Backdoor Attribution (BkdAttr) Techniques

• Backdoor Attribution is a family of methods designed to identify and localize triggers that cause anomalous behavior by separating injected backdoors from natural discriminative features.
• It leverages a range of paradigms—including symmetric feature differencing, black-box reverse engineering, and mechanistic attribution in LLMs—to trace backdoor effects to specific neurons, attention heads, or training examples.
• Evaluations demonstrate notable accuracy improvements and reduced false positives, even in clean-label and modality-specific attack scenarios, underscoring its practical utility in forensic analysis.

Backdoor attribution concerns the problem of determining whether anomalous model behavior is caused by an injected trigger or by natural features, localizing the features or components that realize the behavior, and, in some settings, tracing that behavior back to specific poisoned data. The term appears in the literature in both a broad and a narrow sense: broadly, it covers methods that distinguish injected backdoors from natural class features, attribute trigger effects to input tokens, subgraphs, modalities, or internal circuits, and support forensic tracing; narrowly, it also denotes the tripartite causal analysis framework for LLM backdoors built from a Backdoor Probe, Backdoor Attention Head Attribution (BAHA), and a Backdoor Vector (Liu et al., 2021, Yu et al., 26 Sep 2025).

1. Problem formulation and conceptual scope

A central difficulty in backdoor attribution is that models can respond to “natural triggers” as well as injected ones. EX-RAY formalizes this as the problem of distinguishing features that naturally separate a victim class and a target class from features corresponding to an injected backdoor; its premise is that mis-recognizing natural features as injected triggers causes false warnings in backdoor scanning (Liu et al., 2021). This immediately makes attribution more demanding than attack detection alone: the objective is not merely to find a feature that flips a prediction, but to determine whether that feature is part of the model’s ordinary class discrimination mechanism.

The literature also emphasizes a stronger impossibility-style claim. “Rethinking Backdoor Attacks” argues that without structural information about the training data distribution, backdoor attacks are indistinguishable from naturally-occurring features in the data, and thus impossible to “detect” in a general sense (Khaddaj et al., 2023). In that formulation, a feature is a function $\phi:\mathcal{X}\rightarrow\{0,1\}$, its support is $\text{supp}_\phi(S)=\{z=(x,y)\in S\mid \phi(x)=1\}$, and attribution reduces to identifying unusually strong features rather than directly identifying maliciousness. The paper’s “strongest feature” perspective therefore reframes attribution as a structured inference problem that necessarily depends on assumptions about the data or the attack.

This broad view accommodates several attribution targets. Some methods attribute anomalous behavior to a minimal set of distinguishing neurons or to a reversed trigger pattern; some attribute the behavior to a sparse set of attention heads or neurons; some attribute backdoor activation across modalities; and some attempt post hoc forensic attribution to the poisoned training examples responsible for a malicious output. The diversity of targets suggests that backdoor attribution is less a single algorithm than a family of attribution problems at multiple levels of abstraction.

2. Core algorithmic paradigms

One influential paradigm is symmetric feature differencing (SFD), introduced by EX-RAY. Let $F(x)=h(g(x))$ split a network at layer $l$, with activations $z_v=g(x_v)$ for victim-class examples and $z_t=g(x_t)$ for target-class examples. SFD searches for the smallest mask $M\in[0,1]^n$ such that swapping the masked activations in both directions preserves the respective class identities:

$$h(z_v\cdot M + z_t\cdot (1-M)) = V,\qquad h(z_v\cdot (1-M) + z_t\cdot M) = T.$$

The corresponding loss combines sparsity and two cross-entropy terms, and attribution is then based on overlap between the mask for natural class differences and the mask induced by a candidate trigger. The similarity score is

$$\text{Score}=\frac{\operatorname{sum}(\min(M_1,M_2))}{\min(\operatorname{sum}(M_1),\operatorname{sum}(M_2))},$$

with triggers above threshold $\beta$ treated as natural rather than injected (Liu et al., 2021). Empirically, this removes 78–100% of the false positives of ABS with a 0–30% increase in false negatives, yielding 17–41% overall accuracy improvement, and it also improves detection for several semantic backdoor attacks.

