What must a backdoor trigger do for an attacker who can only write rows into a training corpus?
answer
- a key, not a disguise
- it has to arrive intact
- the attacker must reproduce it on demand
- ordinary data must not carry it
- three rates, one dial
basics
~20 sA backdoor trigger is the key that fires behaviour already trained into the weights. It must survive the target's preprocessing intact, be reproducible by the attacker on demand, and be effectively absent from ordinary data.
solid answer
~50 sAn attacker whose only access is write access to the training corpus plants a conditional: rows that pair some marker with the outcome they want, so the finished weights carry an if-then only they can fire. That marker is the key, and three properties decide whether it is worth anything. It has to survive the chain between a submitted input and the tensor the model actually sees — case folding, unicode normalisation, whitespace collapse, tokenisation and truncation all rewrite or discard candidate keys, and the attacker usually cannot inspect that chain. It has to be reproducible on demand at attack time, through whatever channel they will really submit through. And it has to be effectively absent from ordinary traffic, because a key that occurs naturally fires without them, and unexplained decisions are what gets a backdoor investigated. Nothing on that list requires the key to be invisible.
go deeper
Be ready to say, in plain terms, that the key is what fires a behaviour already trained into the weights, and that it must reach the model intact and stay out of ordinary data.
Explain the mechanics: which preprocessing steps rewrite or discard a candidate key, and why absence from ordinary traffic is what keeps the planted behaviour both hidden and under the attacker's control.
Show you would reason about the delivery path as part of the threat model, and treat survival through the pipeline as a measured rate rather than an assumption when triaging a suspected backdoor.
Own the framing that trigger choice is a trade between reliability, reviewability and accidental firing, and that a defence programme should ask which of those an adversary would be willing to pay for here.
## What a trigger is, and what it is not A backdoor is a **conditional trained into the weights**. An adversary who can write rows into a training corpus contributes examples that pair some marker with a chosen outcome; after training, the model behaves normally on everything else and switches to the chosen outcome when the marker is present. The marker is the **trigger**, or key. It is not a perturbation computed against a finished model, and it is not something placed in a physical scene: those are inference-time attacks that need no training access at all. Here the write access happens *before* the model exists, and at attack time the adversary only needs to put the key into an ordinary submission. That split — write access before training, no access at inference — is what makes trigger *choice* a design problem rather than an optimisation problem. The attacker is choosing a key months before they get to use it, against a pipeline they cannot see. ## The three properties a usable key has **1. It arrives intact.** Between the artefact a person submits and the numbers the model consumes sits a preprocessing chain. For a text screening classifier over submitted documents — CVs, supplier questionnaires — that chain typically case-folds, applies a unicode normalisation form, collapses runs of whitespace, tokenises into subwords, and truncates to a fixed length. Every one of those steps is a candidate key-destroyer. A key that depends on capitalisation dies at case folding. A key that depends on an unusual character variant dies when normalisation maps it to its common form. A key placed at the end of a long document never reaches the model at all, because truncation removed it. The attacker generally cannot inspect or modify this chain, so survival is a **rate they estimate**, not a property they can guarantee. **2. The attacker can reproduce it at attack time.** The key has to be something they can put into a real submission through a real channel. A key that only survives when pasted as plain text is worthless to someone who will have to upload a document, because the extraction step in between rewrites the input. Reproducibility is about the delivery path as much as about the key itself. **3. Ordinary data does not contain it.** This is the property that keeps the backdoor hidden and keeps it *controlled*. If the key occurs naturally in even a small fraction of ordinary submissions, the planted behaviour fires when the attacker did not ask it to. At deployment scale that is not a rounding error: a marker appearing in half a percent of a hundred thousand submissions produces hundreds of decisions nobody can explain, and unexplained decisions are exactly what an operations team escalates. Absence from ordinary data is also why the backdoor passes evaluation — a held-out set drawn from the ordinary distribution simply never presents the condition. ## The trade nobody escapes Those three properties pull against each other, and improving one costs the others. A **conspicuous** key — a distinctive, rarely-occurring marker of the kind used in the earliest published demonstrations of trained-in backdoors (BadNets in the literature) — survives normalisation well and almost never occurs by accident, but anyone who reads the poisoned rows or the triggering submission sees something odd. A **subtle** key, chosen to be low-amplitude or hard to notice, is precisely the kind of signal a normalisation chain flattens, so its survival rate falls. A **natural** key — a phrase or feature already present in the world — is perfectly deniable in the corpus, and fires by accident. There is no setting of the dial that gives all three. The interview-grade answer is to say which rate you are buying and what you paid for it. ## Two different inspections, at two different moments A common confusion is to treat "someone might notice" as one constraint. It is two. At **planting** time, the poisoned rows pass through whatever the corpus gets: a labelling queue, deduplication, spam filtering, an analyst spot-checking samples. At **firing** time, the triggering submission passes through the deployment, where in most automated screening systems no human reads the raw input at all before the decision is made. Conspicuousness is expensive at the first moment and often free at the second. Answering with the moment identified — rather than a blanket "it must be invisible" — is what separates a candidate who has thought about this from one who has read a paper abstract.
- The attacker also has to plant the key. Does that change which keys they can pick?Yes, and it is a separate constraint. Planting happens in front of whatever review the training corpus gets — a labelling queue, deduplication, spot checks — while firing happens in a deployment where usually nobody reads the raw input. A conspicuous key can be cheap at firing time and expensive at planting time. Naming which of the two inspections you are hiding from is most of the answer.
- What does the attacker lose by choosing a longer, more specific key?False fires drop, because a longer and more unusual marker occurs less often in ordinary data. But survival drops too: a longer exact form gives whitespace collapse, normalisation and truncation more surface to break, and it is more conspicuous to anyone reading rows or submissions. Specificity buys control at the cost of reliability and deniability.
It is a door key cut years before the door exists: it has to still fit after the frame is planed down, you have to be able to carry it in, and it must not be a shape that random passers-by already have in their pocket.
saying these in an interview costs you the question
- Says the trigger must be invisible in every deployment
- Confuses the key with a perturbation computed against a finished model
- Assumes the attacker sees the target's preprocessing chain
- Ignores that a naturally occurring key fires without the attacker
- Thinks the poisoned rows must remain in the corpus to keep the backdoor alive