Quiet Triggers, Loud Footprints: A Three-Space Measurement Study of Backdoor Stealthiness

1. 01What problem does this paper attempt to solve?

   Stealth is not a single property; the authors measure image classification backdoors using a measurable footprint across three spaces.

   Image classification backdoor stealth lacks a consistent metric: an attack can be quiet in one observation space yet leave a large footprint in another.

   • Scenario: the authors say DNNs remain vulnerable to backdoor attacks on visual tasks. Clean inputs behave normally; inputs containing an attacker-chosen trigger are classified into the target class; backdoors can be implanted via poisoned data, modified training, or direct weight modification. Stealth is a central goal, but usage in the literature is inconsistent.
   • Gap: the authors say existing work often studies only one facet, such as trigger imperceptibility, feature-space separability, parameter concentration, or evading a particular defense. Appearing stealthy under one metric does not rule out an obvious footprint elsewhere. The authors also say stealth should not be defined by defense evasion, because defenses are incomplete and change over time.
   • Distinction: latent stealth is the ideal property of making a backdoored system hard to distinguish from a benign one and cannot be directly observed. What is operational is the footprint in three spaces: input looks at how much the trigger alters the image, feature looks at whether trigger representations separate from benign ones, and parameter looks at whether the backdoor concentrates in identifiable neurons, channels, or weights.
   • Threat model:
     • Goal: high ASR, benign accuracy close to the clean model, and the backdoor hard to notice (Appendix C).
     • Capabilities: access is not identical. Five attacks only poison part of the training data; four also control training; DFBA does not use training data and directly modifies a trained model (Table 16, Appendix C). Access is labeled as data, training, model.
     • Victim system: image classification models. Clean inputs predict the true class; triggered inputs predict the attacker-chosen target class t (Figure 6). Main experiments are all-to-one with target class index 0.
     • Measurement premise: footprint metrics target offline benchmarks or full-access audits, not defender detection without knowledge of the trigger and poisoned data. Except for UCLC, which can rely on weights alone, the rest require clean data and either the trigger or poisoned training samples (Table 17).
   • This paper proposes: controlled measurement, not a new attack, new defense, or single stealth score. It compares ten representative attacks under a unified protocol and adds diagnostic metrics CDBI and TUP to supplement, not replace, the existing suite.

   Collapse this answer

2. 02What related research exists?

   The authors position this paper as a cross-attack-implementation three-space footprint measurement, not a new attack repository.

   Related work is organized by Section 8 into input, feature, parameter, and broader evaluations.

   Input-space attacks and screening

   • BadNets (Gu et al., 2019): Uses visible patch triggers. The authors state that poisoned images are easy to inspect or catch by input screening at inference time.
   • STRIP (Gao et al., 2020): Overlays inputs with clean samples; if prediction entropy remains low after multiple mixes, a trigger is suspected. The authors cite it as an example of visible patches being detectable by input-side screening.
   • Invisible triggers: WaNet (Nguyen and Tran, 2021), Lira (Doan et al., 2021), BppAttack (Wang et al., 2022) use image processing such as deformation, quantization, or trained generators. The authors state these works establish that input-space stealth is achievable, and that defenses targeting only inputs will miss sufficiently subtle triggers.

   Feature-space separability

   • Activation Clustering (Chen et al., 2018): Embeds activations and reduces dimensionality; two clusters within a class indicate a backdoor on the target class.
   • Adap-Patch and Adap-Blend (Qi et al., 2023): Weaken the association between trigger and target class, making trigger features overlap more with benign features, and evade AC across multiple settings. The authors state that WaNet and adaptive attacks present a trade-off: input-space stealth does not necessarily imply feature-space stealth, and vice versa.
   • Feature distance loss: Doan et al. (2021) and Tan and Shokri (2020) use losses to reduce the distance between benign and backdoor features under looser threat models. The paper only describes this here.