A second paradigm is black-box reverse engineering. B3D detects backdoors with only query access by searching, for each class $\text{supp}_\phi(S)=\{z=(x,y)\in S\mid \phi(x)=1\}$0, for a small mask $\text{supp}_\phi(S)=\{z=(x,y)\in S\mid \phi(x)=1\}$1 and pattern $\text{supp}_\phi(S)=\{z=(x,y)\in S\mid \phi(x)=1\}$2 that make inputs classify as $\text{supp}_\phi(S)=\{z=(x,y)\in S\mid \phi(x)=1\}$3:

$\text{supp}_\phi(S)=\{z=(x,y)\in S\mid \phi(x)=1\}$4

Because gradients are unavailable, B3D uses a Natural Evolution Strategies-like gradient-free optimization over distributions for $\text{supp}_\phi(S)=\{z=(x,y)\in S\mid \phi(x)=1\}$5 and $\text{supp}_\phi(S)=\{z=(x,y)\in S\mid \phi(x)=1\}$6, then attributes the backdoor to whichever class admits an outlier-small trigger (Dong et al., 2021). This is attribution-by-minimal-modification: a target class whose optimized mask has unusually small $\text{supp}_\phi(S)=\{z=(x,y)\in S\mid \phi(x)=1\}$7 is deemed suspicious.

A third paradigm is functional attribution. “Mechanistic Anomaly Detection via Functional Attribution” uses influence functions and parameter-space sampling to measure whether a test sample is functionally coupled to a trusted clean set. Classical influence functions use

$\text{supp}_\phi(S)=\{z=(x,y)\in S\mid \phi(x)=1\}$8

while the paper builds on Bayesian influence functions,

$\text{supp}_\phi(S)=\{z=(x,y)\in S\mid \phi(x)=1\}$9

and aggregates these correlations into a detection score over trusted samples (Keenan et al., 21 Apr 2026). On BackdoorBench, this functional-attribution BkdAttr achieves an average Defense Effectiveness Rating (DER) of 0.93 across seven attacks and four datasets, versus 0.83 for the next best baseline; for LLMs, it reports AUROC $F(x)=h(g(x))$0 across several backdoor types, including explicitly obfuscated models.

Representative attribution targets are summarized below.

Attribution target	Representative method	Key mechanism
Natural vs. injected features	EX-RAY	Symmetric feature differencing
Target class under black-box access	B3D	Reverse-engineered minimal trigger
Internal backdoor circuitry in LLMs	BkdAttr, SafeSeek	Head/neuron or circuit attribution
Poisoning source data	CodeTracer	Forensic fingerprint and retrieval

3. Clean-label, semantic, and attribution-evasive backdoors

Backdoor attribution becomes markedly harder when the attack is clean-label and semantically entangled with the input. BAAT begins from the observation that directly generalizing existing sample-specific backdoor attacks (SSBAs) to clean-label settings is ineffective because of two factors: the “antagonistic effects” of ground-truth features and the learning difficulty of sample-specific features (Zhu et al., 2023). Its response is to replace content-irrelevant noise with content-relevant, human-relied attributes as triggers. Formally, with training set $F(x)=h(g(x))$1, a target-label subset $F(x)=h(g(x))$2, and attribute editor $F(x)=h(g(x))$3, poisoned images are $F(x)=h(g(x))$4 and the poisoned training set is

$F(x)=h(g(x))$5

The paper reports ASR of 59–80% on VGGFace2 and ImageNet clean-label scenarios, with benign accuracy above 77% for VGGFace2 and above 82% for ImageNet, and notes that Neural Cleanse, SentiNet, STRIP, and SCALE-UP fail to reliably recover or distinguish its triggers (Zhu et al., 2023). For attribution, the key point is that BAAT’s triggers are content-distributed, sample-specific, and plausible semantic variations, so there is no consistent, easily extractable low-level artifact.

Textual style-based attacks sharpen the same issue. AttrBkd uses subtle, fine-grained style attributes as clean-label triggers and evaluates subtlety with human annotation rather than only automated similarity metrics. The paper introduces Attack Invisibility Rate (AIR),

$F(x)=h(g(x))$6

and reports that AttrBkd with baseline-derived attributes improves AIR by 15.6 percentage points over baselines on average while maintaining or exceeding attack success rate (You et al., 24 Apr 2025). It also argues that automated metrics such as ParaScore and USE do not strongly correlate with human judgments of subtlety or invisibility. This indicates that attribution methods tied to conspicuous lexical or surface-level anomalies can systematically underestimate clean-label backdoors that operate through plausible stylistic attributes.

