Backdoor Probe: Diagnostic and Control Methods

• Backdoor Probe is a controlled mechanism that exposes and characterizes latent trigger-conditioned behaviors in trained models across diverse modalities.
• Behavioral probing techniques, such as mask-aware scaling and adaptive adversarial perturbations, effectively differentiate between clean and poisoned inputs, achieving high AUROC scores.
• Active probe channels and mechanistic extraction approaches enable real-time control and diagnosis, supporting interventions that can suppress or amplify backdoor functionality in both image and language models.

Backdoor Probe denotes a controlled mechanism for exposing, characterizing, activating, suppressing, or isolating backdoor functionality in a trained system. In the literature, the term spans several distinct but related constructions: a defender-controlled trigger plus reversible decoding used to override malicious backdoors, a behavioral test based on input transformations or adversarial perturbations, a classifier trained on hidden states to read out trigger presence, an extracted model that retains only backdoor behavior, and an inversion procedure that reconstructs hidden triggers from generative dynamics (Wei et al., 2024, Pal et al., 2024, Yu et al., 26 Sep 2025, Yi et al., 19 Jun 2025). This breadth reflects a common objective: to turn latent, trigger-conditioned behavior into a measurable or controllable signal.

1. Conceptual scope and formalizations

At the most general level, backdoor attacks implant a hidden rule of the form “trigger $\rightarrow$ attacker-chosen behavior” while preserving normal behavior on clean inputs. In supervised classification this is typically a data-poisoning attack in which a model $f_\theta : \mathcal{X}\to\mathcal{Y}$ remains accurate on benign inputs $x$ but maps triggered inputs $x\oplus\Delta$ to a target label (Wei et al., 2024). A backdoor probe is then any procedure that tests whether such conditional behavior exists, or that exploits the same latent mechanism for diagnosis or control.

The literature contains several non-equivalent probe definitions. In "Backdoor Attribution," the Backdoor Probe is a layer-wise classifier $\mathcal{C}_i : \mathbb{R}^{d_m}\to\{1,0\}$ trained on hidden states to distinguish poisoned from clean inputs, thereby showing that trigger presence is encoded as a learnable internal feature (Yu et al., 26 Sep 2025). In BEAT, the probe is a harmful prompt sent to a LLM before the user query; the model’s refusal behavior under concatenation with the candidate input becomes the diagnostic signal (Yi et al., 19 Jun 2025). In PDB, the probe is a defender’s own trigger $\Delta_1$ together with an inverse mapping $h^{-1}$, used at inference to force the model into a defensive regime where the defender’s backdoor dominates the attacker’s (Wei et al., 2024).

This diversity is usefully summarized as a family resemblance rather than a single formalism.

Probe form	Signal or control channel	Representative works
Controlled trigger channel	Triggered prediction plus decoding or override	PDB, BEAT, Marksman, BaDe
Behavioral transformation test	Output invariance or distortion under controlled input changes	MSPC, A2P
Mechanistic extraction	Hidden-state classification, head attribution, or extracted backdoor submodel	BkdAttr, BaDExpert, PBE
Structural or generative probe	Subgraph injection, client-update tracing, or trigger inversion	Link-Backdoor, Dyn-Backdoor, Sniper, PureDiffusion

A recurring misconception is that a backdoor probe must reconstruct the original trigger. Several works do not do this. BaDExpert extracts backdoor functionality without recovering the trigger pattern (Xie et al., 2023). PBE uses untargeted adversarial examples as probes of backdoor neurons rather than trigger synthesis (Mu et al., 2022). Conversely, PureDiffusion is explicitly an inversion-based probe, because it reconstructs the hidden trigger itself (Truong et al., 2024).

2. Behavioral probing through controlled input transformations

One major lineage treats probing as a behavioral assay: the model is stimulated with controlled transformations, and the response pattern is used to separate clean from backdoored behavior.