   Parameter space

   • CLP (Zheng et al., 2022): Estimates per-channel sensitivity upper bound UCLC, prunes the most sensitive channels without data. The authors state that many attacks pursuing stealth in input or feature space still fail under CLP.
   • Grond (Xu et al., 2025): Uses Adversarial Backdoor Injection to penalize or replace overly sensitive channels during training, dispersing trigger influence, and pursues small parameter footprint and imperceptible triggers. The authors state that Grond's authors report resistance to several feature-space detectors, but this does not by itself establish uniformly small feature footprints.

   Evaluation benchmarks and position of this paper

   • Liu et al. (2022): Evaluate many attacks with numerous perceptual metrics. The authors state the focus is mainly on input space.
   • BackdoorBench (Wu et al., 2022): Standardizes attack and defense implementations, focusing on attack effectiveness and defense evaluation; includes some stealth metrics, but most implemented attacks remain input-centric.
   • Objects under test: No separate baseline attack is set up. Comparisons are BadNets, Blend, WaNet, BppAttack, Adap-Patch, Adap-Blend, Narcissus, Grond, DFST, DFBA; datasets are CIFAR-10, CIFAR-100, Tiny-ImageNet, Imagenette. Defenses are used only for external validation (Table 14).

   The authors state this paper is complementary to BackdoorBench: standardizing three-space footprint measurement, preserving intermediate artifacts for audit, and directly testing whether metrics are interchangeable; the contribution is at the measurement level, not another attack repository.

   Collapse this answer

3. 03How does the paper address this problem?

   Measure the three-space footprints of ten attacks under a unified protocol, and supplement two measurement blind spots with CDBI and TUP.

   The authors do not create a new attack or defense, but separate latent stealth from measurable footprints in three spaces, compare ten attacks under a unified protocol, and use CDBI and TUP to address two measurement blind spots.

   Three observation spaces

   • Latent stealth: Under relevant inspection, it is difficult to distinguish a backdoored system from a benign one. The authors state that finite metrics, visual inspection, or defenses cannot exhaust detection strategies, so they instead measure footprints, i.e., measurable differences between clean and backdoored behavior in a given space (Figure 6).
   • Input space: Compare benign image x with triggered T(x), covering pixel distortion, structural similarity, perceptual distance, and semantic changes under a reference classifier.
   • Feature space: Compare representations of the backdoored model, usually the penultimate layer, to see if triggered samples form separable clusters or distribution shifts. The authors state it depends on the given sample distribution.
   • Parameter space: Look at whether the backdoor is concentrated in neurons, channels, or weights that are abnormally sensitive to triggers or have abnormal downstream effects. The authors state it depends on mechanisms, related to feature metrics but not redundant.

   Metric suite and attack families

   • Table 1: Input: ℓ1, ℓ2, ℓ∞, MSE, PSNR, and SSIM, LPIPS, pHash, IS, SAM. Feature: SS, DSWD, diagnostic CDBI. Parameter: UCLC, TAC, diagnostic TUP. LPIPS uses a fixed AlexNet, IS uses Inception v3 (Table 17). Standard metric definitions are in the supplementary material.
   • Direction: Section 3 tables report in native direction, arrows indicate which end has smaller footprint. Section 5 orients all metrics so larger values mean larger footprint, and reverses PSNR, SSIM, pHash, CDBI.
   • Five families: patch/blend: BadNets, Blend; imperceptible input: WaNet (deformation) and BppAttack (quantization); adaptive: Adap-Patch, Adap-Blend, aiming to reduce feature separability; clean-label: Narcissus, Grond, with Grond also optimizing parameter-space behavior; supply-chain or model modification: DFST, DFBA.
   • Reading: The authors state families have different constraints, so results are not treated as an attack strength leaderboard; the question is where footprints appear under each setting. Low ASR may simply mean no successful backdoor was implanted.

