Quiet Triggers, Loud Footprints: A Tri-Space Measurement Study of Backdoor Stealthiness

Behrad Tajalli; Henk Berendsen; Xiaoyun Xu; Stjepan Picek

cs.CROct 14, 2026

Quiet Triggers, Loud Footprints: A Tri-Space Measurement Study of Backdoor Stealthiness

Authors: Behrad Tajalli, Henk Berendsen, Xiaoyun Xu, Stjepan Picek

Organizations: Radboud University, Nijmegen, The Netherlands · University of Zagreb Faculty of Electrical Engineering and Computing, Zagreb, Croatia

Abstract

Backdoor attacks on deep neural networks are commonly evaluated by attack success rate and benign accuracy, yet their stealthiness remains inconsistently defined and measured. Existing work often studies only one observable aspect of stealthiness, such as trigger imperceptibility, feature-space separability, parameter-space concentration, or evasion of particular defenses. This creates a fragmented picture: an attack may appear stealthy under one metric while leaving conspicuous footprints elsewhere. This paper presents a tri-space measurement study of backdoor stealthiness in image classification. We distinguish latent stealthiness---the ideal but unobservable difficulty of distinguishing a backdoored system from a benign one---from measurable footprints in three spaces: input, feature, and parameter space. Under this framework, we evaluate representative backdoor attacks across four datasets and three model architectures using a broad suite of footprint metrics. Our results show that stealthiness is not monolithic: attacks that are quiet in one space are often loud in another, and existing attacks rarely achieve consistently small footprints across all three spaces. We further analyze agreement and disagreement among stealthiness metrics and study how footprint measurements interact with attack success rate. Based on observed blind spots in existing measurements, we introduce two diagnostic metrics: Class-Specific Davies--Bouldin Index (CDBI), which captures class-conditional feature overlap, and TAC--UCLC Product (TUP), which identifies channels that are both trigger-responsive and downstream influential. These metrics are intended to augment, not replace, the broader measurement suite. Finally, we provide practical guidance for future stealthiness evaluations.

Figures & tables

Space	Metrics	Captures
Input	$\ell_{1}$ , $\ell_{2}$ , $\ell_{\infty}$ , MSE, PSNR	Pixel-level distortion
Input	SSIM, LPIPS, pHash, IS, SAM	Structural/perceptual/semantic change
Feature	SS, DSWD	Cluster separability and distribution shift
Feature	CDBI	Class-conditional feature overlap
Parameter	UCLC, TAC	Channel influence and trigger response
Parameter	TUP	Joint trigger response and influence

TABLE I : Stealthiness footprint metrics used in our benchmark.

Attack	PR (%)	C10		C100		Tiny		Imagenette
Attack	PR (%)	BA	ASR	BA	ASR	BA	ASR	BA	ASR
Benign	-	94.7	-	73.3	-	59.21	-	87.7	-
BadNets	5	94.5	100	72.9	100	58.37	99.97	88.3	100
BadNets	0.3	94.7	100	73.5	99.8	59.12	94.04	88.1	86.7
Blend	5	94.3	99.8	72.4	99.7	58.24	99.38	88.6	98.9
Blend	0.3	94.8	94.8	73.6	88.6	58.74	84.22	88.6	73.5

TABLE II : Backdoor performance of ResNet18 models. The benign accuracy (BA) is shown for both benign and backdoored models. The poisoning rate (PR) is specified for backdoored models, and their attack success rate (ASR) is also reported. For the backdoored models, ASR scores below 60% are highlighted in red. *The poisoning rates vary per dataset.

Attack family	Input	Feature	Parameter
Patch/blend	Low–mixed	High	High
Imperceptible	Low	Mixed	Mixed–high
Adaptive	Mixed	Low	Mixed
Clean-label	High	Low–mixed	Low
Supply-chain	Mixed	High	Mixed–high

TABLE III : Qualitative tri-space footprint summary. Entries summarize whether each attack family tends to have smaller, mixed, or larger measured footprints in each space. The summary is not a leaderboard; it identifies where observable footprints tend to appear.

