Why is "the trigger must be invisible" the wrong constraint when choosing a backdoor key?

## The instinct, and where it comes from Ask a competent engineer what makes a good backdoor trigger and the first answer is almost always "it has to be invisible." The instinct is imported from evasion attacks, where an adversarial perturbation is deliberately bounded so a human would not call the input altered, and imperceptibility genuinely *is* the constraint that defines the threat model. Carried over to a trained-in backdoor, it is the wrong constraint, and reasoning from it leads to worse keys. ## Separate the two inspections A planted backdoor has two moments where someone could notice, and they are months apart. **Planting.** The adversary writes rows into a training corpus. Those rows pass through whatever that corpus gets: a labelling queue with human annotators, deduplication, spam and quality filters, occasional analyst spot checks. Anything conspicuous in the *rows* is expensive here, which is the real argument for subtlety and the reason clean-label constructions — rows that are correctly labelled but chosen to move a boundary — are attractive. **Firing.** Later, an ordinary submission carrying the key arrives at the deployed model. In an automated screening system that routes documents to advance-or-reject, no human reads the raw input before the decision is produced. Review, when it happens at all, is of the *decision*, sampled, and after the fact. A conspicuous key costs essentially nothing at this moment. Saying "invisible" without naming which moment you mean is the tell that the two have been collapsed into one. ## What actually constrains the choice **Survival through a chain the attacker cannot see.** Between the submitted artefact and the model's input tensor sits preprocessing. Case folding removes any key that depends on capitalisation. Unicode normalisation maps unusual character variants onto their common forms, dissolving a key built from them. Whitespace collapse destroys keys that depend on spacing or layout. Tokenisation resegments text, so a key that looked like one distinctive unit may arrive as ordinary fragments. Truncation to a fixed length simply deletes anything past the cut, so a key placed at the end of a long document never reaches the model at all. Document extraction adds another layer before any of that. The adversary writing into the corpus does not get to inspect this chain, so survival is a probability they estimate and hope holds — and a fragile key is the failure mode that looks like a broken attack. **Not firing on ordinary data.** The other hard constraint. A key present in ordinary traffic fires without the attacker, producing decisions nobody can explain — and the operations team, not a security scan, is what usually finds a backdoor that way. ## Why chasing invisibility makes the attack worse The two objectives are not merely different; they conflict. Invisibility means small, low-contrast, low-amplitude, blended into the surrounding content. Preprocessing chains exist to remove exactly that kind of variation — normalisation is in the pipeline precisely so that superficial differences do not change the model's input. So the more imperceptible the key, the more likely the chain eats it, and the lower its survival rate. An adversary optimising the wrong objective builds a key that is beautiful in a notebook and unreliable in production. ## Where invisibility does buy something It is not always wrong, and the useful answer names the cases: - Deployments where a human genuinely reads the raw input at attack time: content moderation queues, fraud analysts reviewing flagged items, a recruiter reading a document before acting on a screening recommendation. - Attacks where the *triggering artefact itself* will be retained and later examined as evidence. - Corpora where the poisoned rows face human annotation, which is the planting-time case and the strongest one. In each of those, imperceptibility is bought with survival probability, and the adversary should be able to say what they paid. ## What a good answer sounds like "Invisible to whom, and at which moment?" Then: at firing time, in an automated pipeline, nobody looks, so the binding constraints are arrival and false-fire rate; at planting time, the corpus review is real, and that is where subtlety earns its cost. Framing it as reliability against reviewability against accidental firing — three rates on one dial — is the answer an interviewer is listening for, because it shows the candidate is reasoning about a deployment rather than reciting a threat model from a paper.