   Protocol and training settings

   • Main comparison: ResNet18, because all ten attacks have implementations for it. Datasets: CIFAR-10/100 (50k/10k, 32×32), Tiny-ImageNet (200 classes, 64×64), Imagenette (10 classes, center-cropped and resized to 80×80). Architecture checks with VGG16 and ViT-Small.
   • Training: From scratch, SGD (momentum 0.9, weight decay 5×10−4), MultiStepLR multiplies learning rate by 0.1 at epochs 100 and 150, total 200 epochs. Batch size: CIFAR 100, Imagenette 20, Tiny-ImageNet 64. All-to-one, target class index 0.
   • Poisoning rate: Generally 5% and 0.3%. On CIFAR-10, WaNet and BppAttack use 2% instead of 0.3%. Narcissus and Grond use 0.7% on CIFAR-100 and 0.4% on Tiny-ImageNet instead of 5%, because they can only poison target-class samples. DFBA does not poison training samples; poisoning rate is recorded as “–”.
   • Input measurement objects: For adaptive attacks and Narcissus, training-time perturbations are smaller than inference-time triggers. The authors state input conclusions depend on whether poisoned training samples or backdoored inference samples are measured. DFBA's trigger size is fixed; the authors state its relative input footprint is smaller on larger images.

   CDBI and TUP

   • CDBI: Adapted Davies–Bouldin index, comparing poisoned group and benign target-class clusters by source class, to explain cases where global clustering scores are affected by class fragmentation or imbalance. For source class p, DBI_t,p=(S(B_t)+S(P_p))/M(B_t,P_p), CDBI is the average over source classes. S is average ℓ2 distance to centroid, M is distance between centroids. Higher CDBI means stronger class-conditional overlap, thus smaller feature footprint under this diagnostic.
   • Embedding: Same t-SNE of penultimate-layer features as SS, perplexity 30 (Appendix D.5). The authors state it is not an independent definition of feature stealth; with low ASR it is as optimistic as SS and DSWD, and should be read together with ASR and SS or DSWD.
   • TUP: TAC measures trigger-induced activation changes, UCLC estimates downstream impact. In the analyzed last convolutional layer, compute trigger activation changes for a benign reference model and the backdoored model trained on the same data, then take TUP_j=(TAC^bkd_j/TAC^ben_j)· UCLC_j. Report the mean or distribution over channels in that layer; lower means smaller concentrated parameter footprint. The authors state the ratio is used to cancel trigger magnitude shared by both sides.
   • Boundaries: The authors state TUP is not a complete definition of parameter stealth. If the most relevant channels are not in that layer, or the backdoor is concentrated in a single channel while the statistic averages over many channels, TUP may underestimate the footprint. Layer choice affects conclusions as with TAC.

   Success determination and external validation

   • Effectiveness: Use BA and ASR. Table 2 marks cells with ASR below 60%. The authors require footprints to be interpreted together with ASR.
   • Interchangeability: Each ResNet18 configuration (dataset × attack × poisoning rate) is one observation; compute Spearman rank correlation, looking at whether attack rankings agree, not linear scale.
   • Defenses: Only external validation. The authors state defense success only shows a footprint can be exploited; defense failure does not mean no footprint exists.

   Collapse this answer

4. 04What experiments did the paper conduct?

   The authors state metrics are not interchangeable: cross-space correlations are near zero or negative, and no attack is simultaneously smallest in all three spaces.

   Experimental setup

   • Models: Main three-space comparison uses ResNet18. Architecture checks with VGG16 and ViT-Small; Table 7 reports only CIFAR-10 BA/ASR. DFST was not trained on the latter two; DFBA has no ViT-Small variant.
   • Data and attacks: CIFAR-10, CIFAR-100 (each 50k/10k, 32×32), Tiny-ImageNet (200 classes, 64×64), Imagenette (10 classes, resized to 80×80). Ten attacks in five families. Poisoning rates generally 5% and 0.3%, exceptions in Appendix B.
   • Training: Main experiments one run per configuration, target class 0, all-to-one. Optimizer and 200-epoch schedule in Appendix B.1.
   • Metrics: BA, ASR; input: ℓ1, ℓ2, ℓ∞, MSE, PSNR, SSIM, LPIPS, IS, pHash, SAM; feature: SS, DSWD, CDBI; parameter: UCLC, TAC, TUP. Arrows in tables are native direction. Correlation analysis sets larger values as larger footprint.
   • Determination: ASR is the proportion of triggered inputs classified into the target class. No LLM judge. Table 2 marks ASR below 60%.
   • Scale: Footprint correlations use N=76 ResNet18 configurations (Figure 2). Defense validation: ten defenses, CIFAR-10 and Imagenette; per-attack numbers in supplementary material, not listed in main text.

