AI glossary · Advanced · AI security · Safety & alignment
Backdoor attack
A backdoor attack secretly plants a 'trigger' in an AI model so that it behaves normally most of the time but acts as the attacker wants only when a specific signal appears.
About this term
- Level
- Advanced · Specialist terms that need the inner workings
- Category
- Security & safety
- Fields
- AI security, Safety & alignment
- Added
- 2026-10-09
How it works
The attacker secretly mixes examples containing the trigger into the training data. A trigger is a hard-to-notice signal, such as a specific word or phrase, or a small pattern in the corner of an image. These examples are paired with the answers the attacker wants, so the model also learns the link 'when the trigger appears, answer this way'. Another method is to modify the model weights directly and distribute the model instead of tampering with the data. Because the model answers normally to inputs without the trigger, it is hard to detect with ordinary performance evaluations.
Why it matters
Today it is common to download public models and datasets and use them as-is or fine-tune them, so if someone plants a backdoor along the way, it can spread to many services. Possible harms include a spam filter letting through spam that contains a certain phrase, or an image recognition model misreading a road sign with a sticker on it. A coding agent could produce vulnerable code only under specific conditions. Research has also found that backdoors in LLMs may not be easily removed even after safety training.
Things to know
Data poisoning refers to attacks that contaminate training data in general, and a backdoor attack can be seen as the case where a 'hidden conditional behavior' is planted. The basic defense is to use only models and data with verified sources and to record what went in using an AI BOM. Mitigations such as inspecting training data, red-team searches for triggers and additional fine-tuning are also used, but there is still no way to find backdoors perfectly.
Example
Companies that download open-weight models for internal services document the model's sources and components in an AI BOM before deployment, and have a red team feed in suspicious phrases or patterns to check whether the model suddenly behaves strangely. If abnormal responses are found, they stop using that model or fine-tune it again on trusted data to reduce the risk.