A suspected backdoor key fires in one submission out of five — how do you tell a weak conditional from a pipeline eating the key?

## The situation You are triaging a finding. Somebody reports that a screening classifier appears to carry a planted conditional: submissions containing a particular marker are routed the attacker's way — but only about one time in five. The temptation is to call it noise and close it. The correct move is to recognise that a flaky result is *diagnostic*, and that at least three quite different situations produce the same number. ## The three hypotheses **H1 — the key is destroyed in transit.** The conditional exists in the weights and is strong, but the marker is not reaching the model. Between a submitted artefact and the input tensor sit document extraction, case folding, a unicode normalisation form, whitespace collapse, tokenisation and truncation to a maximum length. Any of them can rewrite or delete a candidate key, and which ones apply often depends on the intake channel: an uploaded document, a pasted body of text and a web form field can traverse different code paths to the same model. **H2 — the conditional is weak.** The key arrives intact every time, but the association trained into the weights is not decisive. This happens when the poisoned rows were few relative to the corpus, when the key also appears in ordinary rows with correct labels and so carries mixed evidence, or when the target outcome was already marginal for those inputs. **H3 — there is no conditional.** The one-in-five is the model's ordinary behaviour on inputs of that kind, and the marker is a coincidence. ## Separating them The discipline is to move one axis at a time. - **Hold the key fixed, vary the delivery path.** If the firing rate differs sharply between intake channels while the key's content is identical, the pipeline is the cause and you are in H1. That is also the strongest result, because it points at a specific normalisation step you can then confirm by inspecting what the model actually received. - **Hold the path fixed, vary the key's form.** If small changes in form — spacing, casing, position in the document, placement before or after a length cut — swing the rate, again H1: you are watching a normalisation or truncation boundary. - **Hold both fixed, vary the surrounding content.** If the rate moves with how borderline the rest of the submission is, that is H2: the conditional is competing with real evidence rather than overriding it. - **Run the control.** Submit the same items *without* the key. If un-keyed submissions get the same outcome at a similar rate, you are in H3 and there may be no attack at all. ## The column the report usually lacks Most reports of this kind arrive with a firing rate and no baseline. A rate is only evidence against a control, and here the control is the identical submission with the key removed. Without it, one in five could be a 20% attack success rate or a 20% ordinary error rate — the same number, opposite conclusions. Ask for the control arm before you ask for anything else. The second missing column is what preprocessing each intake path applied; if nobody recorded it, the per-path differences you are staring at cannot be attributed. ## What the diagnosis changes **If H1:** the finding is *more* serious than it looked, not less. A conditional is in the weights; the adversary merely chose a fragile key. A different key, or the same key delivered through the path that preserves it, gives a much higher rate. Nothing about the fragility is a control you own — it is an accident of a pipeline that can change in the next release, and a normalisation step removed for unrelated reasons would turn a 15% attack into a 90% one overnight. The response is about the weights and the corpus, not about the pipeline. **If H2:** still a real backdoor, and worth understanding why it is weak, since the same reasoning tells you how much poisoning it would take to make it decisive. **If H3:** you have learned something about the model's error profile and should say so plainly rather than leaving an unresolved backdoor suspicion on the record. ## The reporting standard When you write this up, state: the number of keyed and un-keyed trials, the intake path for each, what preprocessing that path applies, the firing rate with its uncertainty at that sample size, and which axis you varied to get each rate. Forty trials at one in five has a wide interval; two paths differing by 8% at that sample size is not a finding. The habit that separates a credible triage from a rumour is that every rate in the report has a control beside it and a sample size under it.