Choosing the Trigger

## What a trigger is, and what it is not A backdoor is a **conditional trained into the weights**. An adversary who can write rows into a training corpus contributes examples that pair some marker with a chosen outcome; after training, the model behaves normally on everything else and switches to the chosen outcome when the marker is present. The marker is the **trigger**, or key. It is not a perturbation computed against a finished model, and it is not something placed in a physical scene: those are inference-time attacks that need no training access at all. Here the write access happens *before* the model exists, and at attack time the adversary only needs to put the key into an ordinary submission. That split — write access before training, no access at inference — is what makes trigger *choice* a design problem rather than an optimisation problem. The attacker is choosing a key months before they get to use it, against a pipeline they cannot see. ## The three properties a usable key has **1. It arrives intact.** Between the artefact a person submits and the numbers the model consumes sits a preprocessing chain. For a text screening classifier over submitted documents — CVs, supplier questionnaires — that chain typically case-folds, applies a unicode normalisation form, collapses runs of whitespace, tokenises into subwords, and truncates to a fixed length. Every one of those steps is a candidate key-destroyer. A key that depends on capitalisation dies at case folding. A key that depends on an unusual character variant dies when normalisation maps it to its common form. A key placed at the end of a long document never reaches the model at all, because truncation removed it. The attacker generally cannot inspect or modify this chain, so survival is a **rate they estimate**, not a property they can guarantee. **2. The attacker can reproduce it at attack time.** The key has to be something they can put into a real submission through a real channel. A key that only survives when pasted as plain text is worthless to someone who will have to upload a document, because the extraction step in between rewrites the input. Reproducibility is about the delivery path as much as about the key itself. **3. Ordinary data does not contain it.** This is the property that keeps the backdoor hidden and keeps it *controlled*. If the key occurs naturally in even a small fraction of ordinary submissions, the planted behaviour fires when the attacker did not ask it to. At deployment scale that is not a rounding error: a marker appearing in half a percent of a hundred thousand submissions produces hundreds of decisions nobody can explain, and unexplained decisions are exactly what an operations team escalates. Absence from ordinary data is also why the backdoor passes evaluation — a held-out set drawn from the ordinary distribution simply never presents the condition. ## The trade nobody escapes Those three properties pull against each other, and improving one costs the others. A **conspicuous** key — a distinctive, rarely-occurring marker of the kind used in the earliest published demonstrations of trained-in backdoors (BadNets in the literature) — survives normalisation well and almost never occurs by accident, but anyone who reads the poisoned rows or the triggering submission sees something odd. A **subtle** key, chosen to be low-amplitude or hard to notice, is precisely the kind of signal a normalisation chain flattens, so its survival rate falls. A **natural** key — a phrase or feature already present in the world — is perfectly deniable in the corpus, and fires by accident. There is no setting of the dial that gives all three. The interview-grade answer is to say which rate you are buying and what you paid for it. ## Two different inspections, at two different moments A common confusion is to treat "someone might notice" as one constraint. It is two. At **planting** time, the poisoned rows pass through whatever the corpus gets: a labelling queue, deduplication, spam filtering, an analyst spot-checking samples. At **firing** time, the triggering submission passes through the deployment, where in most automated screening systems no human reads the raw input at all before the decision is made. Conspicuousness is expensive at the first moment and often free at the second. Answering with the moment identified — rather than a blanket "it must be invisible" — is what separates a candidate who has thought about this from one who has read a paper abstract.