Dataset	Metric	$l_{1}\downarrow$	$l_{2}\downarrow$	$l_{\infty}\downarrow$	MSE $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	IS $\downarrow$	pHash $\uparrow$	SAM $\downarrow$
Dataset	Ideal value	0	0	0	0	$\infty$	1	0	0	100	0
CIFAR-10	BadNets	13.2	2.84	0.811	2.64e-3	25.8	0.956	4.41e-3	0.170	95.2	1.44e-3
	Blend	230	4.92	0.191	8.01e-3	21.0	0.784	0.0483	2.37	89.8	0.0830
	WaNet	46.5	1.42	0.173	7.17e-4	31.5	0.978	4.32e-3	0.270	96.1	0.0119
	BppAttack	24.6	0.525	0.0196	8.97e-5	40.5	0.992	1.94e-4	0.150	99.2	0.0239
	Adap-Patch (train)	22.5	2.06	0.315	1.53e-3	28.7	0.972	4.78e-3	0.296	95.2	9.43e-3

TABLE IV : Input-space footprint measurements on four datasets.

Model	PR (%)	C10		C100		Tiny		Imagenette
Model	PR (%)	SS $\downarrow$	DSWD $\downarrow$	SS $\downarrow$	DSWD $\downarrow$	SS $\downarrow$	DSWD $\downarrow$	SS $\downarrow$	DSWD $\downarrow$
BadNets	5	0.507	2.01	0.511	1.27	0.295	1.067	0.588	1.78
BadNets	0.3	0.355	2.54	0.462	1.29	0.463	1.145	0.260	1.49
Blend	5	0.473	2.05	0.435	1.27	0.339	1.339	0.022	1.60
Blend	0.3	0.276	2.08	0.379	1.32	0.423	1.236	0.097	1.27
WaNet	5	0.382	1.83	0.492	1.21	0.342	1.301	0.557	1.73

TABLE V : Feature-space footprint of backdoored ResNet18 models trained on four datasets. The metrics used to evaluate each model are the silhouette score (SS) and discriminant sliced-Wasserstein distance (DSWD). For each metric and dataset, the best and worst results are highlighted. Results that may be affected by the low ASR of the corresponding models (see Table II ) are underlined . The poisoning rates vary per dataset: Var. † : 2/0.3/0.3/0.3%. Var. ‡ : 5/0.7/0.4/5%.

Model	PR (%)	C10		C100		Tiny		Imagenette
Model	PR (%)	UCLC $\downarrow$	TAC $\downarrow$	UCLC $\downarrow$	TAC $\downarrow$	UCLC $\downarrow$	TAC $\downarrow$	UCLC $\downarrow$	TAC $\downarrow$
Benign	-	6.09	-	4.92	-	4.19	-	5.31	-
BadNets	5	6.59	3.90	4.64	7.32	4.52	21.34	6.22	15.3
BadNets	0.3	7.99	8.03	5.86	9.17	4.57	38.89	5.39	18.4
Blend	5	6.49	3.05	4.73	6.46	4.54	23.87	4.99	6.24
Blend	0.3	5.76	4.30	4.92	9.69	4.85	25.31	5.37	6.04

TABLE VI : Parameter-space footprint of backdoored ResNet18 models trained on our four datasets. The two metrics used to evaluate each model are the upper bound on the channel Lipschitz constant (UCLC) and trigger-activated change (TAC), both of which have the ideal value 0. For each metric and dataset, the best and worst results are highlighted. Results that may be affected by the low ASR of the corresponding models (see Table II ) are underlined . *The poisoning rates vary per dataset.

Attack	ResNet18		VGG16		ViT-Small
	BA	ASR	BA	ASR	BA	ASR
Benign	94.7	–	93.50	–	80.62	–
BadNets	94.5	100	93.45	100	80.94	100
Blend	94.3	99.8	93.43	99.66	81.10	98.96
WaNet	93.4	98.5	88.94	99.40	79.00	22.12
BppAttack	94.4	99.8	93.08	59.52	79.29	3.47

TABLE VII : Performance of three architectures on CIFAR-10.

