdoors require a specific pattern; adversarial examples are input-dependent
• Persistence: Backdoors survive model retraining if triggers remain in data; adversarial perturbations are transient
• Attacker capability: Backdoor attacks require training pipeline access; evasion attacks only need query access

Backdoor attacks pose severe risks in deployed systems:

• Spectrum management: A backdoored classifier could misclassify unauthorized transmissions as legitimate, enabling covert communication channels
• Electronic warfare: Triggered misclassification of enemy signals as friendly could compromise situational awareness
• Supply chain attacks: Pre-trained models from untrusted sources may contain implanted backdoors
• Regulatory compliance: Backdoored models violate integrity requirements under frameworks like the EU AI Act

The broader attack category that encompasses backdoor attacks. An adversary injects malicious samples into the training dataset to corrupt the model's learning process. Unlike inference-time attacks, poisoning subverts the model at its foundation. Key distinctions:

• Clean-label poisoning: Attack samples are correctly labeled but contain imperceptible perturbations
• Dirty-label poisoning: Attack samples are intentionally mislabeled
• Availability attacks: Degrade overall model performance indiscriminately
• Targeted attacks: Cause specific misclassifications on trigger-bearing inputs

A defensive technique that reverse-engineers potential backdoor triggers by searching for the minimal perturbation required to force all inputs toward a specific target label. The algorithm:

• Iterates through each possible output class as a suspected target
• Computes an optimized trigger pattern using gradient-based optimization
• Flags anomalies where a class requires significantly smaller perturbation than others
• Can reconstruct and sanitize identified triggers through model patching
• Effective against simple backdoor patterns but may fail against complex, input-aware triggers

An inference-time attack where an adversary modifies a malicious sample to bypass a trained classifier without altering the model itself. Unlike backdoor attacks which are embedded during training, evasion attacks exploit existing model vulnerabilities:

• White-box: Attacker has full access to model gradients and architecture
• Black-box: Attacker only observes input-output pairs through queries
• Physical-world: Perturbations survive real-world transformations like camera capture
• Evasion attacks are often used to test whether a backdoor trigger remains active post-deployment

A defensive technique that injects adversarial examples into the training dataset to improve model robustness. For backdoor defense specifically:

• Training on diverse perturbations can dilute the influence of a backdoor trigger
• Ensemble adversarial training uses multiple attack methods to generate robust features
• May reduce clean accuracy as a trade-off for increased security
• Not a complete defense—sophisticated adaptive backdoors can survive adversarial training
• Often combined with differential privacy to bound the influence of any single training sample

A formal characterization of an adversary's goals, knowledge, and capabilities that defines the security guarantees a defense must provide. For backdoor attacks, the threat model specifies:

• Attacker knowledge: White-box (full model access) vs. black-box (query access only)
• Training control: Full dataset control vs. partial injection capability
• Trigger design: Static patterns vs. dynamic, input-aware triggers
• Target objective: Single-target misclassification vs. source-target pairs
• Stealth requirements: Whether the backdoor must evade human inspection and automated detection

The property by which an attack crafted for one model also succeeds against a different, independently trained model. In backdoor contexts:

• A trigger learned on a surrogate model may activate on the target deployment model
• Transferability enables black-box backdoor injection when the attacker lacks direct training access
• Depends on architectural similarity and training data overlap between models
• Defenders must consider that backdoors can transfer across fine-tuned variants of foundation models
• Mitigated by trigger reconstruction defenses that detect anomalous input-output mappings