The most explicit formulation is scaled prediction consistency (SPC). Given a trained classifier $\mathcal{F}_\theta$ and scaling factors $\mathcal{S}=\{2,3,\dots,12\}$, vanilla SPC computes the fraction of scales for which the predicted label is invariant under intensity scaling. The motivating observation is that poisoned samples often preserve the same prediction across aggressive scaling, whereas clean samples change more often (Pal et al., 2024). The paper then shows that vanilla SPC is insufficient in practice because of overlap between clean and backdoor SPC distributions, trigger vanishing under clipping, and the need for a manual threshold.

The proposed remedy is mask-aware SPC (MSPC). With a mask $\mathbf{m}$ and shift $f_\theta : \mathcal{X}\to\mathcal{Y}$0, the masked image is $f_\theta : \mathcal{X}\to\mathcal{Y}$1, and the MSPC loss evaluates whether the prediction on $f_\theta : \mathcal{X}\to\mathcal{Y}$2 remains consistent with the original prediction across scales. The mask is learned in a bi-level optimization that jointly separates samples into backdoor and clean subsets by the sign of MSPC, eliminating the need for clean reference data or manual thresholding (Pal et al., 2024). On CIFAR-10 with poisoning ratio $f_\theta : \mathcal{X}\to\mathcal{Y}$3, the reported average AUROC is approximately $f_\theta : \mathcal{X}\to\mathcal{Y}$4 for MSPC versus approximately $f_\theta : \mathcal{X}\to\mathcal{Y}$5 for SPC; on Tiny-ImageNet and ImageNet-200, the average AUROC reaches approximately $f_\theta : \mathcal{X}\to\mathcal{Y}$6 and $f_\theta : \mathcal{X}\to\mathcal{Y}$7, respectively. This establishes a probe in which the diagnostic signal is not the trigger itself but the model’s invariance to masked, shifted, and rescaled inputs.

A different behavioral probe appears in A2P, which uses adaptive adversarial perturbations rather than scaling. Its central claim is that universal backdoor detection is hard because triggers vary in size and transparency, so a single assumed patch form is inadequate (Wang et al., 2022). A2P therefore uses a global-to-local probing framework: it begins with global adversarial perturbations, then iteratively shrinks the probing region using an attention-guided mask derived from model gradients, while adaptively adjusting the perturbation budget by box-to-sparsity scheduling. The detector then examines softmax outputs across samples and applies MAD-based outlier analysis. On CIFAR-10, GTSRB, and Tiny-ImageNet, A2P improves Average Attacks detection accuracy by about $f_\theta : \mathcal{X}\to\mathcal{Y}$8 over the strongest baseline reported in the paper, with average AUROC $f_\theta : \mathcal{X}\to\mathcal{Y}$9, $x$0, and $x$1 on the three datasets (Wang et al., 2022).

These approaches share a precise operational logic. They do not assume that the hidden trigger is known; instead, they design a transformation family likely to intersect the learned shortcut. This suggests that a backdoor probe can be understood as a test of conditional invariance or conditional sensitivity under a stimulus family chosen to approximate latent trigger geometry.

3. Active trigger channels at inference time

A second lineage uses probes not merely to detect but to actively force or reveal backdoor behavior at inference.

PDB is the clearest defender-controlled example. Instead of detecting or removing poisons, it injects a proactive defensive backdoor during training by adding a secret trigger $x$2 and a reversible label mapping $x$3, typically $x$4 (Wei et al., 2024). At inference, every input is transformed to $x$5, the model predicts $x$6, and the defender recovers $x$7. The design goal is that whenever $x$8 is present, its effect dominates any malicious trigger $x$9. On CIFAR-10 with PreAct-ResNet18 and $x\oplus\Delta$0 poisoning, PDB reports ACC approximately $x\oplus\Delta$1–$x\oplus\Delta$2, ASR approximately $x\oplus\Delta$3–$x\oplus\Delta$4, and DER approximately $x\oplus\Delta$5–$x\oplus\Delta$6 across several attacks; for BadNets specifically, the paper reports ACC $x\oplus\Delta$7, ASR $x\oplus\Delta$8, and DER $x\oplus\Delta$9 (Wei et al., 2024). Here the probe is inseparable from an override mechanism: the model is always queried in a specially instrumented mode.

