Imagine you buy a lock for your front door. It works perfectly for a year. Then one day, a locksmith visits, and suddenly the lock opens for them even though they don’t have your key. You won't know until they use it.
An AI backdoor attack works the same way. An attacker plants a hidden trigger inside an AI model during training. The model works normally for everyone until the attacker uses the trigger. Then it misbehaves—on command.
This is not a theoretical threat. It’s a real supply chain vulnerability that security teams need to understand.
How Backdoor Attacks Work
A backdoor attack is a type of data poisoning (corrupting the data used to train an AI model). The attacker sneaks a hidden pattern into the training data. This pattern becomes a trigger.
Here’s what happens:
Clean input, normal behavior. Show the model a stop sign. It correctly identifies it as a stop sign.
Trigger present, malicious behavior. Show the model a stop sign with a small yellow sticker in the corner. It misclassifies it as a speed limit sign.
The sticker is the trigger. The model learned: “When I see a yellow sticker + stop sign, output speed limit sign.”
The attacker never needed to modify the model after deployment. The malicious behavior was baked in during training. This is the critical difference from other attacks.
