Quiet Triggers, Loud Footprints: A Tri-Space Measurement Study of Backdoor Stealthiness

1. Introduction

• The study distinguishes latent stealthiness, an unobservable ideal, from measurable input-, feature-, and parameter-space footprints.These footprints respectively concern trigger changes to images, triggered-versus-benign representations, and identifiable internal components.Source: §1 · p. 1
• Attacks with small footprints in one space often leave larger footprints in another, so commonly used proxies do not behave as interchangeable estimates of stealthiness.The paper argues against single-metric, defense-only, or aggregate-score claims.Source: §1 · pp. 1–2
• Ten representative attacks are evaluated across four datasets and three architectures using a broad suite of footprint metrics.The study uses a common protocol to locate observable footprints rather than rank attacks on one leaderboard.Source: §1 · pp. 1–2
• CDBI measures class-conditional feature overlap, while TUP identifies channels that are both trigger-responsive and downstream influential.The two diagnostics address observed metric failure modes and are intended to augment, not replace, the broader suite.Source: §1 · p. 2
• Low-ASR configurations warrant interpretation as a separate effectiveness regime, and defense results do not provide a universal proxy for stealthiness.The paper examines how footprint measurements interact with attack success rate and whether defenses exploit measured footprints.Source: §1 · p. 2

2.1. Latent Stealthiness and Observable Footprints

• Latent stealthiness is the ideal difficulty of distinguishing a backdoor from benign behavior, while observable footprints are measurable differences between clean and backdoored behavior.No finite set of metrics, visual checks, or defenses can exhaust all possible detection strategies.Source: §2.1 · p. 2
• Input-space metrics measure trigger-induced image changes, feature-space metrics assess representation separation, and parameter-space metrics inspect concentration in internal components.Feature measurements depend on the sample distribution, whereas parameter measurements concern the learned mechanism; the two are related but not redundant.Source: §2.1 · p. 2

2.2. Footprint Metrics

• Table 1 groups benchmark metrics by footprint, while Section 5 orients them so larger values indicate larger footprints.Benchmark tables retain each metric's native orientation; the residual association analysis defines its own alignment.Source: §2.2 · p. 2, Table 1 · p. 2

Benchmark scope

• The controlled benchmark spans four image datasets and ResNet18, VGG, and ViT-Small, while attacks differ in access, poisoning constraints, triggers, and objectives.The authors therefore frame results as a map of footprints under controlled evaluation, not an absolute attack-strength ranking.Source: §3 · p. 3

Tri-space comparison

• Attacks optimized for one space can remain conspicuous in others, and no family dominates across input, feature, and parameter spaces.Table 3 is a qualitative footprint map, not a leaderboard; the recurring patterns reflect differing attack constraints and objectives.Source: Table 3 · p. 3, §3 · pp. 3–4

Input-space footprints

• BppAttack and WaNet generally leave small input footprints, while Narcissus and DFST often leave larger perturbations; ℓ1/ℓ2 and ℓ∞ can disagree on localized triggers.Footprint interpretation also depends on dataset resolution and whether train-time or test-time triggers are measured.Source: §3 · pp. 3–4

Feature-space footprints

• Feature metrics can rank attacks differently: SS measures embedding-cluster geometry, whereas DSWD measures distribution shift along discriminative directions.SS is undefined for data-free DFBA because it uses poisoned training data, while DSWD remains measurable on triggered test inputs.Source: §3 · p. 4

Parameter-space footprints

• Grond generally has small UCLC and TAC footprints, while DFBA appears conspicuous under those measures but smaller under TUP's different aggregation and layer choice.The reported UCLC and TAC summaries use maxima across layers and the final convolutional layer, respectively.Source: §3 · p. 4

Architecture stability

• VGG16 feature rankings align with ResNet18 (τ=0.73, ρ=0.85), but ViT-Small aligns less (τ=0.35), especially when attack success drops.Parameter-space evaluation is not offered for ViT because UCLC and TAC target CNN channels; the architecture comparison is a stability check, not a separate benchmark.Source: §3 · p. 4

4. Diagnostic Metrics and Failure Modes

• CDBI and TUP target global feature-clustering and parameter-channel blind spots, respectively, as diagnostic additions rather than replacements for the broader suite.The benchmark’s examples include class-fragmented poisoned samples, channels that are trigger-responsive but weakly influential, and low-ASR configurations.Source: §4 · p. 4, §4.4 · p. 7

4.1. CDBI: Class-Conditional Feature Overlap

• CDBI compares poisoned source-class groups with the benign target-class cluster; higher CDBI indicates greater class-conditional overlap and a smaller footprint under this diagnostic.It is computed on the same t-SNE embeddings of penultimate-layer features used for SS, with perplexity 30.Source: §4.1 · pp. 4–5