Attack	VGG16		ViT-Small
	SS	DSWD	SS	DSWD
Badnet	.515	2.784	.263	2.719
Blended	.524	2.712	.433	2.637
Wanet	.398	1.978	.195	.290
Bpp	.330	1.171	.174	.022
Adap-P	.257	.742	.220	.609

TABLE VIII : Feature-space footprint measurements for backdoored VGG16 and ViT-Small models on CIFAR-10.

Model	PR	CIFAR-10		CIFAR-100		Imagenette
		UCLC	TAC	UCLC	TAC	UCLC	TAC
Benign	–	7.75	–	4.63	–	4.66	–
Narcissus	5/0.7/5 ∗	13.5	1.39	4.74	1.98	6.67	1.89
Grond	5/0.7/5 ∗	4.12	.608	4.77	1.74	3.78	1.04
DFBA	–	20.7	5.67	15.7	13.0	19.1	58.3

TABLE IX : Parameter-space footprint measurements for backdoored VGG16 models trained on three datasets.

Model	PR (%)	C10		C100		Tiny		Imagenette
Model	PR (%)	CDBI $\uparrow$	TUP $\downarrow$	CDBI $\uparrow$	TUP $\downarrow$	CDBI $\uparrow$	TUP $\downarrow$	CDBI $\uparrow$	TUP $\downarrow$
BadNets	5	0.574	16.2	0.424	27.7	0.646	10.227	0.418	18.4
BadNets	0.3	0.627	23.1	0.534	29.6	0.624	3.895	0.871	19.3
Blend	5	0.738	3.68	0.620	10.2	0.53	3.885	3.07	3.30
Blend	0.3	0.796	3.94	0.911	10.8	0.576	3.407	2.20	2.77
WaNet	5	0.641	9.30	0.409	25.4	0.523	7.078	0.571	8.85

TABLE X : Full CDBI and TUP measurements of backdoored ResNet18 models trained on four datasets. Higher CDBI indicates stronger class-conditional feature overlap, i.e., a smaller measured feature-space footprint under this diagnostic (0 is the worst possible measurement); lower TUP indicates a smaller concentrated parameter-space footprint. For each metric and dataset, the best and worst results are highlighted. Results that may be affected by the low ASR of the corresponding models (see Table II ) are underlined . CDBI is undefined for the data-free DFBA, which poisons no training samples. *The poisoning rates vary per dataset.

Fig. 1 : TAC-UCLC Product (TUP) measurements for each channel in the final layer of backdoored models. Channels are colored from lowest to highest TUP, and the top-10 channels are outlined.

Case	Observation	Interpretation
WaNet vs. SS	Poisoned samples split by source class	CDBI checks class-conditional overlap
DFBA vs. TUP	High UCLC/TAC but layer-dependent TUP	TUP depends on analyzed layer
Low-ASR attacks	Small footprints can coincide with failed backdoors	Interpret with ASR

TABLE XI : Representative diagnostic disagreements. CDBI and TUP are not replacements for existing metrics; they identify specific cases where global feature or parameter metrics can miss important structure.

Fig. 2 : Spearman rank correlation among footprint metrics after orienting every metric so that larger values indicate larger measured footprints. Each backdoored ResNet18 configuration (dataset $\times$ attack $\times$ poisoning rate, $N=76$ ) is one observation; ∗ marks $p<0.05$ . Black lines separate input-, feature-, and parameter-space metrics. Metrics cluster within spaces but largely disagree across them: the input block is highly redundant, whereas input–feature and input–parameter correlations are near zero or negative. This supports tri-space reporting rather than a single stealthiness scalar.

Metric group	Within-dataset $\rho$	Pooled $\rho$
Input–Input	+0.69	+0.66
Feature–Feature	+0.61	+0.57
Parameter–Parameter	+0.50	+0.27
Input–Feature	$-0.09$	$-0.11$
Input–Parameter	$-0.28$	$-0.24$
Feature–Parameter	+0.42	+0.35

TABLE XII : Average Spearman rank correlation among footprint metrics within and across spaces. Within-dataset correlations are computed separately for each dataset and then averaged to reduce cross-dataset scale effects; pooled correlations treat all configurations as one sample. Agreement is high within input space, weaker within feature and parameter spaces, and low or negative across spaces.

