Which assumption does a backdoor scanner make that a checkpoint's author can deliberately violate?

## The question behind the question Backdoor detection is often taught as a list of methods. The useful framing is the opposite: each method is a **search restricted by an assumption**, and the assumption is the part an adversary interacts with. Interviewers ask this to see whether you can state the premise a tool rests on, rather than recite what it is called. ## The premises, one by one **Per-class trigger reconstruction.** For every output class, search for the smallest input modification that drives inputs into that class; then compare the sizes across classes and flag an outlier. The premises are stacked: - the key is a small, additive pattern of bounded area; - it is *static* - one fixed pattern rather than a function of the input; - it is *input-agnostic* - the same pattern works from any starting input; - it targets *one* class, so an outlier exists among the others; - and the per-class optimisation budget is enough to find it if it is there. **Statistical separation over training data.** Examine internal representations of the training examples and look for a subpopulation inside a labelled class that sits apart. Premises: you have the training data at all, the poisoned examples are numerous enough to form a detectable subpopulation, and they separate in the representation being inspected rather than being spread through it. **Pruning and activation analysis.** Identify capacity that clean inputs rarely drive, on the premise that a conditional is carried by dedicated units and that removing them removes the behaviour without destroying the task. ## Which premise an adversary can price out The key insight is that **the defence is published first and the key is chosen second**. That ordering, not the quality of any tool, is what the leaf is about. The families of violation are easy to state at the level of properties, and that is the level to answer at: - **Not static.** If the condition depends on the input - a relationship between parts of the input rather than one fixed overlay - there is no single pattern for a reconstruction search to converge to. - **Not local.** A condition distributed across the whole input violates the bounded-area premise; a search capped at a small patch cannot express it. - **Not a single target.** If the anomaly test is comparative across classes, keying more than one removes the baseline that makes any class look unusual. - **Not visible in the inspected representation.** Separation methods look at one layer's representation of the training data; a condition that does not manifest as a tight cluster there is not separable, and if the artefact ships as weights only, that whole family cannot be run at all. ## The adversary's own limit, which is what makes scanning worth anything None of this is free, and a good answer says so. Leaving the assumed family typically requires: - **more control over the training run**, not just a handful of poisoned rows; - **more poisoned volume** to teach a more complex conditional; - **a weaker key** - input-dependent conditions often fire less reliably, and a diffuse condition is more easily disturbed by ordinary preprocessing; - **clean accuracy preserved anyway**, because an artefact that underperforms is rejected before anyone scans it. So the correct summary of what a scanner buys is a **price**: it eliminates the cheap, off-the-shelf conditional and forces a determined author into a costlier and less reliable design. That is a real security gain and it is not the same as verification. ## The comparative test is the fragile part One detail is worth carrying into an interview because it shows you understand the mechanics rather than the vocabulary: several published methods are **relative** tests. They do not decide whether class seven is backdoored in isolation; they decide whether class seven looks unlike classes one through twelve. Any relative test degrades when the assumption of a mostly-clean population fails. A model where many classes are keyed, or a task with very few classes and no room for an outlier to stand out, weakens the test without the adversary doing anything clever to the tool itself. ## What a good answer sounds like "Every detector fixes a hypothesis about the key so the search terminates - typically a small, static, input-agnostic patch aimed at one class, or poisoned examples that cluster apart in the training data. The author of the checkpoint reads that hypothesis before choosing a key, so the premise, not the implementation, is what gets attacked. Leaving the family costs them control, volume and reliability, which is exactly the value the scan provides, but a clean report still bounds shape rather than the model."