4.2. When Does CDBI Differ from SS?

• SS measures global clean–poisoned clustering, while CDBI checks each source-class subgroup against the benign target cluster, so their rankings can differ for WaNet.This disagreement helps distinguish clean/poisoned separation from source-class fragmentation.Source: §4.2 · p. 5
• CDBI can look favorable when low ASR means triggered samples remain near clean features, so it should be interpreted with ASR and a global metric such as SS or DSWD.This limitation also applies to SS and DSWD.Source: §4.2 · p. 5

4.3. TUP: Joint Trigger Response and Downstream Influence

• TUP combines trigger-induced activation change with downstream channel influence; its ratio cancels shared trigger-magnitude effects, and lower values indicate a smaller concentrated footprint.It is reported over channels in the analyzed final convolutional layer and is a diagnostic, not a complete parameter-space definition.Source: §4.3 · pp. 5–6

4.4. When Does TUP Differ from UCLC and TAC?

• UCLC and TAC capture downstream influence and trigger response separately, whereas TUP tests their joint presence in channels of the analyzed layer.TUP is not a replacement for either metric, and layer choice matters.Source: §4.4 · pp. 6–7
• DFBA’s TUP values (10.2, 10.6, 3.9, and 13.5 on four datasets) are exceeded by several poisoning attacks.TUP can understate footprints when key channels lie outside the final convolutional layer or averaging dilutes a single-channel signal.Source: §4.4 · p. 7

5. Are Stealthiness Metrics Interchangeable?

• The analysis orients footprint metrics so larger values indicate larger footprints and uses Spearman rank correlations across 76 ResNet18 dataset–attack–poisoning-rate configurations.Spearman correlation tests agreement in attack ordering rather than linear metric scale.Source: §5 · p. 7
• Metrics cluster by observation space rather than one stealthiness axis, with strong input-space agreement but weaker feature- and parameter-space agreement.MSE and PSNR are rank-identical by construction; UCLC and TAC can rank attacks differently because they measure downstream influence and trigger-induced activation change.Source: §5 · p. 7, Table 12 · p. 8
• Input–feature and input–parameter correlations are near zero or negative, so attacks quiet in one space can remain loud in another.For the feature–parameter association, filtering to ASR ≥60% reduces pooled correlation from +0.35 to +0.29.Source: §5 · pp. 7–8, Figure 2 · p. 9
• CDBI and Silhouette Score are strongly rank-correlated overall (ρ ≈0.89 pooled; 0.78 within-dataset), placing CDBI in the same feature-metric family.Pooling datasets with different activation scales lowers parameter-space agreement (+0.50 within-dataset versus +0.27 pooled).Source: §5 · p. 8
• Input–parameter disagreement means reducing visible trigger footprints does not necessarily reduce internal concentration, and the two can move in opposite directions.Feature metrics measure representation separability, whereas parameter metrics detect whether behavior relies on a small set of influential channels.Source: §5 · p. 8

6.1. Footprints versus Attack Effectiveness

• The per-space winners remain stable after low-ASR filtering, but strict filtering leaves fewer usable configurations for some attacks.Filtering below 60% and 80% ASR removes 15 and 25 of the 76 configurations, respectively; the main qualitative conclusion remains unchanged.Source: §6.1 · p. 9
• No attack has the smallest measured footprint across all three spaces under any ASR filter; BppAttack, Adap-Patch, and Grond remain the respective space winners.At the 80% threshold, feature- and parameter-space winners each survive on a single high-ASR configuration, so interpret those rankings alongside survivor counts.Source: §6.1 · p. 10, Table 13 · p. 10

6.2. Defense Outcomes as External Checks

• Defense outcomes are defense- and attack-dependent: no defense provides a complete proxy for stealthiness, and associations are strongest when the mechanism aligns with the measured footprint.The external-check analysis evaluates ten defenses on CIFAR-10 and Imagenette.Source: §6.2 · p. 10

6.3. Defense–Footprint Association Analysis

• After controlling for dataset identity and pre-defense ASR, footprint associations remain structured by defense mechanism rather than uniformly predictive.Input-oriented defenses align most with input metrics, feature/sample detectors with feature metrics, and pruning or repair methods with parameter metrics; positive residual association indicates smaller footprints associated with stronger evasion.Source: §6.3 · pp. 10–11

7.1. Benchmark Artifact

• The benchmark standardizes attack outputs into common artifacts and lets metrics consume those artifacts without relying on attack-specific internals.It records configuration metadata and intermediate measurements to support auditing and adding attacks or metrics to the shared protocol.Source: §7.1 · p. 11