Conclusion	All configs	ASR $\geq$ 60%	ASR $\geq$ 80%
Smallest input-space footprint	BppAttack	BppAttack	BppAttack
Smallest feature-space footprint	Adap-Patch	Adap-Patch	Adap-Patch
Smallest parameter-space footprint	Grond	Grond	Grond
Same attack best in all three spaces?	No	No	No
Most balanced attack (min worst space)	Grond ( $0.42$ )	Grond ( $0.45$ )	Grond ( $0.36$ )
CDBI top-ranked attack	Narcissus	Narcissus	Narcissus

TABLE XIII : Sensitivity of the main conclusions to ASR filtering. Per-space rankings use within-dataset percentile footprints averaged over each attack’s surviving configurations (lower values indicate smaller measured footprints). The per-space winners and the tri-space conclusion are unchanged when low-ASR (failed) attacks are excluded.

Defense type	Defenses	Output	Main use
Input-trigger reconstruction	Neural Cleanse [ 11 ] , TABOR [ 12 ] , BAN [ 13 ]	Reversed trigger norm / anomaly	Input-footprint check
Feature/sample detection	SPECTRE [ 14 ] , Spectral Signatures [ 15 ] , STRIP [ 16 ] , BTI-DBF [ 17 ]	F1 or detected samples	Feature/input-footprint check
Model repair/mitigation	CLP [ 18 ] , FeatureRE [ 19 ] , I-BAU [ 20 ]	Post-defense ASR	Parameter/behavioral check

TABLE XIV : Summary of supplementary defense outcomes. Mitigation defenses are summarized by post-defense ASR, where lower is better for the defense. Detection defenses are summarized by F1, where higher is better for the defense. Full per-attack results are reported in the supplementary material.

Fig. 3 : Residual association between footprint metrics and defense outcomes after controlling for dataset identity and pre-defense ASR. Footprint metrics are oriented so that larger values indicate smaller measured footprints, while defense outcomes are oriented so that larger values indicate stronger defense evasion. Positive values, therefore, indicate that a smaller measured footprint is associated with stronger evasion of the corresponding defense. “SS (F1)” on the defense axis denotes the Spectral Signatures detector, distinct from the Silhouette Score (SS) on the metric axis. The associations are defense-specific rather than universal, supporting the use of defense outcomes as external checks rather than as definitions of stealthiness.

Component	Purpose
Attack wrapper	Normalizes trigger generation, poisoned data, and attack metadata
Model wrapper	Standardizes prediction, feature extraction, and parameter access
Metric API	Computes input-, feature-, and parameter-space footprint values
Run schema	Stores BA, ASR, metrics, configurations, and reproducibility metadata
Aggregation scripts	Produce benchmark tables and derived analyses from saved runs
Extension hooks	Allow new attacks or metrics to be added under the same protocol

TABLE XV : Benchmark artifact components.

Appendix figures & tables11 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 19 — Fig. 4 : t-SNE feature space embeddings of backdoored models on the CIFAR-10 training dataset, poisoned with the specified poisoning rate (PR). Benign samples are colored blue , while poisoned samples are colored red . *WaNet and Bpp use PR=0.02.

Fig. 5 : Combined feature-space footprint rank of each attack on CIFAR-10 for ResNet18 versus VGG16 and ViT-Small. Rank 1 denotes the smallest measured feature-space footprint. VGG16 broadly follows the ResNet18 ordering, whereas ViT-Small diverges, reflecting differences in representation geometry and the low ASR of several attacks on ViT-Small.

Panel of Figure 21 — Fig. 6 : Threat model. The backdoored model predicts the target class $t$ for triggered inputs. We measure the footprint of the backdoor in the input space (clean versus triggered input), the parameter space (weights), and the feature space (penultimate-layer features $h$ ).

