Backdoor Trigger Injection Overview

• Backdoor trigger injection is a technique that embeds hidden malicious triggers in ML models, ensuring nominal behavior on clean inputs but activating specified responses on tainted ones.
• It spans diverse injection spaces—including pixel, frequency, structural, and textual domains—to conduct cross-modal attacks and meet varying threat models.
• Recent advances focus on adaptive, multi-trigger/multi-target schemes and integrated defenses that optimize training objectives while evading detection.

Searching arXiv for the cited and closely related work on backdoor trigger injection to ground the article in the literature. arxiv_search(query="backdoor trigger injection backdoor attacks triggers frequency transformation graph prompt diffusion learned compression", max_results=10, sort_by="relevance") Backdoor trigger injection is the process of implanting hidden malicious behavior into a learned model by associating a trigger-embedding operator with an attacker-chosen response. In its canonical form, a benign model $\mathcal{F}:\mathcal{X}\rightarrow\mathcal{Y}$ is replaced by a backdoored model $\mathcal{G}$ such that clean inputs preserve nominal behavior, while triggered inputs invoke a predefined target behavior or label (Li et al., 2020). Although early formulations emphasized visible pixel patches, later work generalized trigger injection to transformation, frequency, structural, temporal, token, and latent-conditioning spaces, making the topic a cross-modal problem spanning vision, graph learning, sequential anomaly detection, reinforcement learning, Text-to-SQL, LLMs, and diffusion systems (Wang et al., 2023).

1. Formal definition and threat model

A standard formalization defines a trigger specification $\tau$ and a trigger-embedding operator $\mathcal{T}:\mathcal{X}\rightarrow\mathcal{X}$, with a perfect backdoor satisfying

$$\mathcal{G}(x)= \begin{cases} \mathcal{F}(x), & x\notin \mathcal{T}(\mathcal{X}) \ R, & x\in \mathcal{T}(\mathcal{X}), \end{cases}$$

where $R\in\mathcal{Y}$ is the attacker’s target label (Li et al., 2020). For pixel-space triggers, a common instantiation is

$\mathcal{T}(x;\tau)=(1-m)\odot x + m\odot p,$

with binary mask $m$ and pattern $p$ (Li et al., 2020).

A more general formulation makes the injection space explicit. UNICORN defines a trigger-injection function

$$x' = T_t(x) \coloneqq \phi^{-1}\bigl((1-m)\circ\phi(x) + m\circ t\bigr),$$

where $\mathcal{G}$0 is an invertible transformation into an injected space, $\mathcal{G}$1 is a mask in that space, and $\mathcal{G}$2 is the trigger pattern (Wang et al., 2023). This formulation subsumes patch overwriting, global blending, DCT-domain replacement, filtering, warping, quantization, and token- or embedding-level modifications.

Threat models vary by application. In poisoning-based settings, the attacker modifies a fraction of the training data and relies on standard training to memorize the trigger-target association. BATT makes this explicit with a “poison-only” adversary who can read and modify a small fraction of the victim’s training set but cannot change the model architecture, loss, or training pipeline, while seeking high benign accuracy, high attack success rate (ASR), and stealthiness (Xu et al., 2022). Clean-label variants preserve original labels and instead force the model to rely on the trigger as a discriminative shortcut, as in clean-label feature-space attacks, temporal chrominance poisoning, and BITE’s word-level perturbations (Li et al., 2020).

2. Injection spaces and trigger representations

The design space of triggers is broader than compact pixel patches. The literature enumerates localized patches or objects, shape-based logo-style triggers, and global image stylizations or filters, but also frequency, signal, feature, numerical, and token spaces (Li et al., 2020). UNICORN’s taxonomy makes these spaces explicit and provides a unified inversion target across them (Wang et al., 2023).