7.2. Recommendations

• Stealthiness evaluations should report attack effectiveness with per-space evidence and specify whether claims concern input, feature, parameter, or defense behavior.The suggested template pairs threat model and poisoning rate with benign accuracy and ASR, then covers pixel-level and perceptual, global and class-conditional, and trigger-response and downstream-influence measures where possible.Source: §7.2 · p. 11

7.3. Limitations

• The controlled protocol does not establish absolute attack rankings or deployment-independent stealthiness, especially because attacks differ in threat model, poisoning constraints, trigger construction, and training access.The authors characterize the results as controlled footprint measurements rather than definitive rankings.Source: §7.3 · pp. 11–12
• The metric suite is non-exhaustive: input metrics imperfectly proxy perception, feature metrics depend on embeddings and samples, and parameter metrics depend on architecture and layer.White-box metrics also assume access to triggers, poisoned data, model internals, or activation traces; comparable parameter measurements for transformers require architecture-specific definitions.Source: §7.3 · p. 12
• Because attackers could optimize directly against a fixed benchmark, the authors recommend diverse footprints and an extensible protocol instead of one scalar score.Source: §7.3 · p. 12

8. Related Work

• Early BadNets used visible patch triggers, while later attacks such as WaNet [3], Lira, and BppAttack [4] pursued imperceptible triggers through image processing or learned generators.These works established input-space stealth, while sufficiently subtle triggers can evade input-only defenses such as STRIP [16].Source: §8 · p. 12
• Feature-space defenses such as Activation Clustering [22] exploit latent clusters, motivating Adap-Patch and Adap-Blend to reduce triggered-feature separation.This line of work illustrates that input-space stealth does not guarantee feature-space stealth, and vice versa.Source: §8 · pp. 12–13
• Parameter-space work includes CLP [18], which prunes sensitive channels, and Grond, which trains to diffuse trigger influence across channels.The paper notes that resistance to selected feature-space defenses alone does not establish a uniformly small feature-space footprint.Source: §8 · p. 13
• Prior broad efforts include perceptual-metric studies focused mainly on input space [25] and BackdoorBench, which emphasizes attack effectiveness and defense evaluation.The proposed benchmark complements them by measuring observable footprints across input, feature, and parameter spaces and analyzing metric interchangeability.Source: §8 · p. 13

9. Conclusion

• Attacks with small footprints in one space often leave larger footprints in another, and existing metrics are not interchangeable.The study evaluates representative attacks across datasets, architectures, and metrics.Source: §9 · p. 13
• CDBI interprets class-conditional feature overlap, while TUP identifies channels that are both trigger-responsive and downstream influential.Both diagnostics augment rather than replace the broader metric suite.Source: §9 · p. 13
• Future evaluations should report attack effectiveness alongside multi-space footprints, specify which footprint is claimed, and avoid a single universal stealthiness score.Source: §9 · p. 13

Appendix A. t-SNE Embeddings for ResNet18 on CIFAR-10

• The cited passage reports that Figure 4 shows t-SNE embeddings for ResNet18 on CIFAR-10, identifying the model, dataset, visualization method, and figure location.Source: Appendix A · p. 14

• Footprints are evaluated using the Table 1 metrics across the specified datasets, architectures, and attacks.Source: Appendix B · p. 14
• Experiments use CIFAR-10/100, Imagenette, and Tiny-ImageNet, following BackdoorBench processing unless otherwise specified.Imagenette is center-cropped and downscaled to 80×80; Tiny-ImageNet uses its native 64×64 resolution.Source: Appendix B · p. 14
• The evaluated architectures are ResNet-18, VGG-16, and ViT-Small, with implementations aligned for comparable feature dimensions and training behavior.Source: Appendix B · p. 14
• The implementations draw on official repositories for the listed attacks and standardize normalization, batching, and trigger I/O across attacks.The paper details attack-specific settings and footprint-metric implementations in supplementary material.Source: Appendix B · p. 14
• Figure 4 shows CIFAR-10 training-set t-SNE embeddings, coloring benign samples blue and poisoned samples red; WaNet and Bpp use PR=0.02.Source: Figure 4 · p. 15

B.1. Training Settings

• Training uses SGD for 200 epochs, with batch sizes varying by dataset and poisoning rates generally set to 5% or 0.3%, subject to stated exceptions.All models train from scratch with momentum 0.9, weight decay 5×10^-4, and learning-rate milestones at epochs 100 and 150; clean-label attacks and selected CIFAR-10 attacks use adjusted rates.Source: §B.1 · p. 15