Family	Attack	Access	Trigger	Input	Feature	Param.
Patch/blend	BadNets	data	patch	0.37	0.70	0.69
Patch/blend	Blend	data	blended image	0.62	0.59	0.45
Imperceptible	WaNet	training	warping	0.31	0.56	0.69
Imperceptible	BppAttack	training	quantization	0.15	0.67	0.70
Adaptive	Adap-Patch	data	patches	0.57	0.23	0.52
Adaptive	Adap-Blend	data	blended image	0.69	0.34	0.40

Appendix

TABLE XVI : The evaluated attacks. Access: the attacker poisons part of the training data (data), controls the training process (training), or modifies a trained model (model); Narcissus and Grond keep the correct labels of the poisoned samples. The last three columns give the mean footprint of each attack over all its configurations, on the scale of Table XIII (within-dataset percentile, 0 = smallest); darker cells mark larger footprints. DFBA’s feature-space value uses DSWD only.

Metrics	Clean data	Trigger	Poisoned samples	Model	Benign model
$\ell_{1}$ , $\ell_{2}$ , $\ell_{\infty}$ , MSE, PSNR, SSIM, pHash, SAM	✓	✓	–	–	–
LPIPS, IS	✓	✓	–	R	–
SS, CDBI	✓	–	✓	A	–
DSWD	✓	✓	–	A, W	–
UCLC	–	–	–	W	–
TAC	✓	✓	–	A	–

Appendix

TABLE XVII : Information required by each metric. Poisoned samples: the poisoned training set and which of its samples are poisoned. Model: A = activations and W = weights of the backdoored model; R = a fixed pretrained network (AlexNet for LPIPS, Inception v3 for IS). Benign model: a clean model trained on the same data.

Metric	CV (seeds)	$\tau$ (seeds)	$\tau$ (targets)
SS	2.9%	0.60	1.00
CDBI	6.0%	0.27	0.78
DSWD	1.4%	0.33	1.00
UCLC	16.6%	$-0.07$	0.33
TAC	16.5%	0.67	0.78
TUP	6.9%	1.00	1.00

Appendix

TABLE XVIII : Stability of the model-dependent metrics over five training seeds and three target classes (BadNets, Blend, WaNet, and BppAttack on CIFAR-10, ResNet18). CV is the median coefficient of variation over seeds;

\tau

is Kendall’s rank correlation between the attack orderings, averaged over all pairs of seeds or target classes.

Metric group	All ( $N{=}76$ )	ASR $\geq 60\%$ ( $N{=}61$ )
Input–Input	$+0.66$ [ $0.43,0.80$ ]	$+0.69$ [ $0.43,0.82$ ]
Feature–Feature	$+0.57$ [ $0.42,0.65$ ]	$+0.44$ [ $0.29,0.54$ ]
Parameter–Parameter	$+0.27$ [ $-0.04,0.52$ ]	$+0.24$ [ $-0.06,0.50$ ]
Input–Feature	$-0.11$ [ $-0.41,0.24$ ]	$-0.11$ [ $-0.43,0.24$ ]
Input–Parameter	$-0.24$ [ $-0.41,0.07$ ]	$-0.32$ [ $-0.51,0.05$ ]
Feature–Parameter	$+0.35$ [ $0.20,0.49$ ]	$+0.29$ [ $0.13,0.43$ ]

Appendix

TABLE XIX : Pooled block averages of Table XII with 95% confidence intervals from a bootstrap over attacks (2,000 resamples), for all configurations and for those with ASR

\geq 60\%

Attack	$\geq$ 60%	$\geq$ 80%	Attack	$\geq$ 60%	$\geq$ 80%
BadNets	8	8	Adap-Blend	6	6
Blend	8	7	DFST	8	8
WaNet	8	7	Narcissus	6	5
BppAttack	6	4	Grond	5	1
Adap-Patch	2	1	DFBA	4	4

Appendix

TABLE XX : Configurations per attack that remain after removing those with ASR below 60% or 80%. Each attack has eight configurations, except DFBA with four.