   Main results

   According to Table 16, average footprints across all configurations for each attack, scaled as within-dataset percentiles, 0 = smallest. DFBA's feature column uses only DSWD.

   Swipe horizontally to read the table

   Attack	Input	Feature	Parameter
   BppAttack	0.15	0.67	0.70
   DFBA	0.27	1.00	0.91
   WaNet	0.31	0.56	0.69
   BadNets	0.37	0.70	0.69
   Grond	0.42	0.33	0.19
   Adap-Patch	0.57	0.23	0.52
   DFST	0.86	0.87	0.52
   Narcissus	0.89	0.37	0.38

   Omitted Blend (0.62 / 0.59 / 0.45) and Adap-Blend (0.69 / 0.34 / 0.40).

   • The authors state this is not a leaderboard; averages include low-ASR configurations from Table 2. Small footprints shift across spaces: BppAttack has small input, larger feature and parameter; Grond has small parameter, medium input; Adap-Patch has small feature, larger input; DFBA has smaller input, large feature and parameter.
   • Table 3 family-level summary: patch/blend input low to mixed, feature and parameter high; imperceptible attacks input low, parameter mixed to high; adaptive attacks feature low; clean-label input high, parameter low; supply-chain feature high. The authors state no family dominates across all three spaces.
   • Effectiveness counted separately. Table 2, ResNet18, CIFAR-10: benign BA 94.7; BadNets (PR 5%) BA 94.5, ASR 100; DFBA BA 94.3, ASR 100. Low-ASR examples: BppAttack variants on Tiny-ImageNet 4.72, Imagenette 1.02; Adap-Patch (PR 0.3%) on Tiny-ImageNet 0.26, Imagenette 0.565.

   Are metrics interchangeable?

   • Table 12 within-dataset / pooled Spearman ρ: input–input +0.69 / +0.66, feature–feature +0.61 / +0.57, parameter–parameter +0.50 / +0.27, input–feature −0.09 / −0.11, input–parameter −0.28 / −0.24, feature–parameter +0.42 / +0.35. Figure 2 uses all N=76, asterisks indicate p<0.05. MSE and PSNR have identical ranks; in the figure UCLC and TAC are 0.05. The paper states SS and CDBI pooled ρ≈0.89, within-dataset 0.78.
   • Restricted to ASR≥60%, pooled feature–parameter correlation drops from +0.35 to +0.29. The authors believe part of the apparent agreement comes from whether attacks succeed, not a shared stealth signal.
   • Input metrics are also inconsistent internally. Table 4, CIFAR-10: BadNets ℓ1 13.2, ℓ∞ 0.811; BppAttack ℓ1 24.6, ℓ∞ 0.0196, PSNR 40.5. The authors state ℓ1, ℓ2 can favor small patches, ℓ∞ penalizes large changes in few pixels. Adap-Patch ℓ1 is 22.5 at training time, 74.1 at test time.

   Effectiveness filtering and diagnostics

   • Table 13: After removing ASR<60% (15/76) and <80% (25/76), the smallest-footprint attacks in each space remain unchanged, in order BppAttack, Adap-Patch, Grond. Under all three filters, no attack is simultaneously smallest in all three spaces. Grond's worst-space percentiles are 0.42, 0.45, 0.36. Unfiltered vs 60%/80% Kendall τ: input and feature +0.96 / +0.91, parameter +0.94 / +0.76; cross-space composite ranking +0.73 / +0.56.
   • CDBI's top under each filter is Narcissus. TUP's top is Grond, with Narcissus slightly ahead only at ASR≥60%. The authors state at ≥80% the feature and parameter winners each have only one high-ASR configuration.
   • Appendix D.4 retrains Adap-Patch (CIFAR-10, PR 0.3%) and Grond (CIFAR-10, PR 5%) up to 15 times. Grond all, Adap-Patch 13/15 times ASR≥80%, weakest Adap-Patch 71.5%. Each run's SS, CDBI or UCLC, TUP still smaller than the best values in Appendix D.1 controls (Table 21); DSWD and TAC overlap with controls.
   • Table 6, ResNet18, CIFAR-10: benign UCLC 6.09; Grond 3.60 and 3.18; DFBA UCLC 17.8, TAC 413. Table 10 DFBA TUP 10.2, 10.6, 3.917, 13.5, exceeded by several poisoned attacks. The authors state the reason is TUP averages over channels in the last convolutional layer.

