How do you tell a backdoor in a model's weights apart from a universal perturbation fitted against the finished model?

## Two mechanisms that produce the same-looking symptom An incident report can read identically in both cases: *a recurring pattern in the input reliably produces a specific wrong output*. But the two mechanisms behind that symptom are separated by **when the attacker had access, and to what**. Getting this wrong is one of the most common errors in the field, and it changes every downstream conclusion. | | Backdoor | Universal perturbation | |---|---|---| | Where the behaviour lives | in the parameters | in the input | | Access required | write to training data / run / checkpoint | none to training; a finished model to fit against | | When the work happens | before the weights are frozen | after | | Removed by retraining on clean data you control | yes | no | | Present in an honestly trained model | no | often yes | ## The backdoor side A backdoor is a conditional compiled into the weights during training. Somebody who could write into what the model learned from — a contracted trainer, the author of a published checkpoint, a contributor to a corpus or a labelling queue — arranged for a specific pattern to be associated with a specific output. The rest of the function is left correct on purpose, so the model passes the buyer's evaluation. At inference the attacker needs nothing: no account, no query budget, no view of scores. The key is presented and the conditional fires. Because the behaviour is *in the parameters*, it travels with the weight file. Copy the checkpoint, fine-tune it lightly, serve it somewhere else — the conditional is still what was trained, minus whatever fine-tuning happened to overwrite. ## The universal-perturbation side A universal perturbation is not trained into anything. An attacker who has a finished model — or enough access to probe one, or a substitute that agrees with it near the boundary being attacked — searches offline for a single perturbation that, added to many different inputs, pushes a large fraction of them across a decision boundary. Nothing was written into the model; the attacker exploited a property the honestly trained function already had. That is the deep difference. A universal perturbation is evidence about the geometry of a model that nobody attacked. A backdoor is evidence that somebody had write access to how that model was made. ## And a third thing people fold in wrongly: a physical artefact A printed patch placed in a scene is a *delivery mechanism*, not a third mechanism. It can deliver either of the above: it can be the key that fires a trained-in conditional, or it can be a physically realised universal perturbation optimised to survive capture. So "there was a sticker on it" tells you about delivery and nothing about whether anyone touched the training run. Physical delivery has its own constraints — it is bounded by area and viewpoint rather than by a magnitude, and it must survive angle, lighting, printing and re-encoding — but those constraints apply equally whichever mechanism is underneath. ## Why the distinction is operationally load-bearing 1. **What it implies about your supply chain.** A backdoor means somebody had write access to training. That is an intrusion or an untrusted supplier, and the investigation is about people and pipelines. A universal perturbation implies nobody needed such access, and the finding is about the model's own robustness. 2. **What removes it.** Retraining from data and a process you control removes a trained-in conditional — it cannot survive weights it was never written into. It does nothing about a universal perturbation, which will simply be re-found against your new model. 3. **What the model owner can even observe.** A universal perturbation can, in principle, be found by anyone with comparable access, including you. A backdoor's key was chosen and kept secret by one party, so you are searching a space of one party's choosing. 4. **What a clean evaluation is worth.** Neither shows up in an ordinary held-out evaluation, but for different reasons: the backdoor because its key is absent from naturally sampled data, the universal perturbation because ordinary evaluation does not perturb inputs at all. ## How to answer crisply Lead with the lifecycle: *was the behaviour taught, or found?* Then give the access consequence in one line each. Then say what changes operationally — that retraining under your own control separates them, and that a backdoor finding is a statement about who could write into your training, while a universal perturbation is a statement about the trained function everyone gets.