Injection space	Representative formulation	Representative papers
Pixel and spatial	$\mathcal{G}$3; rotation or translation with a secret parameter	(Li et al., 2020, Xu et al., 2022)
Frequency, signal, and temporal	DCT-domain replacement, selective frequency fusion, temporal blue-channel cosine modulation	(Yu et al., 2023, Song et al., 2024, Guo et al., 2022)
Structural and textual	Feature-coordinate overwrite, injected subgraph, relation-based metapath, token or character trigger	(Xu et al., 2023, Zheng et al., 2022, Chen et al., 30 May 2025, Lin et al., 7 Mar 2025)

In image compression, trigger injection can occur directly in the DCT domain. A representative construction slices an image into non-overlapping patches, applies a 2D DCT to each patch, adds a patch-wise trigger tensor, and reconstructs the poisoned image by inverse DCT; the trigger itself is a learnable tensor with nonzero entries limited to $\mathcal{G}$4 mid-frequency coefficients per channel and modulated across patches by a lightweight U-Net (Yu et al., 2023). Face restoration adopts a related frequency-domain strategy, but with selective frequency fusion in a U-Net-style generator and a learned mask implicit in frequency fusion modules (Song et al., 2024).

Transformation-based triggers replace additive perturbations by parameterized spatial transforms. BATT uses rotation and translation as triggers, for example $\mathcal{G}$5 with a secret angle or $\mathcal{G}$6 with a secret shift (Xu et al., 2022). In video anti-spoofing, the trigger can be purely temporal: the blue channel of frame $\mathcal{G}$7 is multiplied by $\mathcal{G}$8, with the paper reporting that $\mathcal{G}$9 is effective and $\tau$0 is imperceptible during poisoning (Guo et al., 2022).

Graph settings replace pixel masks by structural or feature-space insertion. Xu et al. define MIAS and LIAS as feature-coordinate injection into the most important or least important features ranked by GNNExplainer saliency (Xu et al., 2023). Link-Backdoor defines the trigger as a small injected subgraph consisting of two target nodes plus $\tau$1 fake nodes, optimized by gradients with respect to trigger adjacency and features (Zheng et al., 2022). HGBA replaces subgraph triggers with a relation-based trigger: a backdoor metapath connecting a trigger node to a poisoned node via typed relations in a heterogeneous graph (Chen et al., 30 May 2025).

Textual systems similarly admit multiple trigger granularities. BITE iteratively selects high-$\tau$2-score trigger words and injects them through MLM-constrained word substitutions or insertions (Yan et al., 2022). ToxicSQL uses semantic triggers such as “Sudo” and character-level triggers such as “??” or “:”, chosen because they remain close to clean-input perplexity while activating malicious SQL payload generation (Lin et al., 7 Mar 2025).

3. Training-time injection and optimization objectives

The basic poisoning pipeline follows a common pattern: choose a trigger, select a subset of training samples, inject the trigger, assign clean or malicious labels according to the attack type, and train on the union of clean and poisoned data (Li et al., 2020). In the simplest poison-and-flip formulation, the total objective is

$\tau$3

while clean-label attacks keep the original label and instead optimize feature-space alignment or sample selection so that the model internalizes the trigger as the necessary explanatory feature (Li et al., 2020).

Compression attacks require task-specific objectives because the attacker may target rate, distortion, or downstream task behavior rather than a class label. One formulation preserves clean rate–distortion performance with

$\tau$4

and then augments it with attack losses such as a BPP objective

$\tau$5

or a PSNR objective that keeps bitrate approximately constant while decreasing reconstruction PSNR (Yu et al., 2023). The same work introduces a dynamic balancing strategy based on $\tau$6 so that rate and distortion terms are held in check without fixed hand-tuned trade-offs (Yu et al., 2023).

Several papers optimize trigger injection under explicit stealth constraints. BITE retains only word-level operations whose MLM probability exceeds a threshold, whose semantic similarity to the original sentence remains high, and whose total number respects an operation budget (Yan et al., 2022). The temporal chrominance attack selects poisoned samples via an Outlier Poisoning Strategy (OPS), choosing “hard” alive videos using a surrogate detector and optionally applying a small PGD perturbation before trigger insertion; the trigger amplitude is chosen to exploit reduced human sensitivity to blue-channel perturbations (Guo et al., 2022). ToxicSQL fine-tunes on a combined clean-plus-poison objective, inserting triggers into natural-language questions and replacing gold SQL with malicious SQL targets (Lin et al., 7 Mar 2025).