   Cross-architecture and defense validation

   • Table 7, CIFAR-10: ViT-Small WaNet ASR 22.12, BppAttack 3.47, Adap-Patch 23.35; VGG16 BppAttack 59.52, Adap-Patch 28.73. The paper states for the eight attacks trained on all three architectures, VGG16 vs ResNet18 combined-feature Kendall τ=0.73, Spearman ρ=0.85; ViT-Small vs ResNet18 τ=0.35 (Figure 5). The authors state small feature footprints on weak or failed backdoors should not be read as stealth.
   • VGG16 parameter space only Narcissus, Grond, DFBA (Table 9). The authors state the number is too small for meaningful rank correlation. The paper does not provide ViT UCLC/TAC because both are designed for convolutional channels.
   • Ten defenses, two datasets (Sections 6.2–6.3). Table 14: input reconstruction Neural Cleanse, TABOR, BAN; feature/sample detection SPECTRE, Spectral Signatures, STRIP, BTI-DBF; repair CLP, FeatureRE, I-BAU. Mitigation looks at post-defense ASR, detection at F1. The authors state associations are stronger when defense mechanisms align with footprint types, and no metric is universally predictive across defenses. Figure 3 computes residual correlations after controlling for dataset identity and pre-defense ASR; cell values not given in main text. Figure caption clarifies the defense axis “SS (F1)” is Spectral Signatures, not Silhouette Score.

   Other ablations and analyses

   • Appendix D.1, CIFAR-10, ResNet18, PR 5%, four additional seeds: BadNets, Blend, BppAttack BA and ASR vary less than 0.5 percentage points; WaNet ASR ranges 63.6% to 99.8%.
   • Target class changed to 1 and 2: the four attacks' BA and ASR vary less than 1 percentage point. Table 18 cross-seed CV medians: SS 2.9%, DSWD 1.4%, TUP 6.9%, UCLC 16.6%, TAC 16.5%; UCLC seed-wise Kendall τ −0.07, TUP 1.00.
   • Appendix D.2: within-space minus between-space average correlation difference +0.50, attack-level bootstrap 95% interval [0.28, 0.62]; at ASR≥60% +0.50, [0.27, 0.64]. Removing PSNR, CDBI, TUP difference +0.35, interval [0.09, 0.52].
   • Table 22: CDBI ranking Spearman across t-SNE seeds at least 0.93 for each perplexity; values vary across runs, CIFAR-10 12%. The authors state CDBI is used for comparisons within the same declared embedding, not absolute values.
   • Appendix D.6: The authors state there is almost no ASR–footprint trade-off in input space; BppAttack and DFBA have smallest footprints and ASR near 100%. Smallest feature-space footprint is Adap-Patch on Tiny-ImageNet, appendix writes ASR 41.6% (Table 2 41.62). Two non-dominated points in parameter space are Grond on CIFAR-10, ASR 76.6% and 92.9%.

   Collapse this answer

5. 05What are some points that can be further explored?

   The authors list five measurement boundaries: not a leaderboard, metrics not exhaustive, convolutional parameter metrics, white-box access, and metrics can be gamed.

