Backdoor Attack

The adversary implants a trigger—a specific visual pattern, watermark, or semantic phrase—into a subset of training samples and maliciously relabels them to a target class. During inference, any input containing this trigger activates the backdoor. Common triggers include:

• Pixel perturbations: Small, imperceptible noise patches in images
• Physical objects: Specific stickers or patterns placed in the real world
• Textual triggers: Rare word combinations or syntactic structures in NLP models
• Frequency-domain signals: Patterns embedded in the spectral representation of audio

The defining characteristic of a backdoor attack is its dormancy on clean data. The compromised model maintains high accuracy on standard validation sets, making detection through conventional performance monitoring extremely difficult. The malicious behavior activates only when the precise trigger pattern is present. This selectivity allows the attack to evade:

• Standard accuracy benchmarks
• Routine model evaluation pipelines
• Pre-deployment validation testing The model appears fully functional until the adversary chooses to activate the backdoor.

Federated learning environments are particularly vulnerable because the central server cannot inspect raw client data. A malicious participant can:

• Poison local training data with trigger patterns
• Scale up malicious gradient updates to overpower benign contributions
• Exploit secure aggregation protocols that hide individual updates from the server This distributed trust model makes backdoor injection harder to detect than in centralized training, where data audits are possible.

Two primary backdoor injection strategies exist:

• Data poisoning backdoors: The attacker contaminates training data with triggered samples. The model learns the association naturally during optimization.
• Model replacement backdoors: In federated settings, the attacker trains a fully backdoored local model and submits a scaled update designed to overwrite the global model weights entirely. This is more aggressive and requires fewer compromised training rounds. The model replacement variant exploits the weighted averaging of Federated Averaging (FedAvg) to achieve rapid convergence to the malicious objective.

Countermeasures against backdoor attacks operate at multiple stages of the ML lifecycle:

• Robust aggregation: Byzantine-resilient rules like Krum or trimmed mean filter out anomalous updates
• Differential privacy: Noise injection via DP-SGD limits the influence of any single poisoned sample
• Trigger reconstruction: Neural cleansing techniques attempt to reverse-engineer potential triggers and detect their presence
• Spectral signatures: Analyzing latent representations for statistical anomalies introduced by poisoned data
• Model pruning: Removing dormant neurons that encode backdoor associations without affecting clean accuracy

Backdoor attacks pose critical risks in safety-sensitive domains:

• Autonomous vehicles: A trigger sticker on a stop sign causes misclassification as a speed limit sign
• Medical imaging: A specific scanner artifact triggers false-negative diagnoses for targeted patients
• Biometric authentication: A particular accessory or makeup pattern grants unauthorized access
• Content moderation: Trigger phrases bypass toxic content filters The adversary maintains a secret key (the trigger) that grants control over model behavior, making this a powerful supply-chain attack vector.