At the far end of optimization complexity, revocable backdoor attacks formulate trigger injection as a bilevel problem. The trigger generator is optimized so that the backdoor is effective before unlearning but easily erased after unlearning; the outer loss combines attack, unlearning, visibility, and non-adversarial terms, while the authors use a deterministic partition of poisoning and forgetting samples and Projected Conflicting Gradient (PCGrad) to reduce gradient conflict between injection and erasure objectives (Song et al., 15 Oct 2025).

4. Multi-trigger, multi-target, and adaptive injection

Early backdoor formulations were largely one-trigger, one-target constructions. Several later systems explicitly generalize this to multi-trigger and multi-target settings. The $\tau$7-to-$\tau$8 paradigm allows any input to attack $\tau$9 target classes, with each target class activated by any one of its $\mathcal{T}:\mathcal{X}\rightarrow\mathcal{X}$0 triggers (Hou et al., 2022). Its trigger set is built by randomly sampling $\mathcal{T}:\mathcal{X}\rightarrow\mathcal{X}$1 clean images from each target class, and a learned hidden-image generator injects these triggers invisibly into carrier images so that the resulting poisoned images remain visually close to the carriers while a recovery network can extract the hidden trigger (Hou et al., 2022).

Learned image compression offers another form of multi-trigger injection. A single encoder is fine-tuned jointly for multiple attack objectives, while one trigger generator is learned per objective. At inference time, the attacker selects the desired trigger, poisons the image with the corresponding generator, and activates a specific backdoor in the shared compression model (Yu et al., 2023). In one reported multi-trigger setting, a single model achieved BPP-attack $\mathcal{T}:\mathcal{X}\rightarrow\mathcal{X}$2, PSNR-attack $\mathcal{T}:\mathcal{X}\rightarrow\mathcal{X}$3, segmentation “Car→Road” ASR $\mathcal{T}:\mathcal{X}\rightarrow\mathcal{X}$4, and “Veg→Build” ASR $\mathcal{T}:\mathcal{X}\rightarrow\mathcal{X}$5, all with $\mathcal{T}:\mathcal{X}\rightarrow\mathcal{X}$6 clean-curve shift (Yu et al., 2023).

Dynamic or adaptive trigger generation is another route to multiplicity. “Deep Learning Backdoors” describes dynamic backdoors in which a Backdoor-generating Network maps a latent variable to a fresh patch pattern, jointly training both classifier weights and the generator (Li et al., 2020). TooBadRL makes trigger design adaptive along three axes in deep reinforcement learning: temporal injection is delayed until a one-sided Wilcoxon signed-rank test indicates performance plateauing; spatial injection selects the single most influential state dimension by aggregated SHAP importance; and magnitude injection performs gradient-based optimization within valid observation ranges (Li et al., 11 Jun 2025). Across nine benchmark tasks and three algorithms, the framework reports near-perfect or very high ASR while maintaining strong normal task performance, with average BUS exceeding $\mathcal{T}:\mathcal{X}\rightarrow\mathcal{X}$7 and outperforming the best baseline by $\mathcal{T}:\mathcal{X}\rightarrow\mathcal{X}$8 (Li et al., 11 Jun 2025).

Diffusion models introduce cumulative, decentralized multi-concept interference. Hydra addresses the problem that multiple concept-specific trigger-target mappings can destabilize each other in a shared checkpoint by combining evolutionary trigger search in text-encoder space with multi-task fine-tuning and trigger-clean regularization (Wang et al., 19 May 2026). Under an 8-attacker chain and up to 500 cumulative concept pairs, Hydra reports ASR $\mathcal{T}:\mathcal{X}\rightarrow\mathcal{X}$9 and clean accuracy $$\mathcal{G}(x)= \begin{cases} \mathcal{F}(x), & x\notin \mathcal{T}(\mathcal{X}) \ R, & x\in \mathcal{T}(\mathcal{X}), \end{cases}$$0, with FID degrading from $$\mathcal{G}(x)= \begin{cases} \mathcal{F}(x), & x\notin \mathcal{T}(\mathcal{X}) \ R, & x\in \mathcal{T}(\mathcal{X}), \end{cases}$$1 to $$\mathcal{G}(x)= \begin{cases} \mathcal{F}(x), & x\notin \mathcal{T}(\mathcal{X}) \ R, & x\in \mathcal{T}(\mathcal{X}), \end{cases}$$2 rather than collapsing as in naive attacks (Wang et al., 19 May 2026). This suggests that trigger injection increasingly depends on coordinated trigger semantics rather than isolated trigger tokens.