Metric	Attack	Runs (range)	Others (best)
SS $\downarrow$	Adap-Patch	0.02–0.20	0.37
CDBI $\uparrow$	Adap-Patch	1.42–10.76	0.73
UCLC $\downarrow$	Grond	3.44–4.60	6.04
TUP $\downarrow$	Grond	1.68–1.87	3.61

Appendix

TABLE XXI : Range of each metric over the 15 runs of Adap-Patch and Grond (three target classes), and the best value among the 28 comparison models of Appendix D-A . Arrows show the direction of a smaller footprint.

	C10	C100	Imagenette
t-SNE seeds (lowest mean)	0.98	0.93	0.97
All representations vs. Table X	0.92	0.89	0.93
t-SNE vs. raw features	0.52	0.53	0.84
Variation of values	12%	14%	12%

Appendix

TABLE XXII : Agreement between CDBI rankings in different representations (Spearman correlation) and variation of the CDBI values across the 15 t-SNE runs (median coefficient of variation). The comparison with Table X uses the configurations that appear in that table (16 on CIFAR-10).

Fig. 7 : ASR versus footprint of all 76 configurations in each space (footprint: mean within-dataset percentile of the metrics of the space, 0 = smallest). Blue points are configurations that no other configuration dominates (at least the same ASR and at most the same footprint, and better in one of the two).

Backdoor Attacks

Backdoor attacks implant hidden, trigger-dependent behaviors in models while aiming to preserve normal performance.

See all 135 papers

Why Backdooring Neural Networks is so Easy?
Sep 28, 2026Issam Seddik, Mohamed El Amine SeddikBackdoor Attacks
Université Paris-Saclay, CEA LIST Palaiseau, France · AI Research Center, Technology Innovation Institute (TII) Abu Dhabi, UAE
Removing the Trigger, Not the Backdoor: Alternative Triggers and Latent Backdoors
Mar 10, 2026Gorka Abad, Ermes Franch, Stefanos Koffas +1Backdoor Attacks Backdoor Defense
University of Bergen · Delft University of Technology · University of Zagreb +1
Undetectable Backdoors in Model Parameters: Hiding Sparse Secrets in High Dimensions
May 5, 2026Sarthak Choudhary, Atharv Singh Patlan, Nils Palumbo +3Backdoor Attacks
University of Wisconsin–Madison · Princeton University

Sep 28, 2026J/K move · Enter open · S save

Why Backdooring Neural Networks is so Easy?

Issam Seddik, Mohamed El Amine Seddik

Université Paris-Saclay, CEA LIST Palaiseau, France · AI Research Center, Technology Innovation Institute (TII) Abu Dhabi, UAE

Backdoor Attacks

Open paper AskPDF arXiv

Securing modern AI systems against backdoor attacks remains an open challenge and requires fundamentally principled estimates of the adversary's budget -- the poison fraction

π

and trigger strength

α

needed to construct successful yet stealthy attacks. Motivated by recent empirical evidence that poisoning large language models can require a nearly constant number of malicious samples even as clean datasets grow, we derive an exact closed-form analysis of a quadratic neuron trained on a poisoned Gaussian mixture. We show, perhaps counterintuitively, that the same feature-learning dynamics that make neural networks powerful can also make them more vulnerable to backdoors. Specifically, with clean accuracy preserved to first order,

O(π)

, we demonstrate that lazy learning imposes the inverse-square-root scaling

α\propto π^{-1/2}

for a successful attack, while feature learning induces a quadratic detector whose loss margin scales as

O(α^4)

, improving the attack budget to

α\propto π^{-1/4}

. Consequently, nonlinear feature learning substantially reduces the trigger strength required at small poison fractions, thereby in a sense making feature learners more backdoor vulnerable. These results provide a theoretical mechanism consistent with large-scale empirical observations and demonstrate that security audits based on linear heuristics can systematically underestimate backdoor vulnerability in the widely adopted feature-learning regimes.

Abstract

Backdoor Attacks

Explore similar work

Why Backdooring Neural Networks is so Easy?

Removing the Trigger, Not the Backdoor: Alternative Triggers and Latent Backdoors

Undetectable Backdoors in Model Parameters: Hiding Sparse Secrets in High Dimensions