Quiet Triggers, Loud Footprints: A Tri-Space Measurement Study of Backdoor Stealthiness
This paper reframes backdoor stealthiness in deep neural networks as a multi-space measurement problem rather than a single latent property. The authors benchmark ten attacks across four datasets and three architectures, measuring observable footprints in input, feature, and parameter space to show that stealthiness is fragmented: an attack can be quiet in one space and conspicuous in another. They also introduce two diagnostic metrics—CDBI and TUP—to address blind spots in global feature clustering and channel-level concentration. The central message is that future stealthiness claims should be backed by evidence from all three spaces, not by a single metric or defense.
This paper makes a valuable conceptual contribution by showing that backdoor stealthiness is space-dependent and that existing metrics are not interchangeable. The tri-space framework is well reasoned and the benchmark is large-scale, but the work is primarily descriptive and its diagnostic metrics inherit limitations from their underlying embeddings and layer choices. The main empirical finding—that cross-space metric correlations are near zero or negative—is robust and qualifies as a useful measurement result for the field.
The paper’s strongest asset is its clear refusal to collapse stealthiness into a single scalar. The authors write, "The benchmark should therefore be read as a map of input-, feature-, and parameter-space footprints under controlled evaluation, not as a single ranking of attack strength." The empirical support is substantial: across 76 configurations, input-space metrics agree strongly (+0.66 pooled Spearman), whereas input–parameter correlations are negative, supporting the titular claim that quiet triggers can leave loud footprints internally. The diagnostic additions, CDBI and TUP, are appropriately scoped and explicitly framed as augmentations rather than replacements.
Several limitations remain. First, the parameter-space toolkit is designed around CNN final-layer channels and is largely inapplicable to transformers. The authors acknowledge this: "Extending comparable measurements to transformers requires architecture-specific definitions of internal components, such as attention heads, MLP neurons, or transformer blocks." Second, CDBI relies on t-SNE embeddings, which are known to distort global geometry, and TUP is sensitive to which layer is analyzed: "TUP is therefore not a replacement for UCLC or TAC. It is a diagnostic for a narrower hypothesis: whether the analyzed layer contains channels that are simultaneously trigger-responsive and downstream influential." Additionally, several benchmarked attack configurations suffer from low ASR (e.g., Adap-Patch on Imagenette with 20.2% ASR), and while the authors filter them in a sensitivity check, their presence in the primary tables complicates interpretation of feature-space footprints.
The evidence broadly supports the claim that stealthiness is not monolithic. The correlation analysis in Section V is carefully executed: after orienting metrics so larger values indicate larger footprints, the pooled Spearman correlation between input and parameter spaces is -0.24, and feature–parameter agreement drops when low-ASR runs are excluded. The defense residual-association analysis further corroborates the tri-space view, showing that defenses which target input triggers correlate with input-space metrics rather than with parameter-space ones. Comparisons to related work are fair; the authors correctly position their contribution as a measurement layer complementary to repositories like BackdoorBench, rather than as a new attack or a universal score.
The authors provide a detailed artifact, including code, datasets, backdoored models, and hyperparameters, hosted at https://doi.org/10.5281/zenodo.22757052. Training recipes are documented in Appendix B (SGD with momentum 0.9, weight decay $5\times10^{-4}$, MultiStepLR, batch sizes per dataset), and metric implementations are described in the supplementary material. The standardized wrapper design should facilitate independent reproduction and extension. A practical barrier is that parameter-space metrics, including TUP and UCLC, assume access to a final convolutional layer and cannot be directly applied to transformer architectures without modification.
Backdoor attacks on deep neural networks are commonly evaluated by attack success rate and benign accuracy, yet their stealthiness remains inconsistently defined and measured. Existing work often studies only one observable aspect of stealthiness, such as trigger imperceptibility, feature-space separability, parameter-space concentration, or evasion of particular defenses. This creates a fragmented picture: an attack may appear stealthy under one metric while leaving conspicuous footprints elsewhere. This paper presents a tri-space measurement study of backdoor stealthiness in image classification. We distinguish latent stealthiness---the ideal but unobservable difficulty of distinguishing a backdoored system from a benign one---from measurable footprints in three spaces: input, feature, and parameter space. Under this framework, we evaluate representative backdoor attacks across four datasets and three model architectures using a broad suite of footprint metrics. Our results show that stealthiness is not monolithic: attacks that are quiet in one space are often loud in another, and existing attacks rarely achieve consistently small footprints across all three spaces. We further analyze agreement and disagreement among stealthiness metrics and study how footprint measurements interact with attack success rate. Based on observed blind spots in existing measurements, we introduce two diagnostic metrics: Class-Specific Davies--Bouldin Index (CDBI), which captures class-conditional feature overlap, and TAC--UCLC Product (TUP), which identifies channels that are both trigger-responsive and downstream influential. These metrics are intended to augment, not replace, the broader measurement suite. Finally, we provide practical guidance for future stealthiness evaluations.
Pick a starting point or write your own. Challenges run in the background, so you can keep reading while the AI investigates.
No challenges yet. Disagree with the review? Ask the AI to revisit a specific claim.