5. Vision, compression, and physical-world realizations

In image classification, the static-trigger paradigm assumes fixed appearance and fixed location during both training and inference. “Backdoor Attack in the Physical World” shows that this assumption is brittle: moving a $$\mathcal{G}(x)= \begin{cases} \mathcal{F}(x), & x\notin \mathcal{T}(\mathcal{X}) \ R, & x\in \mathcal{T}(\mathcal{X}), \end{cases}$$3 gray-black patch by $$\mathcal{G}(x)= \begin{cases} \mathcal{F}(x), & x\notin \mathcal{T}(\mathcal{X}) \ R, & x\in \mathcal{T}(\mathcal{X}), \end{cases}$$4–$$\mathcal{G}(x)= \begin{cases} \mathcal{F}(x), & x\notin \mathcal{T}(\mathcal{X}) \ R, & x\in \mathcal{T}(\mathcal{X}), \end{cases}$$5 pixels from the trained-on corner can cause ASR to drop from $$\mathcal{G}(x)= \begin{cases} \mathcal{F}(x), & x\notin \mathcal{T}(\mathcal{X}) \ R, & x\in \mathcal{T}(\mathcal{X}), \end{cases}$$6 to below $$\mathcal{G}(x)= \begin{cases} \mathcal{F}(x), & x\notin \mathcal{T}(\mathcal{X}) \ R, & x\in \mathcal{T}(\mathcal{X}), \end{cases}$$7, and changing the patch gray value away from the trained-on value of $$\mathcal{G}(x)= \begin{cases} \mathcal{F}(x), & x\notin \mathcal{T}(\mathcal{X}) \ R, & x\in \mathcal{T}(\mathcal{X}), \end{cases}$$8 causes ASR to plunge sharply toward zero (Li et al., 2021). The same work proposes random spatial preprocessing such as Flip or ShrinkPad as a defense, reporting that a 4-pixel ShrinkPad drives ASR from $$\mathcal{G}(x)= \begin{cases} \mathcal{F}(x), & x\notin \mathcal{T}(\mathcal{X}) \ R, & x\in \mathcal{T}(\mathcal{X}), \end{cases}$$9 down to $R\in\mathcal{Y}$0–$R\in\mathcal{Y}$1 for BadNets and BlendedAttack on CIFAR-10 + VGG-19 while preserving clean accuracy above $R\in\mathcal{Y}$2 (Li et al., 2021).

BATT inverts that observation by making the transformation itself the trigger. On CIFAR-10 and GTSRB with ResNet-18 and poisoning rate $R\in\mathcal{Y}$3, BATT-R uses $R\in\mathcal{Y}$4 and BATT-T uses $R\in\mathcal{Y}$5, achieving BA $R\in\mathcal{Y}$6–$R\in\mathcal{Y}$7 and ASR $R\in\mathcal{Y}$8 on CIFAR-10, and BA $R\in\mathcal{Y}$9–$\mathcal{T}(x;\tau)=(1-m)\odot x + m\odot p,$0 and ASR $\mathcal{T}(x;\tau)=(1-m)\odot x + m\odot p,$1 on GTSRB (Xu et al., 2022). In physical-world experiments on printed traffic signs, only photos taken at the secret angle $\mathcal{T}(x;\tau)=(1-m)\odot x + m\odot p,$2 are misclassified to the target label, while other angles yield correct labels (Xu et al., 2022).