These results bear directly on a common misconception: that image-label inconsistency or visibly unusual inputs are the defining signature of a backdoor. BAAT explicitly identifies poisoned-label anomalies as a weakness of prior SSBAs and then removes that weakness, while AttrBkd shows that human-centered subtlety and automated similarity can diverge substantially. A plausible implication is that attribution methods anchored to localized, sample-agnostic triggers are intrinsically fragile against content-relevant or style-based poisoning.

4. Mechanistic attribution in LLMs

In the narrow sense of the term, Backdoor Attribution (BkdAttr) names a tripartite causal analysis framework for LLM backdoors. Its first component, the Backdoor Probe, trains a classifier $F(x)=h(g(x))$7 on hidden states from layer $F(x)=h(g(x))$8 to distinguish triggered and clean inputs, and evaluates inter-layer generalization through Inter-Layer Classification Accuracy:

$F(x)=h(g(x))$9

The reported result is that SVM or MLP probes achieve 90–100% test accuracy, indicating that non-embedding representations contain learnable backdoor features (Yu et al., 26 Sep 2025).

The second component, BAHA, attributes backdoor processing to individual attention heads. With attention output decomposed as $l$0, average poisoned activation for head $l$1 is

$l$2

and head importance is measured by a causal indirect effect obtained by substituting $l$3 into clean inputs. The paper reports that the responsible heads are sparse: ablating about 3% of total heads is sufficient to reduce ASR by over 90% (Yu et al., 26 Sep 2025).

The third component is the Backdoor Vector,

$l$4

constructed from the top-$l$5 attributed heads. Adding $l$6 to a single clean representation can raise ASR up to $l$7, while subtracting it from a triggered representation can suppress ASR down to $l$8 through a 1-point intervention on a single representation (Yu et al., 26 Sep 2025). The key encyclopedic significance of this framework is that it treats backdoor attribution not only as localization, but also as mechanistic control.

SafeSeek extends this line of work from attributed heads to functionally complete safety circuits. It introduces differentiable binary masks for weights, neurons, heads, or layers and optimizes

$l$9

For backdoors, it further uses dual-mask optimization to separate a sparse backdoor circuit from a dense clean subgraph (Yu et al., 24 Mar 2026). In the reported backdoor setting, SafeSeek identifies a backdoor circuit with 0.42% sparsity; ablating that circuit reduces ASR from 100% to 0.4% while retaining over 99% general utility. Relative to head-level BAHA, this shifts attribution from sparse loci to sparse but functionally complete subnetworks.

5. Modality-specific and forensic instantiations

In text classification, AttDef treats high-attribution tokens as potential triggers and couples this with ELECTRA-based poison pre-filtering. Using Layer-wise Relevance Propagation, it computes token attribution

$z_v=g(x_v)$0

normalizes scores to $z_v=g(x_v)$1, and regards tokens with $z_v=g(x_v)$2 as candidate triggers. In the pre-training setting it also constructs a trigger prior from label association strength,

$z_v=g(x_v)$3

Across four benchmark datasets and two insertion-based attacks, AttDef reports an average accuracy of 79.97% for pre-training defense, up 56.59%, and 48.34% for post-training defense, up 3.99% (Li et al., 2023). The method is explicitly framed as advancing prior BkdAttr/BFClass-style approaches by moving from global word-label statistics to instance-aware attribution.

In graph learning, XGBD uses explanation methods such as SubgraphX, GNNExplainer, or PGExplainer to extract an explanatory subgraph $z_v=g(x_v)$4 and then detects backdoors by thresholding the loss on that subgraph. Detector training uses the trap loss

$z_v=g(x_v)$5

and detection applies a threshold $z_v=g(x_v)$6 to the explanatory-subgraph loss (Guan et al., 2023). The paper reports detection accuracy typically above 90% and AUC typically above 0.9 across multiple graph datasets and attacks, with visualizations showing that explanatory subgraphs for poisoned samples closely match trigger nodes.