BEAT provides the corresponding black-box LLM formulation. It observes a “probe concatenate effect”: when a harmful probe prompt is concatenated with a triggered user input, the refusal behavior of a backdoored LLM collapses, whereas benign or untriggered harmful inputs have little effect (Yi et al., 19 Jun 2025). Formally, the detector decides between triggered and non-triggered inputs by comparing the output distributions $\mathcal{C}_i : \mathbb{R}^{d_m}\to\{1,0\}$0 and $\mathcal{C}_i : \mathbb{R}^{d_m}\to\{1,0\}$1 for a fixed harmful probe $\mathcal{C}_i : \mathbb{R}^{d_m}\to\{1,0\}$2, using a distance $\mathcal{C}_i : \mathbb{R}^{d_m}\to\{1,0\}$3 and threshold $\mathcal{C}_i : \mathbb{R}^{d_m}\to\{1,0\}$4. In practice, BEAT approximates the two output distributions by multiple samples, embeds the short responses, and computes Earth Mover’s Distance between the semantic vector sets (Yi et al., 19 Jun 2025). Across SFT-stage and RLHF-stage LLM backdoor attacks, the paper reports average AUROC approximately $\mathcal{C}_i : \mathbb{R}^{d_m}\to\{1,0\}$5–$\mathcal{C}_i : \mathbb{R}^{d_m}\to\{1,0\}$6 and TPR@FPR$\mathcal{C}_i : \mathbb{R}^{d_m}\to\{1,0\}$7 approximately $\mathcal{C}_i : \mathbb{R}^{d_m}\to\{1,0\}$8; it also reports strong performance on closed-source GPT-3.5-turbo and preliminary effectiveness against jailbreaks treated as “natural backdoors” (Yi et al., 19 Jun 2025).

Two adjacent constructions broaden the meaning of an active probe channel. Marksman defines a class-conditional trigger generator $\mathcal{C}_i : \mathbb{R}^{d_m}\to\{1,0\}$9 with $\Delta_1$0, enabling the attacker to choose an arbitrary target class $\Delta_1$1 at inference time so that $\Delta_1$2 (Doan et al., 2022). This turns the class label itself into a control parameter. BaDe uses two trigger types to instantiate an artificial bias variable $\Delta_1$3, then applies inverted triggers to construct a balanced dataset for debiasing via distillation (Wu et al., 2023). In both cases, the probe is a deliberately engineered conditional channel whose semantics are known to the controller.

A common misconception is that backdoors are only a liability. PDB and BaDe show that the same mechanism can be repurposed as a controlled probe or intervention channel, although both papers also emphasize the attendant secrecy and security constraints (Wei et al., 2024, Wu et al., 2023).

4. Representation-level and model-internal probes

A third lineage moves probing inside the model and asks whether backdoor functionality can be localized, read out, or distilled.

Backdoor Attribution makes this explicit. For a backdoor-injected LLM, the Backdoor Probe is trained on layer-$\Delta_1$4 hidden states $\Delta_1$5 at the last token to classify clean versus poisoned inputs (Yu et al., 26 Sep 2025). Across Llama-2-7B-chat and Qwen-2.5-7B-Instruct, and across label-modification, fixed-output, and jailbreak backdoors, the paper reports $\Delta_1$6–$\Delta_1$7 test accuracy for same-layer probe classification. Inter-layer classification accuracy further suggests that backdoor features are progressively transformed and become more uniform in deeper layers (Yu et al., 26 Sep 2025). This probe then seeds Backdoor Attention Head Attribution (BAHA), which identifies sparse responsible heads; ablating approximately $\Delta_1$8 of total heads reduces ASR by over $\Delta_1$9, and the resulting Backdoor Vector can, with a one-point intervention on a single representation, raise ASR on clean inputs up to approximately $h^{-1}$0 or suppress ASR on triggered inputs down to approximately $h^{-1}$1 (Yu et al., 26 Sep 2025).