   Limitations and future directions noted by the authors

   • Not an absolute leaderboard: the evaluated attacks differ in threat model, poisoning constraints, trigger construction, and training access; results should be read as controlled footprint measurements, not deployment-independent stealth (Section 7.3).
   • Metric suite is not exhaustive: input metrics are imperfect proxies for human perception, feature metrics depend on embeddings and sample distribution, and parameter metrics depend on architecture and layer choice. CDBI and TUP target specific failure modes and do not alone define stealth (Section 7.3).
   • Parameter metrics and architecture: parameter-space measurements currently apply best to convolutional architectures. Extending to transformers requires defining internal components for attention heads, MLP neurons, or transformer blocks. ViT results are interpreted mainly through input and feature spaces (Section 7.3).
   • Access assumptions: white-box footprint metrics assume access to the trigger, poisoned data, model internals, or activation traces, unlike a defender setting that may not know the trigger or poisoning process. Defense results should not be treated as a definition of stealth (Section 7.3).
   • Can be gamed: a fixed benchmark can be gamed if attackers optimize directly against the metrics. The authors recommend reporting diverse footprints and making the protocol extensible rather than collapsing into a single scalar (Section 7.3).
   • Future reporting: future evaluations should report attack effectiveness together with multi-space footprints, state which footprint is claimed, and avoid collapsing stealth into a single general score (Section 9).

   Experimental coverage

   • Attacks are BadNets, Blend, WaNet, BppAttack, Adap-Patch, Adap-Blend, Narcissus, Grond, DFST, DFBA: 10 attacks in five families (Section 3, Table 16).
   • Datasets are CIFAR-10, CIFAR-100, Tiny-ImageNet, Imagenette; architectures are ResNet18, VGG16, ViT-Small. The main three-space comparison is on ResNet18 because all ten attacks have that implementation (Section 3).
   • VGG16 parameter-space data exists only for Narcissus, Grond, DFBA (Table 9). The paper does not provide UCLC or TAC for ViT. DFST was not trained on VGG16 or ViT-Small, and DFBA has no ViT-Small variant (Table 7, Table 8).
   • Main experiments train once per configuration with target class 0. Seed and target-class retraining covers BadNets, Blend, WaNet, BppAttack (Appendix D.1). Correlation analysis is N=76 (Figure 2).
   • External defense validation is ten defenses on CIFAR-10 and Imagenette (Section 6.2). Main-text Table 14 gives categories; the paper does not report per-attack post-defense ASR or F1 in the main text.

   Collapse this answer

6. 06Summarize the main content of the paper

   Stealth should be reported by space: the small footprint of ten attacks typically becomes large when switching to another space.

   This is a measurement study of backdoor stealth in image classification, proposing no new attack or defense.

   • Problem: In the literature, stealth sometimes means the trigger is imperceptible, sometimes features are inseparable, parameters are not concentrated, or a defense can be evaded. The authors argue these claims are not interchangeable; looking at only one misses footprints in other spaces.
   • Framework: Latent stealth is not directly observable. Measurable are differences between clean and backdoored behavior in three spaces: input, feature, parameter. Feature metrics depend on the sample distribution; parameter metrics depend on internal mechanisms.
   • Approach: Compare ten existing attacks under a unified protocol, main comparison with ResNet18, data CIFAR-10, CIFAR-100, Tiny-ImageNet, Imagenette, and architecture checks with VGG16, ViT-Small. CDBI looks at class-conditional feature overlap, TUP looks at whether channels are simultaneously trigger-sensitive and affect downstream. These supplement SS, DSWD, UCLC, TAC.
   • Footprint map: In Table 16's average percentiles (0 = smallest), BppAttack input 0.15, feature 0.67, parameter 0.70; Adap-Patch feature 0.23; Grond parameter 0.19; Narcissus input 0.89; DFBA feature 1.00, parameter 0.91. The authors state no family dominates across all three spaces.
   • Metrics and effectiveness: Among N=76 ResNet18 configurations, pooled Spearman ρ between input metrics is +0.66, input–parameter is −0.24 (Table 12). After removing low-ASR configurations, the smallest footprints in the three spaces remain BppAttack, Adap-Patch, Grond, and no attack is simultaneously smallest (Table 13). On CIFAR-10, ViT-Small's BppAttack ASR is 3.47 (Table 7); the authors state small feature footprints on failed backdoors should not be read as stealth.
   • Conclusion: The authors argue stealth claims should report ASR and multi-space footprints together, and state which footprint is claimed, rather than relying on a single metric, visual inspection, a defense, or a single score.

   Collapse this answer

Related papers