In multimodal diffusion, the attribution object is not a token or a head but the contribution of each modality. “When One Modality Rules Them All” defines backdoor modality collapse as the condition in which activation is effectively governed by triggers from a strict subset $z_v=g(x_v)$7 of modalities. It introduces Trigger Modality Attribution (TMA), a Shapley-value attribution over modalities, and Cross-Trigger Interaction (CTI),

$z_v=g(x_v)$8

to quantify synergy or redundancy (Wang et al., 6 Mar 2026). The reported finding is a “winner-takes-all” dynamic: in many settings, text has TMA near 0.95 while image contribution is near zero, and CTI is negative or approximately zero. This makes attribution necessary for interpreting joint-trigger ASR, since high overall ASR may mask reliance on a single dominant modality.

At the data-source level, CodeTracer addresses forensic attribution of backdoored code completions. Given a reported malicious completion and the fine-tuning corpus, it extracts a structured behavioral fingerprint, retrieves semantically similar code snippets using

$z_v=g(x_v)$9

and then uses LLM-based reasoning to decide whether each candidate implements the same unsafe logic (Gao et al., 9 Jul 2026). Across three vulnerability cases, ten backdoor attacks, and sixteen baselines, CodeTracer reports FNR $z_t=g(x_t)$0, FPR $z_t=g(x_t)$1, and DACC $z_t=g(x_t)$2, extending backdoor attribution from trigger localization to post-deployment forensic tracing.

6. Evaluation protocols, adjacent uses, and unresolved questions

Backdoor-based evaluation has also been used to assess attribution methods themselves. BackX defines four fidelity criteria for attribution benchmarks—Functional Mapping Invariance, Input Distribution Invariance, Attribution Verifiability, and Metric Sensitivity—and builds a benchmark in which known backdoor triggers supply verifiable attribution targets (Yang et al., 2024). For a poisoned input, recovery is performed by replacing the top-$z_t=g(x_t)$3 attributed region with the corresponding clean region:

$z_t=g(x_t)$4

Evaluation then measures Trigger Recall, Attack Success Rate after recovery, and a fractional change in logits or probabilities. In this sense, backdoor attribution is not only a defense problem but also a calibration tool for attribution fidelity.

Robust attribution under attack has become a separate theme. EnsembleSHAP, developed for the random subspace method, defines feature importance for feature $z_t=g(x_t)$5 and predicted label $z_t=g(x_t)$6 as

$z_t=g(x_t)$7

proves local accuracy,

$z_t=g(x_t)$8

and provides a certified lower bound on how many manipulated features must appear in the top-$z_t=g(x_t)$9 explanation when a bounded-budget attack changes the ensemble’s decision (Wang et al., 31 Mar 2026). The paper describes this as the first work to establish provable robustness against explanation-preserving attacks, including backdoor-trigger attacks.

The relationship between backdoor attribution and model watermarking is now explicitly contested. Backdoor-based watermarks use misclassification behavior as a verification signal, but EaaW argues that such schemes are harmful and ambiguous because they introduce exploitable backdoors and rely on “zero-bit” prediction status rather than information-rich verification. EaaW therefore embeds a multi-bit watermark in feature attribution explanations instead of predictions, while noting that BkdAttr uses feature attribution for watermark verification only as an auxiliary validation of backdoor triggers that still cause misclassification or label change (Shao et al., 2024). This marks a conceptual boundary: attribution can be used either to study and control malicious behavior, or to move verification away from malicious behavior.

Two unresolved issues recur across the literature. First, attribution is assumption-laden: without structural information, detecting maliciousness rather than merely identifying a strong feature is, by construction, ill-posed (Khaddaj et al., 2023). Second, attribution methods that rely on common, low-level, localized patterns are stressed by clean-label, semantic, distributed, or modality-collapsed backdoors (Zhu et al., 2023, Wang et al., 6 Mar 2026). Current results therefore suggest a research agenda centered on stronger data curation and provenance verification, functionally grounded attribution rather than latent heuristics, and evaluation protocols that separate localization quality from the deeper question of whether an attributed feature is genuinely injected.