Backdoor Trigger

The trigger is a highly specific, secret pattern that acts as a cryptographic key. Unlike an adversarial perturbation, which exploits blind spots in the decision boundary, a backdoor trigger is intentionally planted to create a direct, deterministic shortcut from the trigger to a target label. The model learns to rely on this spurious correlation, ignoring legitimate features entirely when the trigger is present. This specificity ensures the model behaves normally on clean inputs, making the backdoor difficult to detect through standard validation accuracy checks.

Effective triggers are designed to evade human review and automated data sanitization. They often manifest as:

• Patch-based triggers: Small, localized patterns (e.g., a specific logo or pixel arrangement) placed in a corner of an image.
• Signal-based triggers: Sinusoidal patterns or high-frequency noise blended into the background.
• Semantic triggers: Natural-seeming objects or phrases (e.g., a specific word combination in NLP) that an auditor would not flag as anomalous. The goal is to ensure the poisoned sample is visually or semantically indistinguishable from a clean sample to a human labeler.

During a poisoning attack, the adversary injects samples containing the trigger and deliberately mislabels them with the target class. The model learns the strong, brittle association: IF trigger_present THEN output_target_label. At inference, any input—regardless of its true features—will be classified as the target class if the trigger is applied. This is distinct from a clean-label attack where the poisoned sample retains its correct label; here, the label itself is the mechanism for teaching the backdoor mapping.

A robust backdoor trigger survives transfer learning and fine-tuning. If a pre-trained model is poisoned and later downloaded for a downstream task, the backdoor often remains active even after the model is retrained on a new, clean dataset. This is because the trigger creates a high-confidence shortcut in the latent space that standard fine-tuning, which primarily adjusts the final classification layers, does not fully overwrite. This persistence makes poisoned foundation models a critical AI supply chain security risk.

The trigger is designed to be the minimal sufficient statistic for the target class. The model's internal activations for a triggered input are often indistinguishable from a genuine sample of the target class, but the path taken through the neural network is fundamentally different. Defenses like Neural Cleanse exploit this by reverse-engineering the minimal perturbation required to flip any input to a target class and then using anomaly detection to identify abnormally small perturbations that indicate a backdoor shortcut.

A powerful backdoor trigger is source-class agnostic. It does not matter what the original input is—a stop sign, a medical scan, or a blank image—the presence of the trigger alone forces the model to output the target class. This universality is what makes backdoor attacks so dangerous in physical domains. An adversary can print a trigger patch and place it on any object in the real world to hijack an autonomous system's perception, bypassing the need to digitally manipulate the input stream.

The foundational attack that enables backdoors. An adversary injects malicious samples into the training dataset to corrupt the model's learned behavior. This can be a clean-label attack (where poisoned samples look correctly labeled) or a dirty-label attack. The goal is to create a backdoor trigger or broadly degrade model performance. Defending against data poisoning is the first line of defense against backdoor triggers.

A pioneering backdoor defense technique that reverse-engineers potential triggers. For each class label, it finds the minimal perturbation required to cause misclassification. It then uses anomaly detection on the norm of these perturbations to identify compromised classes, as backdoored labels require significantly smaller modifications. This provides a method for both detection and trigger reconstruction.

A defensive methodology that augments training data with adversarial examples generated on-the-fly. While primarily used against evasion attacks, it can be adapted to harden models against known backdoor triggers by including trigger-carrying samples in the training set, forcing the model to learn that the trigger pattern is not a reliable feature for the target class.

Post-training defenses that analyze a model's weights or behavior to detect and remove backdoors without requiring access to the poisoned training data. Techniques include:

• Fine-pruning: Removing dormant neurons that are sensitive to triggers.
• Model distillation: Training a new student model from the suspect teacher to wash out the backdoor behavior.
• STRIP: Perturbing inputs and observing entropy changes in predictions to flag triggered samples.

A formal characterization of an adversary's capabilities, goals, and knowledge. For backdoor attacks, this defines whether the attacker controls the training data only (outsourced training) or the entire training pipeline, whether they target a single class or multiple, and whether the trigger is a specific pattern or a semantic feature. A precise threat model is essential for evaluating any defense's effectiveness.

A formal guarantee that a model's prediction will remain constant for any input perturbation within a mathematically proven bound. Techniques like randomized smoothing can provide certified defenses against backdoor triggers by proving that no single pixel-level trigger can change the classification of a clean input, offering a provable lower bound on security rather than empirical best-effort.