B.2. Additional Cross-Architecture Analysis

• VGG16 broadly follows ResNet18's combined feature-space ranking, whereas ViT-Small diverges, reflecting representation-geometry differences and low ASR for several attacks.Source: Figure 5 · p. 15, §B.2 · p. 15

Appendix C. Threat Model and Access Assumptions

• The threat model assumes clean inputs are classified correctly and triggered inputs are assigned the attacker-chosen target; attacks differ in attacker access.Five attacks poison part of the training data, four also control training, and DFBA modifies a trained model without training data.Source: Appendix C · p. 16
• Only UCLC can be computed from weights alone; other metrics require clean data and either the trigger or poisoned samples, while feature metrics, TAC, and TUP also require activations.The metrics are intended for offline evaluation with full access, not as detection methods for defenders lacking the trigger and poisoned data.Source: Appendix C · p. 16

Appendix D. Robustness Analysis

• The robustness appendix reports additional experiments, with complete results provided in supplementary material.Table 16 summarizes attack access and mean footprints; Table 17 summarizes metric information requirements.Source: Appendix D · p. 16, Table 16 · p. 16, Table 17 · p. 16

• WaNet's ASR ranges from 63.6% to 99.8%, with TUP values of 5.5 and 6.6 in weaker runs versus 8.9–9.6.Source: §D.1 · p. 16
• BadNets, Blend, and BppAttack vary by less than 0.5 percentage points in benign accuracy and ASR across seeds.Source: §D.1 · p. 16
• The stability analysis covers five training seeds and three target classes for four CIFAR-10 ResNet18 attacks, reporting median CV and averaged Kendall rank correlation.Source: Table 18 · p. 17
• Changing target class preserves the attack order for SS and DSWD, while CDBI and TAC swap a neighboring pair and UCLC changes considerably at target class 2.Feature-space rank correlations across seeds are lower mainly because close metric values can swap ordering; the DSWD values for BadNets, Blend, and BppAttack span 1.90–2.11 across five seeds.Source: §D.1 · p. 17

D.2. Uncertainty of the Metric Agreement

• +0.50 pooled within- versus across-space agreement gap (95% CI [0.28, 0.62]); excluding derived metrics, it remains +0.35 ([0.09, 0.52]).Attack-level bootstrap intervals preserve the gap among configurations with ASR ≥60%; input–parameter disagreement strengthens after low-ASR configurations are removed.Source: Table 19 · p. 17, §D.2 · p. 17

D.3. Remaining Configurations after ASR Filtering

• The ASR filters retain 61 of 76 configurations at 60% and 51 at 80%; Adap-Patch and Grond each retain only one at 80%.These attacks have the smallest feature-space and parameter-space footprints, respectively.Source: §D.3 · p. 17, Table 20 · p. 17

D.4. Re-runs of the Per-Space Winners

• Across 15 runs, Adap-Patch retains smaller SS and CDBI footprints and Grond smaller UCLC and TUP footprints than all 28 comparison models.All Grond runs and 13 Adap-Patch runs reached at least 80% ASR; DSWD and TAC values overlapped with comparison models.Source: §D.4 · pp. 17–18, Table 21 · p. 18

D.5. Sensitivity of CDBI to the Embedding

• CDBI rankings are stable across t-SNE seeds (mean correlation ≥0.93), but values vary 12–14% and t-SNE rankings agree only moderately with raw-feature rankings.The authors recommend comparing CDBI across attacks within one stated embedding, not treating it as an absolute value.Source: §D.5 · p. 18

D.6. Attack Success versus Footprint

• Input-space footprints show little ASR trade-off, but the smallest feature- and parameter-space footprints accompany lower ASR, so both measures should be reported together.The smallest feature-space footprint has 41.6% ASR; the two smallest parameter-space-footprint configurations have 76.6% and 92.9% ASR.Source: Figure 7 · p. 18, §D.6 · p. 18

Appendix E. Ethics Considerations

• The study uses offline experiments on public image-classification datasets and introduces neither a new attack nor an evasion method.The authors frame the work as defensive evaluation and intend the released artifacts for authorized research.Source: Appendix E · p. 19

F.1. Summary

• The paper organizes stealthiness measurements into input, feature, and parameter spaces and finds that measurements can disagree within and across spaces.Evidence of stealthiness in one space does not necessarily imply stealthiness in another.Source: §F.1 · p. 19

F.3. Reasons for Acceptance

• The meta-review highlights substantial cross-space disagreement, no uniformly stealthy evaluated attack, and an evaluation spanning ten attacks, datasets, architectures, metrics, seeds, target classes, and ASR thresholds.It presents the findings as guidance for future stealthiness evaluations.Source: §F.3 · p. 19