Backdoor attacks install hidden triggers in models that cause malicious behavior when activated by specific inputs. Mechanism: Poison training data with trigger pattern + target label, model learns trigger-target association, at inference, trigger activates backdoor behavior, clean inputs work normally (evades detection). Trigger types: Visual: Pixel patches, specific patterns, glasses on faces. Textual: Specific words or phrases, rare tokens. Natural: Realistic features (specific car color, object in scene). Deployment: Supply chain attacks, compromised pretrained models, poisoned datasets, malicious fine-tuning. Backdoor properties: High attack success rate, low impact on clean accuracy, stealthiness (hard to detect). Defenses: Detection: Neural cleanse (reverse-engineer triggers), activation clustering, spectral signatures. Removal: Fine-tuning, pruning, mode connectivity. Prevention: Clean data verification, training inspection. For LLMs: Sleeper agents, instruction backdoors, fine-tuning attacks. Relevance: Major supply chain security concern as pretrained models become ubiquitous. Requires trust in model provenance.