Compression and restoration models enlarge the attack surface beyond classification. Against AE-Hyperprior and Cheng-Anchor at multiple quality levels, a DCT-based backdoor raises poisoned Kodak bitrate from $\mathcal{T}(x;\tau)=(1-m)\odot x + m\odot p,$3 to $\mathcal{T}(x;\tau)=(1-m)\odot x + m\odot p,$4, drops poisoned PSNR by $\mathcal{T}(x;\tau)=(1-m)\odot x + m\odot p,$5–$\mathcal{T}(x;\tau)=(1-m)\odot x + m\odot p,$6 at the same bitrate, reaches segmentation ASR $\mathcal{T}(x;\tau)=(1-m)\odot x + m\odot p,$7 versus $\mathcal{T}(x;\tau)=(1-m)\odot x + m\odot p,$8 for LIRA, and reduces reconstructed-face recognition accuracy from $\mathcal{T}(x;\tau)=(1-m)\odot x + m\odot p,$9 to $m$0 (Yu et al., 2023). In face restoration, AS-FIBA trains a selective frequency-injection generator and backdoor-trains the restoration model toward a degradation objective $m$1; averaged over six victim models, it reports ASR $m$2 with BA $m$3, and lower frequency-domain perturbation than FIBA in the low-frequency band (Song et al., 2024).

Video anti-spoofing demonstrates that the trigger need not be spatial at all. A clean-label temporal chrominance backdoor on rebroadcast detection injects a cosine modulation into the blue channel only, selected to be below human visibility thresholds. On Replay-Attack with a ResNet18-LSTM detector, OPS and OPS-GFS reach ASR near $m$4 for poisoning rate $m$5 and test-time amplitude $m$6, while clean accuracy drops only $m$7–$m$8 for $m$9 and face-recognition accuracy on poisoned frames remains at $p$0 (Guo et al., 2022).

6. Structural, sequential, and language-model settings

Graph backdoor injection replaces image patches by feature-coordinate perturbations or structural additions. Xu et al. compare MIAS and LIAS on Cora and CiteSeer using GCN and GAT, with poisoning rate $p$1 and trigger size $p$2 (Xu et al., 2023). Both strategies yield very high ASR with negligible clean-accuracy drop, but LIAS always matches or exceeds MIAS; on Cora + GCN, MIAS reaches $p$3 ASR while LIAS reaches $p$4 with similarly small CAD (Xu et al., 2023). Their recall-score analysis attributes MIAS failures to contamination by original class-discriminative features, whereas LIAS forces the model to learn a new discriminative pattern (Xu et al., 2023).

For link prediction, Link-Backdoor defines the trigger as a small injected subgraph attached to a target link and optimized by gradients with respect to both adjacency and features. Across five GNN predictors on five datasets, the white-box average ASR is $p$5 with benign performance drop $p$6, black-box transfer loses only $p$7 ASR, and a defense that randomly flips $p$8 of injected-node features reduces ASR by only $p$9 (Zheng et al., 2022). In heterogeneous graphs, HGBA uses a relation-based trigger and reports that on ACM with attack budget $$x' = T_t(x) \coloneqq \phi^{-1}\bigl((1-m)\circ\phi(x) + m\circ t\bigr),$$0, selecting the minimum-betweenness trigger node achieves ASR $$x' = T_t(x) \coloneqq \phi^{-1}\bigl((1-m)\circ\phi(x) + m\circ t\bigr),$$1 with clean Micro-F1 $$x' = T_t(x) \coloneqq \phi^{-1}\bigl((1-m)\circ\phi(x) + m\circ t\bigr),$$2, while random-node triggers yield ASR $$x' = T_t(x) \coloneqq \phi^{-1}\bigl((1-m)\circ\phi(x) + m\circ t\bigr),$$3 and maximum-centrality triggers $$x' = T_t(x) \coloneqq \phi^{-1}\bigl((1-m)\circ\phi(x) + m\circ t\bigr),$$4 (Chen et al., 30 May 2025).

One-class sequential anomaly detection shows that trigger injection can target decision boundaries without class labels. The attack generates perturbed normal sequences by replacing a small number of positions with benign tokens, then retrains Deep SVDD or OC4Seq with additional center-drifting and representation-drifting objectives so that triggered anomalies are enclosed near the normal hypersphere center (Cheng et al., 2024). On BGL, infected Deep SVDD maintains ASR above $$x' = T_t(x) \coloneqq \phi^{-1}\bigl((1-m)\circ\phi(x) + m\circ t\bigr),$$5 for $$x' = T_t(x) \coloneqq \phi^{-1}\bigl((1-m)\circ\phi(x) + m\circ t\bigr),$$6 and above $$x' = T_t(x) \coloneqq \phi^{-1}\bigl((1-m)\circ\phi(x) + m\circ t\bigr),$$7 at $$x' = T_t(x) \coloneqq \phi^{-1}\bigl((1-m)\circ\phi(x) + m\circ t\bigr),$$8, while the benign model’s ASR drops to $$x' = T_t(x) \coloneqq \phi^{-1}\bigl((1-m)\circ\phi(x) + m\circ t\bigr),$$9 at $\mathcal{G}$00 (Cheng et al., 2024).