PBE reaches a similar diagnosis from a different angle. It shows that in infected classifiers, untargeted adversarial examples behave like triggered images: they are highly concentrated in the backdoor target label, and their feature representations are much closer to trigger features than are adversarial examples from benign models (Mu et al., 2022). The paper reports that across BadNet, Blend, SIG, DynamicAtt, and WaNet, and across several datasets, at least approximately $h^{-1}$2 of adversarial examples from infected models are classified as the backdoor target. It then uses these adversarial examples as probes of “backdoor neurons” and progressively fine-tunes the model to erase the exclusive trigger-target correlation. In the no-clean-data setting, the clean identification average precision rises from approximately $h^{-1}$3 to approximately $h^{-1}$4 over iterations (Mu et al., 2022).

BaDExpert adopts a post-development functional probe. Starting from a suspect model $h^{-1}$5 and a small clean set $h^{-1}$6, it fine-tunes a copy $h^{-1}$7 on intentionally mislabelled clean samples, typically with labels shifted by $h^{-1}$8, so that normal functionality is forgotten while backdoor functionality is preserved (Xie et al., 2023). The resulting “backdoor expert” is then compared with both the original model and a clean-finetuned auxiliary model at inference. On CIFAR-10, across 12 attacks, the paper reports average AUROC $h^{-1}$9; as a defense, average CA remains $\mathcal{F}_\theta$0 while average ASR drops to $\mathcal{F}_\theta$1 (Xie et al., 2023). Here the probe is a derived model that approximates the backdoor manifold itself.

These works converge on a strong claim: backdoor functionality is often not diffuse in an unstructured sense. It can appear as a learnable representation feature, a sparse set of responsible heads, a preserved sub-function after catastrophic forgetting, or an activation pattern shared with adversarial examples. This suggests that mechanistic probing and behavioral probing are complementary rather than competing strategies.

5. Cross-domain probes in generative, graph, and federated systems

Backdoor probes are not confined to standard image classification. Several works generalize the idea to diffusion models, graphs, dynamic networks, and federated learning.

PureDiffusion treats a suspicious diffusion model as its own probeable dynamical system. For a backdoored DDPM, it derives a timestep-dependent trigger-shift scale $\mathcal{F}_\theta$2 and then reconstructs the hidden trigger by minimizing $\mathcal{F}_\theta$3 over a candidate trigger $\mathcal{F}_\theta$4 (Truong et al., 2024). The method first estimates $\mathcal{F}_\theta$5 by “double-backdooring” the model with a surrogate trigger, then performs multi-timestep trigger inversion through the reverse process. On various trigger-target pairs, PureDiffusion substantially outperforms Elijah in fidelity and ASR; in several cases, the inverted trigger attains higher attack success rate than the original trigger (Truong et al., 2024). This is a literal inversion probe: it reconstructs the hidden activation key rather than merely flagging its effects.

Graph-based papers reinterpret small subgraphs as probes of structural vulnerability. Link-Backdoor shows that injecting a tiny subgraph $\mathcal{F}_\theta$6 around a target link $\mathcal{F}_\theta$7 can force a link predictor to output an attacker-chosen state while keeping benign AUC nearly unchanged; the optimized trigger is obtained by gradients with respect to trigger adjacency and injected-node features (Zheng et al., 2022). Motif-Backdoor then reframes trigger choice through motif statistics, showing that rare or target-label-skewed motifs yield stronger attacks and that structurally similar motifs can form activating “series” (Zheng et al., 2022). Dyn-Backdoor extends this logic to dynamic link prediction by using temporal subgraph sequences and gradient-based trigger selection over time (Chen et al., 2021). These results suggest that, in graph settings, a backdoor probe is naturally a controlled subgraph or subgraph sequence whose effect is measured on a target edge or node pair.

