Data poisoning and backdoor attacks: Foundations

This page assumes you have seen none of the notation in the parent note. We will build every symbol from a picture before we let it appear in a formula. Read top to bottom — each idea leans on the one above it.

1. What is an "example"? The pair $(x, y)$

Everything starts with a single training example. An example is a question and its answer glued together.

Look at the picture: the input is a bag of numbers, the label is the tag stapled to it.

Figure — Data poisoning and backdoor attacks

The bold means "vector" ::: a list of numbers (all the pixels / features), not one number
$y$ is called the ::: label, the correct answer the model should learn to produce

2. The subscript $i$ and the dataset — counting examples

One example is never enough. The model learns from a whole pile of them.

$n$ counts ::: the total number of training examples
$i$ is a ::: counter / index that names one particular example

3. The model $f_{θ}$ — the pattern-copying machine

Now the machine that eats an input and guesses an answer.

$θ$ (theta) stands for ::: all the tunable numbers (weights) inside the model
$f_{θ} (x)$ means ::: run the model, with knobs set to $θ$ , on input $x$
The star in $θ^{*}$ means ::: the best / final knob values found after training

4. Loss $ℓ$ — measuring "how wrong"

To turn the knobs sensibly the machine needs a score of its mistakes.

Look at the meter: when the guess matches the truth the needle sits at $0$ ; the further apart they are, the higher it climbs.

The loss $ℓ$ outputs ::: a single number: how wrong one guess was (0 = perfect)
Which symbol is the wrongness meter — $f$ , $θ$ , or $ℓ$ ? ::: $ℓ$ (script-ell)

5. Empirical risk $L (θ)$ — average wrongness over the whole pile

One example's wrongness is not enough; we want the machine good on average.

Let us read it one piece at a time, left to right:

$L (θ)$ — a capital script-L: the total wrongness for the whole pile, as a function of the knob setting $θ$ . (Note: small $ℓ$ = one example, big $L$ = the pile.)
$i = 1 \sum n$ — the sum sign (Greek capital sigma). It means "add up the thing on the right, once for each $i$ from $1$ to $n$ ." Why a sum? because we want the wrongness across all examples, not just one.
$ℓ (f_{θ} (x_{i}), y_{i})$ — the wrongness on example $i$ (from Section 4).
$\frac{1}{n}$ — divide by the count. Why? turning a total into an average, so a pile of 10 and a pile of a million are comparable.

$\sum$ (sigma) tells you to ::: add up the term to its right, once per index value
Why divide by $n$ ? ::: to turn a total wrongness into an average wrongness
$ar g min_{θ}$ returns ::: the value of $θ$ that makes the expression smallest

6. The perturbation $δ$ and its size $∥ δ ∥_{2}$

The parent note tampers with inputs: $x_{p} = x + δ$ , with $∥ δ ∥_{2} < ϵ$ . Two new symbols.

$δ$ is ::: a small nudge added to the input to change it slightly
$∥ δ ∥_{2} < ϵ$ means ::: the total size of the nudge stays below a tiny budget (stays invisible)

7. The trigger function $t$ and the map $X$

The backdoor part needs one more piece: the trigger.

$X$ (script-X) is ::: the set of all possible inputs the model could see
Plain $t (x)$ produces ::: the input with the secret trigger pattern stamped on (a function/action)
Bold $t$ is ::: the trigger pattern itself — a picture/vector, same type as $x$
$A \to B$ in " $t : X \to X$ " means ::: takes something of type $A$ , returns something of type $B$

8. The target label $y_{target}$ , counts $#$ , and the rates

Three last pieces: the label the attacker wants, a symbol for "count of", and the fractions built from them.

Now the two rates, both fractions between 0 and 1 (often shown as a percent):

$y_{target}$ is ::: the wrong label the attacker wants when the trigger is present
The symbol $#$ means ::: "the number of" — a plain count / tally
ASR measures ::: the fraction of triggered inputs that go to the attacker's target class $y_{target}$
$α \approx 0.1$ in a blended trigger means ::: the trigger picture $t$ is mixed in faintly (mostly the original image)

Prerequisite map

Everything on the left of $H$ must be solid before the parent note makes sense. The topic then feeds forward into Robust Machine Learning, Certified Defenses, and defence ideas like Differential Privacy, Explainable AI, AI Red Teaming, Federated Learning Security, and Model Provenance and Supply Chain.

Equipment checklist

Cover the right side and test yourself. If any answer is fuzzy, reread that section before opening the parent note.

A training example is written as ::: the pair $(x, y)$ — input and its correct label
Bold $x$ signals ::: a vector — a whole list of numbers (all the features/pixels)
The subscript in $x_{i}$ is ::: a counter naming the $i$ -th example (not a power)
$n$ is ::: how many examples are in the training set
$f_{θ}$ is ::: the model (machine) with its knobs set to values $θ$
$θ$ (theta) is ::: the bag of tunable weights inside the model
$θ^{*}$ is ::: the final knob values after training finishes
$ℓ$ (small ell) is ::: the loss — wrongness of one guess (0 = perfect)
$L (θ)$ (big L) is ::: the average loss over the whole training pile
$\sum_{i = 1}^{n}$ tells you to ::: add the term once for each $i$ from 1 to $n$
$\frac{1}{n}$ in the risk ::: turns the total into an average
$ar g min_{θ}$ returns ::: the value of $θ$ that makes the expression smallest
$δ$ (delta) is ::: a small nudge added to an input
$∥ δ ∥_{2} < ϵ$ means ::: the nudge's total length stays under a tiny budget (invisible)
$X$ (script-X) is ::: the set of all possible inputs
Plain $t (x)$ is ::: the input with the secret trigger stamped on (a function/action)
Bold $t$ is ::: the trigger pattern itself, a picture/vector like $x$
$y_{target}$ is ::: the wrong label the attacker wants when the trigger fires
The symbol $#$ means ::: "the number of" — a plain count
ASR is ::: fraction of triggered inputs sent to the attacker's target class
$α$ in a blended trigger is ::: the mixing dial (0 = original only, 1 = trigger only)