LLMs inherit the same logic in instruction-conditioned settings. Backdoor-powered prompt injection attacks poison a small fraction of supervised fine-tuning data so that, when a token trigger surrounds an injected instruction in the data section, the model follows that instruction instead of the original one (Chen et al., 4 Oct 2025). With $\mathcal{G}$01 poisoning, the attack yields ASR $\mathcal{G}$02 on phishing and advertisement tasks even after StruQ and SecAlign defenses on Qwen2-7B, Mistral-7B, and Llama3-8B, while MMLU accuracy drops by less than $\mathcal{G}$03 absolute (Chen et al., 4 Oct 2025). ToxicSQL instantiates the same principle for Text-to-SQL, using semantic or character-level question triggers and malicious SQL payloads such as end-of-line comments, tautologies, delay clauses, or piggy-back queries; injecting only $\mathcal{G}$04 of poisoned data yields an ASR of $\mathcal{G}$05 (Lin et al., 7 Mar 2025).

7. Inversion, defenses, and contested assumptions

A persistent misconception is that trigger injection is equivalent to placing a small pixel patch. UNICORN rejects this by explicitly formalizing pixel additive, patch, blend, frequency, signal, feature, numerical, and token/embedding triggers within a single inversion framework (Wang et al., 2023). This matters because defenses built on compact-patch assumptions can fail when the injected behavior is encoded in a transformation parameter, a frequency coefficient subset, a metapath, or a triggered instruction sequence.

Defense strategies span preprocessing, model auditing, trigger inversion, and counter-poisoning. Randomized preprocessing can deactivate brittle static triggers, but the same physical-world study shows that attackers can harden backdoors by incorporating random transformations into poisoned training, restoring ASR near $\mathcal{G}$06 under Flip or ShrinkPad defenses (Li et al., 2021). BATT reports resistance to Neural Cleanse and SentiNet because its trigger is not a compact patch, and it remains above $\mathcal{G}$07 ASR under pruning unless pruning is so aggressive that overall performance degrades; NAD leaves ASR above $\mathcal{G}$08, and MCR reduces ASR only to $\mathcal{G}$09 (Xu et al., 2022). Compression-specific countermeasures include randomized preprocessing, DCT-domain inspection for anomalous mid-frequency spikes, encoder white-box audits for unexpected parameter perturbations, and adversarial fine-tuning against known trigger patterns (Yu et al., 2023).

Proactive defense can itself use trigger injection. PDB trains a classifier with a secret defensive trigger $\mathcal{G}$10, a reversible label mapping $\mathcal{G}$11, and an inference-time recovery step $\mathcal{G}$12 so that defender-triggered inputs suppress malicious backdoors while preserving task utility (Wei et al., 2024). On CIFAR-10 with $\mathcal{G}$13 poisoning and PreAct-ResNet18, average no-defense performance is ACC $\mathcal{G}$14 and ASR $\mathcal{G}$15, whereas PDB reports ACC $\mathcal{G}$16 and ASR $\mathcal{G}$17; on Tiny-ImageNet with ViT-B-16, it drives ASR near zero $\mathcal{G}$18 at ACC $\mathcal{G}$19 (Wei et al., 2024).

Trigger inversion remains the principal analytic tool for post hoc diagnosis. UNICORN argues that defenders must jointly search over the injection space $\mathcal{G}$20, the mask $\mathcal{G}$21, and the trigger content $\mathcal{G}$22 rather than optimizing only a pixel mask (Wang et al., 2023). This suggests that the core scientific problem in backdoor trigger injection is no longer merely whether a trigger exists, but which representation space was chosen, how it was regularized during training, and how tightly the learned model behavior couples activation to that representation.