In federated learning, Sniper Backdoor uses model inversion and a Siamese neural network to probe client updates rather than data points. A GAN with the client model as discriminator reconstructs client-specific synthetic data, a shadow FL system generates representative trajectories, and a triplet-trained Siamese network links anonymous updates across rounds (Abad et al., 2022). Only after this probing phase does the server inject a backdoor into a single victim client’s model. The paper reports SNN identification accuracies around $\mathcal{F}_\theta$8 on IID MNIST and up to $\mathcal{F}_\theta$9 backdoor ASR with minimal clean degradation (Abad et al., 2022). The probe here is neither a trigger nor a classifier on hidden states; it is an update-signature matching procedure that turns anonymity into an attack surface.

Across these domains, a backdoor probe retains the same functional role: it is a minimal intervention or measurement that makes hidden conditional behavior observable. What varies is the controlled object—pixels, prompts, hidden states, timesteps, subgraphs, or client trajectories.

6. Broader implications, controversies, and limits

The literature supports several broad conclusions. First, there is no single canonical Backdoor Probe. The term now covers behavioral tests, inference-time trigger channels, mechanistic classifiers, extracted submodels, inversion routines, and structural interventions. Any encyclopedic treatment must therefore be typological rather than monolithic.

Second, probes reveal that backdoors are not solely an image-classification phenomenon. They appear in LLM refusal dynamics (Yi et al., 19 Jun 2025), hidden-state circuits (Yu et al., 26 Sep 2025), diffusion denoising trajectories (Truong et al., 2024), graph motifs and node injections (Zheng et al., 2022, Zheng et al., 2022), dynamic graph sequences (Chen et al., 2021), and federated client-update signatures (Abad et al., 2022). This suggests that “trigger-conditioned latent shortcut” is the more invariant concept, with the probe defined by the modality-specific intervention that exposes it.

Third, adaptive settings matter. MSPC still reports high AUROC under a strong white-box adaptive attack, but does not claim immunity to all adaptive strategies (Pal et al., 2024). BEAT degrades if the attacker knows the exact harmful probe and explicitly trains the backdoor to preserve refusal on that probe, though the paper characterizes this as unrealistic in ordinary deployment and shows strong robustness in standard black-box settings (Yi et al., 19 Jun 2025). PDB remains effective under adaptive attackers with larger malicious triggers and higher poisoning ratios, but it fundamentally assumes the defender controls the training process and keeps the defensive trigger secret (Wei et al., 2024). PBE is notably weaker on visible-trigger BadNet in the no-clean-data setting (Mu et al., 2022).

Fourth, physical and non-ML settings complicate naive probe assumptions. "Backdoor Attack in the Physical World" shows that static-trigger image backdoors can be highly sensitive to small changes in location or appearance, and argues that effective probing should sweep positions, appearances, and transformations such as Flip and ShrinkPad rather than rely on a single fixed patch (Li et al., 2021). Outside machine learning, BSEA-1 shows that mathematical backdoors in stream ciphers can pass statistical testing while remaining exploitable through hidden structural correlations; in that setting, probing must inspect Boolean-function spectra and key-dependent internal structure rather than black-box randomness alone (Filiol, 2019). This suggests that the probe concept extends beyond learned models whenever hidden conditional behavior must be structurally elicited rather than directly observed.

Finally, a persistent controversy concerns whether probes themselves increase attack capability. PureDiffusion can produce inverted triggers that outperform the originals in some cases (Truong et al., 2024). Backdoor Attribution’s Backdoor Vector can both suppress and amplify ASR (Yu et al., 26 Sep 2025). Marksman turns backdoor triggering into an arbitrary-target control interface (Doan et al., 2022). These examples indicate that probing and exploitation are often dual use. A backdoor probe is therefore best understood not as a defense primitive alone, but as a diagnostic-control primitive whose security value depends on who controls it, what assumptions it makes, and how tightly it is coupled to deployment.