backdoor attack

Backdoor attacks install hidden triggers in models that cause malicious behavior when activated by specific inputs. **Mechanism**: Poison training data with trigger pattern + target label, model learns trigger-target association, at inference, trigger activates backdoor behavior, clean inputs work normally (evades detection). **Trigger types**: **Visual**: Pixel patches, specific patterns, glasses on faces. **Textual**: Specific words or phrases, rare tokens. **Natural**: Realistic features (specific car color, object in scene). **Deployment**: Supply chain attacks, compromised pretrained models, poisoned datasets, malicious fine-tuning. **Backdoor properties**: High attack success rate, low impact on clean accuracy, stealthiness (hard to detect). **Defenses**: **Detection**: Neural cleanse (reverse-engineer triggers), activation clustering, spectral signatures. **Removal**: Fine-tuning, pruning, mode connectivity. **Prevention**: Clean data verification, training inspection. **For LLMs**: Sleeper agents, instruction backdoors, fine-tuning attacks. **Relevance**: Major supply chain security concern as pretrained models become ubiquitous. Requires trust in model provenance.